Privacy Policy

Last updated: October 12, 2026

This website is intentionally light on data. No third-party fonts, and web analytics and advertising measurement only if you allow it. Below is a complete account of what happens with personal data when you visit simonziri.com, written to be read, not just filed.

1. Controller

Responsible for data processing on this website (see Imprint):

ZIRI GmbH
Germanenweg 49
71272 Renningen
Germany
E-mail: simon@simonziri.com

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the site, Vercel processes technical connection data (IP address, date and time of access, requested URL, browser and operating system information) in server logs. This is technically necessary to deliver the website and to keep it secure.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing a secure, functioning website. Vercel may process data in the USA; transfers are safeguarded by the EU Standard Contractual Clauses and Vercel’s participation in the EU-U.S. Data Privacy Framework. Log data is automatically deleted by Vercel after a short retention period.

3. Contact form

When you use the contact form, we process the data you enter:

  • your work e-mail address (required)
  • your company website (optional)
  • your answers to the qualification questions and anything you write in the message field (optional)

We use this data exclusively to respond to your inquiry and to prepare a potential collaboration. Submissions are not stored on the web server — they are forwarded directly to our e-mail inbox and kept there for as long as the correspondence requires, at most until the statutory retention periods expire.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, taken at your request) and your consent, Art. 6(1)(a) GDPR, which you give via the checkbox before sending. You can withdraw this consent at any time with effect for the future by e-mailing us. The form uses an invisible technical field to filter out automated spam; no captcha service and no third party is involved.

4. Training sign-up form

When you sign up for one of our free recorded trainings, we process:

  • your work e-mail address
  • your answer to one short question: what describes you best (for example B2B tech, B2B services or agency)
  • whether you also want our newsletter (optional, separate checkbox; you only receive it after confirming via a link we e-mail you, and you can unsubscribe at any time)
  • which training you signed up for and, if the link you arrived through contained them, the campaign parameters utm_source, utm_campaign and utm_content (these tell us which ad or post brought you to the page; they are read from the address bar, no cookies are set)

We use this data to send you the training and to follow up with you about it. Submissions are not stored on the web server; they are forwarded directly to our e-mail inbox, to our e-mail service provider beehiiv and to our CRM Pipedrive (see below). We keep them for as long as needed to deliver the training and follow up on it. If no further exchange with you follows, we delete them no later than 12 months after our last contact with you, or earlier if you withdraw your consent. If a business conversation develops from it, we keep your details for as long as that relationship requires and as statutory retention periods demand.

Legal basis: your consent, Art. 6(1)(a) GDPR, which you give via the checkbox before sending. You can withdraw it at any time with effect for the future by e-mailing us. As with the contact form, an invisible technical field filters out automated spam; no captcha service is involved.

We use two processors for the training sign-up:

  • beehiiv (beehiiv Inc., USA), our e-mail service provider. We use it to send you the training and, only if you ticked the separate newsletter checkbox and confirmed via the link, our newsletter. beehiiv receives your e-mail address, your answer to that question, the training, whether you opted in to the newsletter and the campaign parameters. beehiiv may process data in the USA; transfers are safeguarded by the EU Standard Contractual Clauses.
  • Pipedrive (Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia), our CRM. We use it to keep track of sign-ups and our follow-up. Pipedrive receives the same data as listed above.

Optional form on the thank-you page. After signing up you can tell us which topic is most pressing for you right now. This form is voluntary. We process your answers together with your e-mail address so we know who they come from, to shape the training and our follow-up. They are forwarded to our e-mail inbox and stored as a note in Pipedrive, with the same retention as above. Legal basis: our legitimate interest in tailoring the training to its participants, Art. 6(1)(f) GDPR. To avoid asking for your e-mail address twice, your browser keeps it in its session storage for this tab only. It is not placed in the page address or in a cookie, is not shared with analytics or advertising services, and is deleted when you close the tab.

Both process the data on our behalf under a data processing agreement.

5. E-mail delivery (Resend)

Submissions from the contact form and the training sign-up form are delivered to our inbox via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which processes the submitted data on our behalf under a data processing agreement. Resend may process data in the USA; transfers are safeguarded by the EU Standard Contractual Clauses.

6. Embedded videos (YouTube)

Individual case study pages embed videos via YouTube’s privacy-enhanced player (youtube-nocookie.com), operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. In this mode YouTube does not set advertising cookies before you play a video; when the player loads, your IP address is nevertheless transmitted to Google. If you start playback, Google may process usage data under its own privacy policy.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in presenting our work; playback only happens on your initiative.

7. Google Analytics 4 (only with your consent)

If you allow “Statistics” in our privacy banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We load it through Google Tag Manager, a tool from the same provider that loads the analytics script. Without your consent to “Statistics”, Google Analytics does not run. Google Tag Manager itself is only loaded once you allow “Statistics” or “Marketing” (see section 7b); before that, no data is sent to Google.

Google processes the data on our behalf as a processor under Google’s data processing terms (Art. 28 GDPR).

Purpose: we want to understand how visitors use this site, which pages are read, and which campaigns bring visitors and sign-ups. When you send the contact form or sign up for a training, we record that a sign-up happened (and for which training), not what you entered.

Data processed:

  • pseudonymous identifiers stored in the cookies _ga and _ga_<id>, which recognize your browser across visits and sessions
  • usage data such as pages viewed, time of the visit, scrolling, clicks on outbound links and file downloads
  • your IP address, which Google uses on servers in the EU only to derive an approximate location (country, region, city) and then discards; Google Analytics 4 does not store full IP addresses
  • device type, operating system, browser and screen size
  • the referring website and campaign parameters in the link you arrived through (for example utm_source or utm_campaign)

Google signals and ad personalization are turned off. We do not combine this data with other data about you.

Legal basis: your consent, Art. 6(1)(a) GDPR, and for storing and reading the cookies on your device § 25(1) TDDDG.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR).

Retention: we have set the data retention in Google Analytics to 14 months; after that, event data is deleted automatically. The cookies expire after at most 2 years.

You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. When you withdraw, Google Analytics stops collecting data and we delete the _ga cookies from your browser. More in Google’s privacy policy.

7a. Microsoft Clarity (only with your consent)

If you allow “Statistics”, we also use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us how visitors interact with our pages through heatmaps and session recordings (mouse movements, clicks, scrolling). Text you type into form fields is masked and not recorded. Clarity sets the cookies _clck and _clsk (up to one year) and is loaded through Google Tag Manager, only after your consent.

Purpose: to find out where our pages are unclear or hard to use and improve them. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-US Data Privacy Framework. Microsoft keeps Clarity data for up to 13 months. You can withdraw your consent at any time via “Cookie settings” in the footer; Clarity then stops and its cookies are removed. More in Microsoft’s privacy statement.

7b. Meta Pixel (only with your consent)

If you allow “Marketing” in our privacy banner, we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). Like our analytics tools, it is loaded through Google Tag Manager (see section 7) and only after your consent. Without your consent, the Meta Pixel is not loaded and no data is sent to Meta.

Purpose: to measure which of our ads on Facebook and Instagram lead to sign-ups, to optimise the delivery of our ads, and possibly to show our ads to people who have visited this site.

Data processed:

  • identifiers stored in the cookies _fbp and _fbc, which recognize your browser and the ad you clicked
  • pixel events such as PageView (a page was viewed) and Lead (a sign-up happened, without what you entered in the form). We only send the Lead event for training sign-ups that are not from agencies; your answer itself is not sent to Meta
  • your IP address
  • browser and device information
  • the URL of the page you are on

In addition to the pixel in your browser, Meta sends the same events from its own servers to Meta (Meta’s “Conversions API”). This only covers events the pixel has captured after your consent; without consent, nothing is sent this way either.

For the collection of this data on our website and its transmission to Meta, we and Meta are joint controllers (Art. 26 GDPR). We have agreed with Meta on the respective responsibilities in Meta’s Controller Addendum; under it, Meta is the contact point for exercising your rights regarding this processing, though you can also contact us. The further processing of the data after the transmission is Meta’s own responsibility.

Legal basis: your consent, Art. 6(1)(a) GDPR, and for storing and reading the cookies on your device § 25(1) TDDDG.

Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR).

The cookies _fbp and _fbcexpire after 90 days. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. When you withdraw, the Meta Pixel stops sending data and we delete the _fbp and _fbc cookies from your browser. More in Meta’s privacy policy.

7c. LinkedIn Insight Tag (only with your consent)

If you allow “Marketing” in our privacy banner, we use the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). It is loaded through Google Tag Manager (see section 7) and only after your consent. Without your consent, the tag is not loaded and no data is sent to LinkedIn.

Purpose: to measure which of our LinkedIn ads lead to sign-ups, to receive aggregated, anonymous reports about the companies, job functions and industries of our visitors, and possibly to show our ads on LinkedIn to people who have visited this site.

Data processed: cookies set by LinkedIn (for example li_fat_id, bcookie, lidc, UserMatchHistory), your IP address, browser and device information, the page URL and referrer, and events such as a sign-up (without what you entered in the form). If you are logged in to LinkedIn, LinkedIn can link this data to your LinkedIn account; we only receive aggregated reports and never see who you are.

For the collection on our website and the transmission to LinkedIn, we and LinkedIn are joint controllers (Art. 26 GDPR) under LinkedIn’s terms for the Insight Tag. The further processing after transmission is LinkedIn’s own responsibility. Legal basis: your consent, Art. 6(1)(a) GDPR, and for storing and reading cookies on your device § 25(1) TDDDG.

LinkedIn may transfer data to LinkedIn Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). LinkedIn cookies expire after up to 180 days. You can withdraw your consent at any time via “Cookie settings” in the footer. More in LinkedIn’s privacy policy.

Our privacy banner offers three categories: “Necessary” (always on, only stores your choice), “Statistics” (Google Analytics and Microsoft Clarity, see sections 7 and 7a) and “Marketing” (Meta Pixel and LinkedIn Insight Tag, see sections 7b and 7c). Google Tag Manager is loaded as soon as you allow at least one of Statistics or Marketing; each tool only runs for the category you allowed.

When you make a choice in our privacy banner, we store it in your browser’s local storage: which categories you allowed, a version number and the time of your choice. No cookie is set and nothing is sent to us or to anyone else. We need this so the site remembers your choice and does not ask again on every page.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary to provide the service you requested) and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (we have to be able to show your consent). The entry stays until you change your choice or clear your browser storage.

9. What this site does not do

  • No analytics without your consent: Google Analytics and Microsoft Clarity only run after you allow it (see sections 7 and 7a).
  • No advertising pixels or marketing cookies without your consent: the Meta Pixel and the LinkedIn Insight Tag only run after you allow it (see sections 7b and 7c).
  • No third-party fonts or CDNs — fonts are served from our own server.
  • No profiling, no automated decision-making.

Should we introduce further tools in the future, we will update this policy beforehand and, where legally required, ask for your consent first.

10. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17) and restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, e-mail simon@simonziri.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence.

11. Changes to this policy

We update this policy whenever the website’s functionality changes in a way that affects personal data. The date above always reflects the current version.