Zemerc Ltd is the controller. This notice describes the website as it actually behaves, not as a list of rights reserved: where something is not done, it says so rather than reserving the option to start.
The controller for the personal data described in the privacy notice is located at 84 Oakland Avenue, Heworth, York, North Yorkshire, YO31 1DF, United Kingdom. Privacy requests can be sent to privacy@zemerc.com.
No analytics package, tag manager, advertising technology, profiling or cross-site tracking exists anywhere on this website. Verified by loading every public page with the network recorded.
What you send is emailed to Zemerc so it can be answered. This website keeps no copy of it and holds no enquiry database.
A YouTube-hosted tour loads only after you allow external media and press play. Nothing reaches YouTube before that.
The one thing stored is your own choice, kept in your browser and removable at any time.
This notice explains what Zemerc does with personal data when you use this website. It is written to be read, so it describes what the website actually does rather than reserving every right it might one day need.
Where this website does not do something, this notice says so. If that changes, this notice changes with it, and where the change needs your agreement you will be asked before it takes effect.
Zemerc Ltd, trading as Zemerc, is the controller of the personal data described in this notice. Zemerc Ltd is a company registered in England and Wales, registered office 84 Oakland Avenue, Heworth, York, North Yorkshire, YO31 1DF, United Kingdom.
Privacy questions and requests relating to personal data can be sent to privacy@zemerc.com or submitted through the contact form by selecting "Privacy question". Both routes are handled as privacy enquiries.
No data protection officer is designated. On the processing described here, none of the conditions that require a designation under Article 37 of the UK GDPR is met. If that position changes, this notice will name the designation and how to reach it.
Controller details
This notice covers the public pages of this website: what you read, the enquiry form, the preference you may set, and the assistant on the page.
It does not cover the Zemerc applications. Each application is supplied under its own agreement, and the operational records held inside it (the registers, documents and evidence your teams keep) are governed by that agreement and the data processing terms attached to it. Where Zemerc processes such records, it generally does so as a processor acting on your instructions, not as the controller described here. Nothing in this notice varies that agreement.
It also does not cover sites Zemerc does not operate. Where a page links somewhere else, that destination has its own notice.
Reading these pages does not create a profile of you. The website sets no cookies, runs no analytics, contains no advertising, marketing or tag-management technology, and makes no third-party requests as you move around it. Typefaces are served from this website rather than fetched from a font service.
Personal data is processed in four circumstances: when you submit an enquiry, when information is required to protect the website from misuse or abuse, when external media is loaded where applicable, and when you use Maya, including voice input where you choose to use the microphone.
The assistant on the page answers from material published on this website. It is described separately under Maya.
All of it comes from you, directly. Zemerc does not buy personal data, does not enrich what you send from third-party sources, and receives nothing about you from data brokers, advertising networks or social platforms.
Nothing on this website requires an account, and the public site has no sign-in.
The record below is the complete set of processing this website performs. The lawful bases are those in Article 6(1) of the UK GDPR; where EU law applies, the equivalent provisions of the EU GDPR are relied upon.
Where legitimate interests are relied upon, the specific interest is stated rather than the phrase used generically. You may object to processing on that basis, and how to do so is set out under Your rights.
Processing record
Where legitimate interests are the basis, Zemerc has considered whether the interest is overridden by your interests, rights and freedoms. The assessment is short because the processing is small.
Answering an enquiry you chose to send is within your reasonable expectations, uses only business contact details you supplied, and produces nothing beyond a reply. Protecting the endpoint uses a hashed value that cannot be read back to an address, is never linked to your enquiry and never leaves the server. Tracing a delivery records a reference and a category, not you or what you wrote.
None of this involves profiling, monitoring, combining data from other sources, or any use for marketing.
The form asks for your name, work email address and what you need, and for the category of enquiry so it reaches the right people. Organisation, role, region, industry, the application and the operating area are optional and exist so the person who answers understands the context.
The checkbox at the end of the form is an acknowledgement that you have read how the enquiry is handled. It is not consent under data protection law, and ticking it is not the lawful basis for answering you.
When you submit, the form posts to an endpoint on this website. The endpoint re-checks everything the browser checked, then hands the enquiry to an email delivery provider, which delivers it to a Zemerc mailbox. Your email address is set as the reply address so a reply comes straight back to you.
This website keeps no copy. There is no enquiry database behind it: once the provider has accepted the message, the only record is the email in the mailbox it reached.
If delivery is not available (because it is not configured, or the provider refuses the message) you are told plainly that the message was not sent, and nothing is held for a later attempt. You will never see a confirmation for a message that did not go.
The enquiry form cannot currently deliver. The delivery provider is not configured in this environment, so a submission is refused rather than silently stored. This notice will not describe delivery as working before it does.
Any website is delivered by infrastructure that must process network requests (including the originating address and the request headers) in order to return a page at all, and such infrastructure ordinarily records some of that for operational and security purposes.
The Zemerc website is hosted on Vercel and delivered through Vercel’s infrastructure. Network request data, including the originating address and request headers, is necessarily processed to deliver the website. Vercel’s own logging contents, retention periods and applicable international-transfer arrangements are not stated here where they have not yet been independently verified.
Application tours hosted by Zemerc play from this website and involve no third party.
A tour hosted on YouTube is different. Loading it would let YouTube receive your request and set its own technologies under its own policy. This website therefore loads nothing from YouTube unless you have allowed external media and then pressed play. Until both are true, such a tour shows a poster image and a direct link, and nothing is requested from YouTube.
The map on the contact page works the same way. It is served by Google, so nothing is requested from Google until you have allowed external media and then pressed the button to load it. The map is centred on York, the city of the registered office, and marks no building.
No tour is currently hosted on YouTube, and the map is not yet configured on this environment, so in practice no external media loads at all.
Maya is the assistant available from the corner of the page. It answers from material already published on this website (application descriptions, operating areas, services, resources and answers to common questions) by matching your question against that material and returning what it finds.
When you use Maya, your question is sent to an endpoint operated by Zemerc and then processed by our AI service provider to generate a response. Zemerc does not retain your Maya conversation after the session ends. Maya conversations are not linked by Zemerc to enquiries you submit through the website, and you are not required to provide your identity to use Maya.
Maya uses an AI service provider to process questions and generate responses. If you choose to use voice input, the audio required to transcribe your question is also processed through the service. Voice input is optional and you can continue to use Maya by typing.
Zemerc uses an AI service provider to support Maya. This notice describes the categories of information processed when Maya is used and will be updated if the way the service operates, the information processed or the relevant provider arrangements materially change.
Zemerc does not sell personal data, does not share it with advertisers or data brokers, and operates no advertising, profiling or cross-site tracking on this website.
The record below lists every provider that could receive personal data because of your use of these pages, and its actual status today. A provider used elsewhere in the Zemerc environment is not listed here unless this website sends it something.
No executed data processing terms have been reviewed for the providers below in preparing this notice. Rather than assert that Article 28 terms are in place, this notice states the arrangement and records the point as outstanding.
Website recipients
Some of the service providers used by this website may process personal data outside the United Kingdom. Vercel currently provides the website’s hosting and infrastructure and may process network and request data through infrastructure outside the United Kingdom. Google Maps may also receive information when a visitor has given consent to external media and chooses to open a map.
Zemerc is verifying the applicable international-transfer arrangements and contractual safeguards for these services. Where UK data-protection law requires a transfer mechanism, this may include reliance on adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, as applicable. This notice will be updated to identify the relevant mechanism where it has been verified and is required to be disclosed.
Additional service providers, including providers used for Maya or email delivery, will not be treated in this notice as active production recipients until they have been appointed and enabled. Before production activation, Zemerc will verify their processing locations, contractual arrangements and any applicable international-transfer safeguards, and will update this notice where required.
It is worth separating two different things: how long Zemerc intends to keep something, and whether a system enforces that automatically. Only the second is a guarantee, and on this website almost nothing is enforced because almost nothing is stored.
This website stores no enquiry. What persists is the email in the destination mailbox, and that is kept for as long as the correspondence is kept. Zemerc’s intention is to hold website enquiry correspondence for no longer than 24 months after the last contact about it, and to review it then. That is a policy, not an automated control: no deletion job runs against the mailbox, and this notice will not imply otherwise.
The abuse-protection counter is held in memory for a five-minute window and is lost when the server process restarts. Your external-media preference sits in your browser for twelve months or until you clear it. Zemerc does not retain your Maya conversation after the session ends. Requests are processed by our AI service provider in accordance with its applicable data-retention controls.
Retention of records inside a Zemerc application is a different matter, governed by the agreement for that application rather than by this notice.
Retention
The measures that apply to this website are: the enquiry endpoint validates every submission on the server rather than trusting the browser; it refuses oversized requests; it rate-limits by a hashed address; it silently discards submissions that are detected as automated; it never returns success for a message that was not delivered; and it logs no enquiry content.
Personal data in transit is protected by the transport security of the connection you are using. Some security controls also depend on the hosting, infrastructure and mailbox providers used in production. The website is hosted on Vercel; no additional claim is made here about provider-specific controls that have not been independently verified.
Controls inside the Zemerc applications are a separate matter and are described on the trust page, which distinguishes what applies to this website from what applies to an application running under its own agreement.
No security measure is perfect, and this notice does not describe any as such.
Where Zemerc holds personal data about you, data protection law gives you rights over it. In the United Kingdom these are set out in the UK GDPR and the Data Protection Act 2018; in the European Economic Area, in the EU GDPR.
Browsing these pages creates nothing for Zemerc to hold. If you send an enquiry, what Zemerc holds is the email it became, in the mailbox it reached: and that is what a request would be answered from.
To exercise a data-protection right, write to privacy@zemerc.com or use the enquiry form and select "Privacy question". Zemerc will respond within the applicable legal timeframe and may request information necessary to confirm identity. Any extension or fee will be handled only where permitted by applicable law.
If you are not satisfied with how Zemerc has handled your personal data or your request, please raise it first so it can be put right.
You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s supervisory authority for data protection, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaining to Zemerc first is not a precondition.
If you are in the European Economic Area and the EU GDPR applies to the processing, you may instead complain to the supervisory authority of the Member State where you live, work, or where the matter arose.
Zemerc is established in England and Wales and operates this website from the United Kingdom. The markets listed by the company are the United Kingdom, the European Union, the Middle East, Africa, the United States.
The EU GDPR applies to a controller outside the Union only where it offers goods or services to people in the Union, or monitors their behaviour there. This website monitors nobody: it runs no analytics, sets no cookies and performs no tracking of any kind. Where it does apply because an enquiry concerns services offered into the Union, the rights described above apply in the same terms under the EU GDPR.
No representative in the Union is appointed under Article 27, and none is named on this website. Whether an appointment is required, and by whom it would be held, is being determined; this notice will name a representative only once one has been formally appointed. Naming a person because a document mentions them would not be an appointment.
A representative in the United Kingdom is not required: Article 27 of the UK GDPR applies to controllers established outside the United Kingdom, and Zemerc is established in England and Wales.
This website is a business website, directed at organisations and the people who work in them. It is not directed at children, offers nothing to them and does not knowingly process their personal data.
If you believe a child has sent personal data through this website, write to the privacy address and it will be deleted.
Zemerc makes no decision about you by automated means on this website, and carries out no profiling. Nothing here scores, ranks, segments or evaluates you, and no outcome that affects you is produced without a person.
Routing an enquiry to a mailbox by the category you selected is not a decision about you; it determines who reads your message.
Maya returns published material in response to a question. It makes no decision about you and holds nothing about you.
This website neither asks for nor requires special category data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, or sex life or sexual orientation) nor data about criminal offences or convictions.
The enquiry form is a free-text field, so you could type such information into it. Please do not. If you do, it is processed only to the extent necessary to answer you and is not used for anything else.
This notice describes current behaviour. If the website begins doing something it does not do today (introducing analytics, storing enquiries rather than only emailing them, or adding another embedded service) this notice is updated to describe it before the change takes effect.
Where a change requires your consent, you will be asked. Where it changes a material part of how your personal data is handled, the change will be flagged rather than left for you to find.
This notice has not yet been approved for production publication. The date it takes effect will be recorded here when it is.
Privacy questions, requests relating to personal data and complaints can be sent to privacy@zemerc.com or submitted through the contact form by selecting "Privacy question".
Postal correspondence can be addressed to the Privacy Contact, Zemerc Ltd, 84 Oakland Avenue, Heworth, York, North Yorkshire, YO31 1DF, United Kingdom. General enquiries can be sent to info@zemerc.com or made by telephone on +44 7775 870174.
Questions about information held through an existing implementation are answered for that application. Raise it and it will reach the team responsible.
