Privacy Policy

1. Data we collect

We collect only what is needed to answer your request and run a project.

• Data you give us: name, company, email, phone number, service of interest, indicative budget, timeline and the content of your message. It reaches us through the website contact form, a Facebook or Instagram instant form, WhatsApp, or a direct email.
• Conversation content: WhatsApp messages, attachments, voice notes and emails you send us, along with our replies.
• Project data, if you become a client: whatever the engagement requires (content, technical access, billing details).
• Technical data: IP address, browser and device type, approximate country, pages viewed and referring site. Used for security, site delivery and aggregate analytics.
• Advertising data: when a conversation starts from a Facebook or Instagram ad, an ad click identifier is passed along with the message by Meta and stored with your conversation.

2. Meta ads and instant forms

If you submit a Facebook or Instagram instant form, Meta collects the information you confirm in that form and passes it to us. We use it to get back to you about your enquiry. Meta's own processing inside its platforms is governed by Meta's privacy policy.

To measure campaign quality, we send an event back to Meta through the Conversions API indicating that an ad-sourced contact turned into a qualified conversation or a sale. That event carries the ad click identifier and your phone number as a SHA-256 hash, never in clear text. No conversation content and no attachments are sent to Meta.

The zelos.tn website installs no Meta pixel and sets no advertising cookies.

3. Analytics

We use Plausible Analytics, an EU-hosted, cookie-free analytics tool that assigns no individual identifier. It produces aggregate counts: page views, traffic sources, clicks on contact buttons. Nothing in it identifies you or tracks you across sites.

Site infrastructure runs through Cloudflare, which logs requests technically in order to filter attacks and serve pages.

4. Purposes and legal bases

• Answering your enquiry, quoting and following up. Legal basis: pre-contractual steps taken at your request.
• Delivering and invoicing an engagement. Legal basis: performance of the contract.
• Measuring and improving site and campaign performance. Legal basis: legitimate interest in promoting our services, implemented with aggregate or pseudonymised data.
• Meeting accounting and tax obligations. Legal basis: legal obligation.
• Keeping the site secure and preventing abuse. Legal basis: legitimate interest.

5. Recipients and processors

Your data stays inside Zelos. It is hosted and processed by a small set of technical providers, each limited to one role:

• Our hosting provider for the website and database (dedicated server located in the European Union).
• Cloudflare, for site delivery and protection.
• Meta Platforms, for ads, instant forms and WhatsApp messaging.
• Plausible Analytics, for aggregate statistics.
• Our mail server, for routing the emails tied to your request.

6. Transfers outside Tunisia

Some of the providers above are established in the European Union or the United States. Transfers to Meta rely on the contractual safeguards that provider offers. We never sell or rent your data.

7. Retention periods

• Enquiries with no commercial follow-up: 24 months from the last exchange.
• WhatsApp conversations and their attachments: 24 months from the last message.
• Client files and contractual documents: for the duration of the relationship, then 10 years for accounting records required by law.
• Technical and security logs: 12 months maximum.
• Aggregate analytics: kept indefinitely, as they contain no personal data.

8. Security

The site is served over HTTPS. Conversations and client files are reachable only through a private, authenticated dashboard restricted to the Zelos team. Backups are encrypted and stored in private repositories. Credentials and API keys are kept out of the source code.

9. Cookies

zelos.tn sets no advertising cookies and no analytics cookies. Only strictly necessary cookies may be used, for example to remember your language choice or keep an administration session open. They serve no profiling purpose.

10. Your rights

Under Tunisian organic law no. 2004-63 on the protection of personal data, and under the GDPR when you contact us from the European Union, you have the right to access, rectify, erase, object to, restrict and port your data.

To exercise these rights, write to [email protected] describing your request. We answer within 30 days. Deletion requests are carried out except where the law requires us to keep a record, such as an invoice.

You may also lodge a complaint with the Tunisian National Authority for Protection of Personal Data (INPDP), or with your national supervisory authority if you live in the European Union.

11. Minors

Our services are aimed at professionals and organisations. We do not knowingly collect data about people under 16. If such data reaches us, it is deleted as soon as we become aware of it.

12. Changes

This policy may change as our services or legal obligations evolve. The last-updated date appears at the top of this page, and any substantial change will be announced here.