Last updated: 25 October 2026
MyZapp (https://myzapp.zappsl.com) is ZAPP's customer and partner space: support, documentation, licenses, contracts and training. This policy explains which personal data we process in MyZapp, why, for how long, and how to exercise your rights. For our corporate website, see https://zappsl.com/confidentialite/.
1. Data controller
ZAPP SL — Tax ID (NIF) B86408291 — Calle Asturias, 4, 28850 Torrejón de Ardoz (Madrid), Spain. Registered with the Madrid Commercial Registry, volume 26669, folio 160, section 1, sheet M-533868.
Data protection officer: dpo@zappsl.com.
2. Data processed
| Category | Data |
|---|---|
| Account | first name, last name, business email address, phone number (optional), organization, language, role (customer, key contact, partner) |
| Authentication | password (stored with irreversible encryption), verification codes, passkeys, Microsoft 365 identifier if you sign in with that account |
| Support | ticket content, conversations, attachments, time spent, satisfaction ratings |
| Contracts and billing | support contracts, packs, usage statements, licenses, quotes, orders; payment data is processed by Stripe (MyZapp does not store card numbers) |
| Training | Academy enrollments, progress and certifications |
| Technical data | IP address, sign-in date and time, browser, security and audit logs |
| Hosted instances | for customers who entrust us with hosting their application: technical server monitoring data; the instance's business data is governed by the hosting contract |
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Provide support, documentation, licenses and the services you subscribed to | performance of the contract |
| Manage accounts, access and MyZapp security | performance of the contract and legitimate interest (security) |
| Invoice and track contracts and support balances | performance of the contract and legal obligation |
| Keep you informed by email about your requests, your balance and operations on your services | performance of the contract |
| Improve our services (internal statistics, satisfaction) | legitimate interest |
| Meet our accounting, tax and legal obligations | legal obligation |
We do not use your data for advertising and we make no automated decisions that produce legal effects concerning you.
4. Recipients
Data is accessible to authorized ZAPP staff and, where relevant, to the ZAPP partner who supports you. We use the following processors:
| Processor | Role | Location |
|---|---|---|
| Scaleway (Online SAS) | hosting of the MyZapp servers | France |
| OVH SAS | email delivery, domain names | France |
| Microsoft | sign-in with a Microsoft 365 account (optional) | European Union / United States |
| Stripe | online payment (where applicable) | European Union / United States |
Data is never sold.
5. Transfers outside the European Economic Area
MyZapp is hosted in France. When a processor (Microsoft, Stripe) processes data outside the EEA, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
6. Retention periods
| Data | Period |
|---|---|
| Account | while the account is active; deactivated when the relationship ends, then deleted or anonymized at the end of the periods below |
| Tickets, conversations and attachments | contract term plus 5 years |
| Accounting records and invoices | 6 years (Spanish Commercial Code, art. 30) |
| Sign-in and security logs | 1 year |
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and you may withdraw your consent where processing is based on it. Write to dpo@zappsl.com; we will only ask for proof of identity if there is reasonable doubt about who you are. You can update some of your information directly in your MyZapp profile.
You may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, https://www.aepd.es).
8. Cookies
MyZapp only uses cookies that are strictly necessary for it to work: session and authentication, protection against request forgery, and remembering your chosen language. No advertising or audience measurement cookies. These cookies do not require consent.
9. Security
Encrypted connections (HTTPS), passwords stored with irreversible encryption, two-factor authentication, audit log, regular backups and access restricted to authorized staff.
10. Changes
We may update this policy; the date at the top of the page shows the latest version. In the event of a significant change, we will inform you in MyZapp or by email.