Privacy Policy

This privacy policy explains how personal data is processed when you visit our website or use our forms and newsletter. We process data for the purposes and on the legal bases described below, limiting processing to the data required. Personal data is information relating to an identified or identifiable natural person.

The following statements on data protection describe what types of data are collected when accessing our website, what happens with these data and how you may object to data usage.

Person Responsible (controller)
Responsible within the meaning of the EU General Data Protection Regulation (GDPR) is:ZAZOU Berlin GmbHFranzösische Straße 15 / 10117 Berlininfo@zazouberlin.com / https://www.zazouberlin.com

Data Security Officer
The data security officer is:
WS Datenschutz GmbH – externer Datenschutz
If you have questions about data protection, you can contact Webersohn & Scholtz at the following e-mail address:
privacy@zazouberlin.com
or by mail:
WS Datenschutz GmbH
- Datenschutz -
Meinekestraße 13 / 10719 Berlin
www.ws-datenschutz.de

1. Which data will be used
When you visit this website, connection and access data required for delivery and secure operation are processed. Sections 16 and 17 explain the hosting and security services we use. If you use a form, we also process the information you enter for the purpose described there.

2. Protection of your data
We have taken technical and organizational measures to ensure that the requirements of the EU General Data Protection Regulation (GDPR) are met by us, as well as, by external service providers working for us.
If we work with other companies in order to provide our services, such as email and server providers, this will only be done after an extensive selection process. In this selection process, each individual service provider is carefully selected for its suitability in terms of technical and organizational data protection skills. This selection procedure will be documented in writing and an agreement on the order processing of data (order processing contract) will only be concluded if the third party complies with the requirements of Art. 28 GDPR.
Your information will be stored on specially protected servers. Access to it is only possible for a few specially authorized persons. If you send us data via web forms, the data is always transmitted via an encrypted connection (128-bit TLS).

3. Service providers and international transfers
We use Cloudflare to deliver and secure the website and to send form-related emails. We use Pipedrive, including Pipedrive Campaigns, to handle enquiries and send newsletters. These providers may also process data outside the European Economic Area. Details of recipients, subprocessors and safeguards for international transfers are available in the providers’ privacy notices and data processing agreements linked below.

4. Cookies and technical storage
The public website does not use Google Analytics or Google Remarketing analytics or advertising cookies. The fonts are served together with the website, without a connection to an external font service. Necessary security functions may process browser-related information. See the section on Cloudflare Turnstile below for details of our form protection.

5. Enquiries and non-binding offers
When you contact us using the enquiry form, we process the contact details, event information and message you enter to answer your enquiry and prepare an offer. This may include your name, email address, telephone number, event date, number of guests and budget information. We also transmit an identifier for this enquiry, the path of the entry page, the address of the page from which you send the enquiry, including campaign markers in that address (e.g. utm parameters or click IDs), and only the hostname of the previously visited page if your browser provides it. We do not store anything in your browser for this purpose, neither a cookie nor local storage. The data is transmitted from our server to Pipedrive and stored with your enquiry in our CRM system. We also receive an email copy in our contact mailbox; Cloudflare Email Service handles the technical sending process. An event enquiry does not sign you up for the newsletter.

The legal basis is Article 6(1)(b) GDPR where processing concerns a contract with you or steps requested by you before entering a contract. For enquiries on behalf of a business, processing its contact persons’ details is based on Article 6(1)(f) GDPR; our legitimate interest is handling the business enquiry.

6. Deletion of personal data
ZAZOU Berlin GmbH processes the personal data only as long as necessary. As soon as the purpose of the data processing is fulfilled, deletion of the data is carried out according to the standards of the deletion concept, unless legal regulations oppose this.

7. Data processing for applications
ZAZOU Berlin GmbH offers the opportunity to apply for jobs via e-mail. For this purpose, personal data is processed and stored for further processing during the respective application process.
In case of successful application and employment, the personal data is stored in accordance with the legal requirements. In case of unsuccessful application the data will be deleted in accordance with the rules of the local deletion concept. In doing so the provisions of the AGG (German Employment Law), in particular the existing evidence pursuant to § 22 AGG are taken into account.

8. External links to social networks
Our website contains external links to social networks. Displaying such a link does not itself connect to the linked provider. When you open the link, that provider’s privacy terms apply. It may process your IP address and browser information and may associate this information with your account if you are signed in.

9. Google Analytics
Google Analytics is not integrated into this website.

10. Google Remarketing
Google Remarketing is not integrated into this website.

11. Instagram
Our Instagram link opens an external website. Details of its data processing are available in the Instagram Privacy Policy.

12. Legal basis for the processing of personal data
The processing of personal data requires a legal basis. The GDPR names different legal bases in Art. 6 GDPR. 
A legal basis for processing personal data is, for example, Art. 6 (1) (a) GDPR. This refers to the consent given by the user. The consent is earmarked. Processing personal data is also allowed in order to fulfill a contract acc. Art. 6 (1) (b) GDPR. However, Art. 6 (1) (b) GDPR must be interpreted broadly, since the initiation of a contractual relationship regarding data processing is also included. This applies in particular to those cases in which the user uses the contact form of ZAZOU in order to receive a non-binding offer. Art. 6 (1) (c) GDPR describes the legal basis of data processing in cases involving a legal obligation to process data. Processing personal data may in exceptional cases be based on Art. 6 (1) (d) GDPR. This requires the vital interests of the affected person or other natural person to be protected. This refers to cases which would lead to injury or impairment of life, limb and health. For the initiation of assistance personal data such as the name, contact details and possibly health insurance would be required to be handed over. It is also possible that processing personal data is based on the legal basis of Art. 6 (1) (f) GDPR. The so-called "legitimate interest" is standardized in this basis, which is to be read with reference to the addendum reason 47 of the GDPR. In the legal sense, Article 6 (1) (f) of the GDPR is a so-called "standard of interception", which applies unless other legal bases than those described above apply. When the standard of interception is applied, weighting the specific interests - that of the affected person or that of the data processor – takes place.

13. Your rights
You have the following rights with respect to the personal data concerning you: 
• Right to information,
• Right to rectification or deletion,
• Right to restriction of processing,
• Right to object to the processing,
• Right to data transfer,
• Right on confirmation.
In the case of a request for information, you must provide sufficient information about your identity and provide proof that it is your personal data. The information relates to data that has been stored regarding your person, the origin of the data, the recipient or the categories of recipients to which data has been transmitted and the purpose of the storage. To exercise these rights, please contact our Privacy Officer, which is mentioned at the beginning of the Privacy Policy.
If you have given your consent to the processing of your data, you can revoke at any time. Such revocation will affect the admissibility of processing your personal data by us.
Insofar as we base the processing of your personal data on the weighting of interests, you may object to the processing. This is the case if processing your data is not required to fulfill a contract with you, which is explained in the following description of the functions. In the event of such a revocation, we ask you to explain the reasons why we should not process your personal data. In the case of your justified objection, we will examine the situation and will either stop processing your data, adapt the data processing or point out to you our compelling legitimate reasons on which we continue the processing.
Of course, you may object to the processing of your personal data for advertising and data analysis purposes at any time. You may contact us or our responsible data security officer via the contact details stated at the beginning of the Privacy Policy.
You also have the right to complain about our processing your personal data to a supervisory authority.

14. How you perceive these rights
To exercise these rights, please contact our data security officer:
WS Datenschutz GmbH – externer Datenschutz
privacy@zazouberlin.com
or by mail:
WS Datenschutz GmbH – externer Datenschutz
Meinekestraße 13D-10719 Berlin

15. Changes to this policy
We update this privacy policy when our data processing or legal requirements change.

Last updated: October 2026.

Our website, images and downloads are delivered through Cloudflare, Inc., USA. Visits involve processing the connection and access data needed for delivery, particularly the IP address, requested URL, time and browser information. This supports secure delivery, protection against attacks and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating the website securely and reliably.

Further information: Cloudflare Privacy Policy and Cloudflare Data Processing Addendum.

Turnstile is loaded when you use our forms to detect automated abuse. Cloudflare processes IP addresses and technical browser and connection signals for this purpose. Our interest in protecting the forms is the legal basis under Article 6(1)(f) GDPR. Cloudflare also processes signals as an independent controller to improve detection. Details and contact information are available in the Turnstile Privacy Addendum.

Pipedrive processes the data required to handle your enquiry or newsletter signup. For an enquiry, we store contact details and event information with the handling status. For a newsletter signup, the email address, subscription status and association with the ZAZOU newsletter are processed.

Details of Pipedrive and its service providers: Privacy Notice, Data Processing Addendum and Subprocessors.

You receive our newsletter only after giving separate consent under Article 6(1)(a) GDPR. After signup, we send an email containing a time-limited confirmation link. Your address is passed to Pipedrive for the ZAZOU newsletter only when you explicitly confirm your signup on the website.

For evidence, we store the email address, consent wording and its version, source page, signup and confirmation timestamps, and the associated contact identifier. This record is stored with Cloudflare and contains no IP address. The confirmation link is valid for 48 hours. Unconfirmed signups are deleted in the next daily cleanup seven days after the link expires. We retain the evidence while your consent is active. After a documented withdrawal, we retain the evidence until three years after the end of the calendar year in which consent was withdrawn. Resolved review cases without a confirmed signup are deleted after 30 days. In a specific legal dispute, deletion is suspended for as long as necessary.

You may withdraw your consent at any time for the future using the unsubscribe link in the newsletter or by emailing contact@zazouberlin.com. Withdrawal does not affect the lawfulness of earlier processing. Where evidence remains necessary to establish, exercise or defend legal claims, it is retained solely for that purpose.