How we handle personal data.

ZIVEL Prefab is a brand operated by Elvon Isolatie VOF, a business registered in the Netherlands.

This Privacy Policy explains how we process personal data when you visit the ZIVEL Prefab marketing website, request access to our ordering platform, or contact us by email.

The separate ZIVEL ordering application may involve additional processing of customer, order, payment and billing information. That processing is not fully covered by this marketing website policy.

Access requests

When you submit our Request Access form, we collect:

• Company name
• Contact person's name
• Email address
• Telephone number, if provided
• Information about your fabrication activities or other message, if provided
• Submission date and time
• A pseudonymised hash derived from your IP address for spam prevention and rate limiting

The form also uses technical anti-spam checks. The hidden anti-spam field and form-opening timestamp are not stored in the access-request database.

Email enquiries

If you contact us by email, including to request a quotation as a private customer, we may process your name, email address, the contents of your message, and any dimensions, drawings or project information you choose to provide.

Website usage

Our hosting infrastructure processes the technical information needed to deliver and protect the website. This includes IP addresses, browser information, requested pages and technical logs. The remaining cookies and technical requests of the hosting platform are addressed in section 7.

Analytics (only with your consent)

If you accept analytics in the cookie consent interface, we use Google Analytics 4 to understand how the website is used. In that case Google processes online identifiers (such as cookie IDs), approximate location derived from your IP address, device and browser information, and the pages you visit. We do not send names, email addresses, company names, form contents or invitation codes to Google Analytics, and addresses are reduced so that only privacy-safe campaign parameters (such as UTM parameters) are retained. If you reject or withdraw analytics, no analytics data is collected.

We process personal data for the following purposes:

Receiving and responding to platform access requests

Legitimate interests in handling business enquiries; pre-contractual steps where applicable

Preparing and responding to quotation requests

Steps taken at your request before entering into a contract

Preventing spam, abuse and unauthorised access

Legitimate interests in website and service security

Operating and maintaining the website

Legitimate interests in providing a reliable and secure website

Understanding how the website is used (Google Analytics)

Your consent, given through the cookie consent interface

Meeting applicable legal obligations

Compliance with a legal obligation

Where we rely on legitimate interests, those interests must be balanced against the rights and freedoms of the individuals concerned.

Analytics processing takes place only after you have given consent through the cookie consent interface. You can withdraw that consent at any time via the Cookie settings link in the footer; withdrawal takes effect immediately and stops further analytics collection.

Access requests: Records submitted through the marketing website's Request Access form are scheduled for automatic deletion once they are more than 120 days old, based on their submission date and time. The cleanup is scheduled to run once per day and applies regardless of whether a request has been answered or is still being reviewed. This rule applies only to records in the marketing website's access-request database; it does not automatically delete emails, backups, hosting logs, or accounts, orders and other records in the separate ordering application.

Email correspondence: General email enquiries and related correspondence are retained for 12 months after the last meaningful communication. After that period, they are deleted or reviewed to determine whether further retention is necessary. Correspondence related to contracts, invoices, disputes or legal retention obligations is handled separately for the applicable period.

Provider logs and backups: Hosting and security logs and backup copies are subject to the relevant providers' retention and deletion arrangements. The applicable periods have not been fully confirmed. The 120-day access-request cleanup does not establish that all copies are deleted after 120 days.

Where information must be retained to comply with accounting or other legal requirements, it may be kept for the applicable statutory period.

Personal data may be processed by authorised personnel and service providers supporting our business, including:

• Lovable Cloud and associated hosting infrastructure, for website hosting, access-request processing and database storage.
• Cloudflare security infrastructure, for website protection and bot management.
• Google/Gmail, when you communicate with us by email.
• Google Ireland Ltd. and Google LLC, for Google Analytics 4, but only if you have accepted analytics in the cookie consent interface.
• Other technical service providers where necessary for website delivery, security and maintenance.

Access to the access-request database is restricted. Public website visitors cannot directly read or modify submitted requests.

We do not sell personal data to advertisers.

The primary marketing website database is configured in an EU hosting region.

This does not by itself establish that every related processing activity — including backups, support access, email services, technical logs and platform event reporting — takes place exclusively within the European Economic Area (EEA). The applicable provider arrangements, subprocessor locations, contractual coverage and safeguards for any international transfers have not been fully confirmed. We do not treat the database's EU region as evidence that all related processing remains within the EEA.

If you accept analytics, Google Analytics data may be processed by Google LLC in the United States. Google states that such transfers are covered by its data processing terms, including standard contractual clauses and the EU–US Data Privacy Framework where applicable.

Hosting and security services may set cookies when you visit the website. The Cloudflare __cf_bm security cookie has been observed on the published website. It supports bot management and has an approximately 30-minute inactivity lifetime.

A cookie named __dpl has also been observed previously on the published website. Its exact purpose and necessity have not been officially confirmed. We therefore do not classify it as strictly necessary or analytics-related. This uncertainty remains relevant to determining whether consent is required; we do not claim that every cookie is exempt from consent requirements.

A first-party consent cookie (zivel_consent) stores your analytics choice — only the decision, a format version and a timestamp — for up to 12 months. It is set on the zivelprefab.com domain so that the ordering application at app.zivelprefab.com can respect the same choice. It contains no personal data.

Google Analytics is disabled by default and loads only after you accept analytics. When accepted, Google sets first-party analytics cookies such as _ga and _ga_*, which can persist for up to 14 months. Advertising consent signals remain disabled. You can withdraw your consent at any time via the Cookie settings link in the footer; withdrawal stops further analytics collection immediately and removes the Google Analytics cookies.

The website's fonts are hosted locally and are not requested from Google Fonts.

We use technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure and loss. These include restricted database permissions, row-level security, server-side form validation and anti-spam controls.

No internet-based service can guarantee absolute security.

Under the GDPR, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate information.
• Request deletion of personal data where applicable.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.

To exercise your rights, contact zivelprefab@gmail.com.

We may request reasonable information to verify your identity before responding. We will respond within the time limits required by applicable law.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

The required fields in the Request Access form are necessary for us to identify your business and respond to your request. Without this information, we cannot process the access request.

Providing a telephone number or additional message is optional.

Sending an email quotation request is voluntary, but sufficient contact and project information is needed for us to prepare a meaningful response.

The marketing website uses automated technical checks to prevent spam and limit repeated form submissions. These checks do not make automated decisions about customer eligibility that produce legal or similarly significant effects.

Access approval and quotation decisions are handled separately.

We may update this Privacy Policy when our services, technology or legal requirements change. The latest version will be made available on the ZIVEL Prefab website with its revision date.

For privacy-related questions or requests: