ZEROSTAND
Request a demo

Privacy Notice.

What we collect through this website, why, who receives it, how long we keep it, and the rights you have.

Effective 15 October 2026. Version 2.

1. Who we are

This website and the Zerostand product are operated by Zerostand, based in Kuala Lumpur, Malaysia ("we", "us"). We are the data controller for the personal data described in this notice. You can reach us about privacy at privacy@zerostand.com.

2. What this notice covers

This notice covers the website, demo and contact requests, proof-of-value contacts, and business communications with us.

It does not cover data processed inside the Zerostand product. Zerostand is self-hosted: it runs on infrastructure our customers control, and the customer controls the data in their own deployment. We receive none of it unless a customer sends it to us, for example in a support conversation.

3. What we collect

  • Form fields. Name, work email, company, job title, country and the message you type into the demo or contact form. Name, work email and company are required; the rest is optional.
  • Emails you send us, and the correspondence that follows.
  • Technical data our host processes to deliver the site: IP address, browser type and request logs, handled by Cloudflare as our hosting provider.
  • Bot-check signals on the demo form. Cloudflare Turnstile, which tells people from automated submissions, processes your IP address, TLS fingerprint, browser user-agent and the address of the page, as described in Cloudflare's Turnstile Privacy Addendum. It runs only on the pages that carry the form.

We do not use analytics or advertising cookies. See section 9.

4. Why we use it, and the legal basis

  • To reply to your request and arrange a demo or proof of value. In the EU and UK our basis is our legitimate interest in responding to a business enquiry you made. In Malaysia we rely on your consent, given when you submit the form, and on the processing being necessary for steps you asked us to take.
  • To keep the site secure, including detecting abuse. Legitimate interests.
  • To keep business records and meet legal obligations. Legal obligation and legitimate interests.

We use what you enter in the form only to reply to you and arrange the demo or proof of value. We do not add you to a newsletter or marketing list without a separate opt-in.

5. Who receives it

Processors acting on our instructions:

  • Web3Forms, which delivers form submissions to us.
  • Our email provider, which stores and transmits our email.
  • Cloudflare, which hosts the site, protects it and runs the Turnstile bot check on the demo form.

We may also share personal data with our professional advisers, and with authorities where the law requires.

We do not sell or share personal information, and we do not use it for targeted advertising.

6. International transfers

Our processors may process data outside the country you are in, including in the United States. Where data leaves the EU or UK we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where applicable, in our processors' terms. Where data leaves Malaysia we rely on the conditions in section 129 of the Personal Data Protection Act 2010. Email sent to our addresses is forwarded by Cloudflare Email Routing and stored with our email provider, which may hold it outside Malaysia.

7. How long we keep it

  • Demo and contact requests that do not lead to a business relationship are deleted within 12 months of our last contact with you.
  • Contacts at customers and prospective customers are kept for the duration of the relationship, then for as long as Malaysian law requires us to keep business records.
  • Copies held by our form provider are deleted according to its retention period, which we keep as short as its service allows.

8. Security

Access to the mailbox that receives enquiries is limited to the people who handle them and protected by multi-factor authentication. The site is served over HTTPS. If a personal data breach affects you, we will notify the relevant authority and, where the law requires, you: in Malaysia within the periods set by section 12B of the Personal Data Protection Act 2010; in the EU and UK under Articles 33 and 34 of the GDPR and UK GDPR.

9. Cookies and similar technologies

This site sets no cookies and uses no analytics. Fonts are served from our own domain, so loading a page makes no request to a third party other than our host, Cloudflare, which also serves the Turnstile bot check on the pages that carry the demo form. If we ever enable a security feature of our host that sets a strictly necessary cookie, we will name it here.

10. Your rights

Depending on where you are, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict our processing, to receive a copy in a portable format, and to withdraw consent where we rely on it. To exercise any of these, email privacy@zerostand.com. We respond within 21 days under the Malaysian PDPA and within one month under the GDPR and UK GDPR, and we may ask you to confirm your identity first.

You can also complain to a supervisory authority: in Malaysia the Personal Data Protection Commissioner; in the EU your national supervisory authority; in the UK the Information Commissioner's Office; in Singapore the Personal Data Protection Commission; in Australia the Office of the Australian Information Commissioner.

11. Region-specific information

Malaysia

This notice is given under section 7 of the Personal Data Protection Act 2010. The purposes, source and recipients of your data are set out above. Providing your name, work email and company is obligatory if you want us to reply; the other fields are optional. If you do not provide the obligatory fields, we cannot respond to your request. You may access and correct your data, and withdraw consent, by emailing privacy@zerostand.com. A Bahasa Malaysia version of this notice is available on request from privacy@zerostand.com.

European Union and United Kingdom

Our legal bases are set out in section 4. You have the rights in section 10, including the right to object to processing based on legitimate interests. We have not appointed a representative in the EU or UK. If we do, we will name them here.

Singapore

Most of what the form collects is business contact information under the Personal Data Protection Act 2012. We treat the message field and anything personal you include as personal data under this notice.

California and other US states

In the past twelve months we have collected the categories of personal information listed in section 3 for the purposes in section 4. We do not sell or share personal information, and we do not use it for targeted advertising. Where state law gives you rights to access, delete or correct your information, you may exercise them by email, and we will not discriminate against you for doing so.

Australia

We handle personal information in line with the Australian Privacy Principles where they apply to us. Section 6 describes overseas disclosure. You may ask us to access or correct your information, and complain to us first and then to the OAIC.

12. Children

This site is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

13. Changes

We will post any change to this notice here with a new effective date and version number. The current version is 2, effective 15 October 2026; it adds the Cloudflare Turnstile bot check on the demo form to sections 3, 5 and 9. Version 1 was effective 14 October 2026.

14. Language

This notice is published in English. A Bahasa Malaysia version is available on request from privacy@zerostand.com.