Last updated: 14 October 2026 · Deutsche Version
Zapote Ventures UG (haftungsbeschränkt)
c/o Oscar Morillo Victoria
Marschnerstraße 19, 12203 Berlin, Germany
Email: oscar.morillo@zapote.de
Further details can be found in our legal notice (Impressum). We have not appointed a data protection officer, as there is no legal obligation to do so.
Storage period: Unless a more specific storage period is stated in this notice, your personal data remains with us until the purpose of the processing ceases. If you make a legitimate request for deletion or withdraw consent, we will delete your data unless there are other legally permissible grounds for storage (e.g. tax or commercial-law retention periods); in that case deletion takes place once those grounds cease to apply.
This website is hosted using IONOS Deploy Now by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR, which forms part of the IONOS terms and conditions and covers our Deploy Now contract.
According to IONOS's written confirmation, website files, access logs and visitor statistics under our contract are processed and stored exclusively in data centres in Germany. According to IONOS, these data are neither processed nor transferred outside Germany. IONOS also confirms that it uses no external subprocessors for Deploy Now. A content delivery network (CDN) is not a standard part of the contract; we have not activated a CDN. Further information is available in IONOS's data protection information (German).
When you access the website, your IP address is technically required to deliver the page to your browser. According to IONOS, connection data is processed for the purpose and duration of establishing the connection; the IP address is anonymized immediately after transmission. The following data is stored in server log files:
The purpose is to ensure the secure and stable operation of the website, for example to prevent and investigate attacks. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). According to IONOS, access logs are stored for no more than eight weeks and deleted by the end of that period.
This website uses TLS encryption (HTTPS) to protect data against unauthorised interception during transmission between your browser and the web server. You can recognise HTTPS by the "https://" prefix in your browser's address bar.
This website embeds the fonts "Fraunces" and "IBM Plex Sans" locally (self-hosted). It does not load fonts from external font servers (e.g. Google Fonts).
This website does not set its own cookies, uses neither local storage nor session storage, and does not embed any analytics or tracking scripts. No third-party content is embedded. Your browser may cache the delivered files as part of its normal caching functionality.
To evaluate the use of our website in aggregated form (e.g. number of page views, most visited pages), we use the visitor statistics provided by our host IONOS (see Section 2). They are generated exclusively from the server log files, evaluating the referrer, requested page or file, browser type and version, operating system, device type and time of access. Your IP address is anonymized immediately after transmission; the statistics cannot be linked to you personally. No profiling takes place. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR).
The information above on cookies and tracking applies to our website at zapote.de. External services (see Sections 6 to 8), including meetergo booking pages and forms, are accessed only when you actively click a corresponding link. Processing on those external pages is described in the corresponding sections.
Our wholesale page (/grosshandel/ and /en/wholesale/) additionally contains a plain link to the information website on the Digitalbonus Bayern funding programme (digitalbonus.bayern). This content is not embedded either; data is only transmitted when you click the link, and even then without referrer information (noreferrer). The destination website's privacy policy applies there.
Our home pages (German and English) also contain plain links to talks and articles on external websites (YouTube, operated by Google Ireland Limited; CTO Craft; and the founder's professional LinkedIn profile, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). Our digital business card (German and English) also links to this LinkedIn profile. This content is not embedded; no data is transmitted to these providers when our website loads. Only when you click such a link do you visit the provider's website, where its privacy policy applies. No referrer information is passed on (noreferrer). LinkedIn is responsible for processing on LinkedIn itself; information about this and your rights is available in LinkedIn's Privacy Policy. If you contact us via LinkedIn, LinkedIn's terms also apply there; for confidential matters we recommend email (Section 5).
If you contact us by phone, we process the information you provide and, where necessary to handle your inquiry, your name, the phone number displayed or provided, and details of your inquiry. The purpose, legal bases and deletion criteria are as described below for handling inquiries.
If you contact us by email, we process the data you provide (including name, email address and the content of your message) to handle your inquiry. Our mailbox is also operated by IONOS SE (see Section 2) in Germany under a data processing agreement.
The legal basis is Art. 6(1)(b) GDPR where you would personally be a party to the contract and processing is necessary for pre-contractual steps at your request. For inquiries as a company contact and other inquiries, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling business inquiries). We delete the data once it is no longer required to handle your inquiry, unless statutory retention obligations (e.g. for business correspondence under German commercial and tax law) apply.
We hereby object to the use of the contact details published in the legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.
To book an introductory call, we link to meetergo, a service provided by meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany. meetergo is not embedded in this website; a connection is established only when you click a booking button and open the meetergo booking page.
On our behalf, meetergo processes the data you enter in the booking form (first name, last name and email address), the selected appointment, and booking and cancellation data, confirmations and reminders. Processing is governed by the data processing agreement pursuant to Art. 28 GDPR (version 3.0, September 2026), which takes effect through incorporation into the service contract or electronic acceptance.
To check our availability and manage booked appointments, meetergo is connected to our calendar at IONOS SE via CalDAV. Calendar and availability data is synchronised, and booked appointments, including the necessary participant and appointment data, are created or updated in the IONOS calendar. IONOS is our separate service provider for this purpose under a data processing agreement. The connection is used to organise appointments.
According to the provider, the core meetergo application is hosted at Hetzner in Germany. To deliver static content, meetergo uses BunnyWay d.o.o. (bunny.net), a global CDN with primarily EU locations; this involves processing in particular IP addresses and browser data. Transactional emails are sent through AhaSend B.V. in the Netherlands. The meetergo data processing agreement generally provides for processing in the EU/EEA and permits third-country transfers through authorised subprocessors subject to Art. 44 et seq. GDPR. It therefore does not guarantee that all meetergo data is processed exclusively in Germany. Details of recipients, processing locations and any applicable transfer mechanisms are available in the meetergo subprocessor list.
The legal basis is Art. 6(1)(b) GDPR where you personally are or would be a party to the contract and processing is necessary to perform the contract or for pre-contractual steps at your request. For inquiries as a company contact and other business inquiries, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in organising requested calls).
Automatic deletion of appointment records at meetergo is set to 30 days after the appointment ends. Where statutory retention obligations or another legal basis require longer storage, for example for ongoing pre-contractual discussions or performance of a contract, we retain the necessary data separately. We delete related calendar data at IONOS according to the same criteria. According to meetergo, technical access logs for booking pages are retained for up to 14 days. Processing for which meetergo is independently responsible, such as technical delivery and abuse prevention, and cookies on the meetergo page are additionally described in meetergo's privacy notice.
We currently use meetergo forms for appointment booking; the booking form asks only for first name, last name and email address.
If you contact us through a meetergo form, we process the contact details and content you provide to handle your inquiry and communicate with you. This includes in particular information in the booking form; each form indicates which information is required. meetergo processes this data on our behalf under the data processing agreement described above. The information above on subprocessors and processing locations also applies to these forms. No meetergo forms are embedded in our website.
The legal basis is Art. 6(1)(b) GDPR where processing is necessary to perform a contract with you or for pre-contractual steps at your request. For inquiries as a company contact and other inquiries, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling and responding to inquiries).
We delete form and inquiry data once it is no longer required to handle the inquiry and related communication. If a business relationship results or statutory retention obligations apply, we retain the necessary data for the corresponding longer period. Booking data is subject to the period stated above, generally 30 days after the appointment ends. Data is used for newsletters or other marketing communications only where there is the required legal basis.
Alternatively, you can always arrange an appointment by email.
Calls take place by video or audio conference using meetergo connect, provided by meetergo GmbH (see Section 6 for provider and data processing agreement details). You receive the access link with your appointment confirmation. Processing involves in particular your display name, the audio, video, screen-sharing and chat content you choose to share, and session and connection data such as IP address, device information and join and leave timestamps.
According to meetergo, audio and video are transmitted through its own media servers at Hetzner in Nuremberg, Germany, including any necessary connection relays. Audio, video, screen-sharing and chat content is processed only as part of the respective call. We currently do not use recording or AI-assisted analysis of calls. If we change this in the future, we will provide separate advance information about the purpose, legal basis and retention period and obtain your consent where required. Appointment-related metadata is subject to the deletion criteria in Section 6. According to meetergo, technical access logs containing session metadata are retained for up to 14 days.
The legal basis is Art. 6(1)(b) GDPR where you personally are or would be a party to the contract and the call is necessary for that purpose. For participation as a company contact and other business calls, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in holding requested online calls). If you prefer not to use video conferencing, please let us know by email and we will gladly arrange an alternative, such as a phone call.
We operate a company page on LinkedIn (linkedin.com/company/zapote-ventures). The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). When you visit our page on LinkedIn, LinkedIn processes your data under its own privacy policy, in particular if you are logged in; this may include processing in the USA. Information is available in LinkedIn's Privacy Policy and in the European Regional Privacy Notice, which supplements it and takes precedence for users in the EEA.
For page statistics (“Page Insights”), LinkedIn provides us with aggregated reports, for example on page views, visitors and reactions to posts, and on their professional characteristics (e.g. industry, company size, job title, region). These are based on personal data that LinkedIn collects when members and visitors interact with our page or its content. The statistics contain no information on individual visitors. We see individuals only to the extent LinkedIn provides for it, for example as followers of our page or when they comment on our posts or message us. We use the statistics to analyze the reach and effectiveness of our LinkedIn activities and to improve our content. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR).
We are jointly responsible with LinkedIn for this processing (Art. 26 GDPR). The arrangement is LinkedIn’s “Pages Joint Controller Addendum” (see the LinkedIn Help Center); it applies automatically as soon as we operate the page, and no separate acceptance is required. In essence, it provides that LinkedIn collects and processes the personal data for page statistics, fulfils the GDPR obligations for this processing including data subject rights, and provides the core information about the processing. We evaluate the aggregated statistics, shape the content of our page, and provide this notice and our contact details. You can assert your rights both with LinkedIn and with us (see Section 1 for contact details); we will forward requests that concern LinkedIn to LinkedIn or support you in doing so.
If you message us via LinkedIn or comment on our posts, we process the data you provide in order to reply (Art. 6(1)(b) or (f) GDPR). For confidential matters we recommend email (Section 5). The link to the founder's professional LinkedIn profile is also a plain link (see Section 4).
No further disclosure takes place unless we are legally obliged to do so.
As a data subject under the GDPR, you have the following rights:
To exercise these rights, an informal message to the contact address above is sufficient.
Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object informally by writing to oscar.morillo@zapote.de.
Where your personal data is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for such marketing. If you object, your personal data will no longer be used for direct marketing (Art. 21(2) and (3) GDPR).
You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Alt-Moabit 59–61, 10555 Berlin, Germany
www.datenschutz-berlin.de
You are under no statutory or contractual obligation to provide us with personal data. Without contact details, however, we cannot process your inquiry or booking.
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.