Last updated: June 2026

1 General

1.1 Controller

The controller responsible for data processing in the ROGER app is:

ZAL GmbH
Hein-Saß-Weg 22
21129 Hamburg, Germany
Phone: +49 40 248 595-0
E-mail:

ROGER is the communications app of ZAL GmbH. ROGER is aimed at customers, partner networks, employees, and anyone with an interest in ZAL and its topics.

For further information and contact options, please refer to our legal notice at zal.aero.

1.2 Data Protection Officer

You can reach our Data Protection Officer at:

DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Frapanweg 22, 22589 Hamburg, Germany
Contact form: https://www.dsextern.de/anfragen/

1.3 Legal Bases

Personal data is processed on the following legal bases:

1. Consent pursuant to Art. 6(1)(a) GDPR: Upon registration, you will be informed about data processing and give your consent by active confirmation.

2. Legitimate interests pursuant to Art. 6(1)(f) GDPR: Where processing is necessary for the operation of the app and the provision of its functions.

1.4 Your Rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR).

Withdrawal of consent: Any consent given may be withdrawn at any time with effect for the future (Art. 7 GDPR).

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement. This right of complaint exists without prejudice to other administrative or judicial remedies.

To exercise your rights, please contact the Data Protection Officer listed above or write to:

1.5 Disclosure to Third Parties

We only transfer personal data to third parties in accordance with the applicable legal provisions. We engage processors with whom data processing agreements pursuant to Art. 28 GDPR have been concluded (see Section 3).

Where data is transferred to countries outside the EU/EEA, this only takes place where an adequate level of data protection is ensured, consent has been given, or the transfer is otherwise permitted by law.

1.6 Retention Periods

Personal data will be deleted once the purpose of processing has ceased and no statutory or contractual retention obligations apply. Unless a different retention period is specified in these notices, this principle applies.

2 Data Processing

2.1 Technical Connection Data

When the app is accessed, connection data is technically processed by the server, including IP address, time of access, and device information. This data is not evaluated on a personal basis and is used exclusively for the technical operation of the app.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stable operation of the app).

The app contains links to external websites (e.g. event calendar, cafeteria menu). The respective privacy notices of those external sites apply; we have no influence over their content or data processing.

2.2 User Account

Authorised ROGER users gain access to additional functions upon sign-in. The following personal data is processed in this context:

– First and last name
– E-mail address
– ZAL ID

Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR.

2.3 Service Forms

Authorised users can submit various service requests and applications digitally via ROGER.

The data stored in the user profile (name, e-mail address) is pre-filled automatically. Depending on the form, additional information may be required. The details you provide in the request form, including the contact information you supply, are stored for the purpose of processing your request and handling any follow-up queries. We do not share this data without your consent.

Processing is carried out on the basis of Art. 6(1)(b) GDPR where your request relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries directed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where this has been obtained; consent may be withdrawn at any time.

The data you provide via the form will be retained until you request deletion, withdraw your consent to storage, or the purpose for storage no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Legal basis: Art. 6(1)(f) GDPR.

2.4 Push and E-mail Notifications

Push notifications:
With your consent, notifications are displayed directly on your device. For this purpose, a device ID is assigned and linked to your account. You can disable push notifications at any time in your device settings.
Legal basis: Art. 6(1)(a) GDPR (consent).

E-mail notifications:
For important information, notifications may be sent to the e-mail address stored in your profile. You can configure this in your profile settings.
Legal basis: Art. 6(1)(f) GDPR.

 

2.5 Account Deletion

If an account is deleted, content created by the user remains in the app. The author information (first and last name) will be pseudonymised and replaced by a placeholder. Personal data will be deleted once the purpose of processing has ceased and no statutory retention obligations apply.

3 Service Providers

Data is hosted by the solution provider Staffbase GmbH under a data processing agreement pursuant to Art. 28 GDPR. Staffbase engages the following sub-processors:

Microsoft Ireland Operations Ltd. (Azure)
South County Business Park, One Microsoft Court, Dublin, Ireland.
Data is hosted in a Microsoft data centre in Germany; transmission and storage are encrypted.

Cloudflare, Inc.
101 Townsend St, San Francisco, USA.
Content delivery network for the provision of media files. Storage within the EU.

Zendesk, Inc.
989 Market Street, San Francisco, CA 94103, USA.
Customer support management. Processing within the EU.

Google LLC (Firebase Cloud Messaging)
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Delivery of push notifications via random instance IDs without personal reference.

Last updated: June 2026 | Version 1.0