Privacy Policy

The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "GDPR") is cyrcID s.r.o., Company ID: 24110124, with registered office at Nové sady 988/2, Staré Brno, 602 00 Brno (hereinafter: "controller").

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The controller has not appointed a data protection officer.

The controller processes personal data that you have provided or personal data that the controller has obtained based on the fulfillment of your order.

The controller processes your identification and contact data and data necessary for the performance of the contract.

Some contact details are not obtained from you but from public sources and commercial business-contact databases, in particular the Apollo service. These are strictly professional contact details: first name and surname, work email address, phone number, job title, employer name and a link to a professional profile.

The controller processes this data in order to approach you with an offer of cooperation, on the basis of its legitimate interest under Article 6(1)(f) GDPR. It is retained for 12 months from the last contact. You may object to this processing at any time under Article 21 GDPR, following the procedure in art. 6; the controller will then stop the processing and delete the data without undue delay.

The legal basis for processing personal data is:

• performance of a contract between you and the controller pursuant to Article 6(1)(b) GDPR,
• the legitimate interest of the controller in providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(f) GDPR,
• your consent to processing for the purpose of providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Act No. 480/2004 Coll., on certain information society services, in the event that no goods or services have been ordered.

The purpose of processing personal data is:

• Processing your order and exercising the rights and obligations arising from the contractual relationship between you and the controller; when placing an order, personal data are required that are necessary for successful order processing (name and address, contact). The provision of personal data is a necessary requirement for concluding and performing the contract, without the provision of personal data it is not possible to conclude the contract or for the controller to perform it;
• Sending commercial communications and conducting other marketing activities.

The controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

The controller retains personal data according to their purpose:

• 10 years — invoicing and accounting records. The period follows from Section 35(2) of Act No. 235/2004 Coll., on Value Added Tax, and Section 31 of Act No. 563/1991 Coll., on Accounting.
• 4 years from the termination of the contractual relationship — data needed to exercise rights and obligations under the contract and to assert claims arising from it. The period follows from the general three-year limitation period under Section 629 of the Civil Code, extended by one year for asserting a claim.
• 3 years from the last sign of interest, that is, the last open, click or reply — marketing contacts processed on the basis of consent. If you withdraw consent earlier, processing ends upon withdrawal.
• 12 months from the last contact — contact details of persons approached with a business offer, processed on the basis of legitimate interest.

Upon expiry of the period stated above, the controller deletes the personal data. Where deletion would make it impossible to keep the accounting records or would invalidate historical impact calculations and statistics, the controller anonymizes the data instead, so that it can no longer be attributed to a specific person.

The controller engages the following processors:

• Hetzner Online GmbH — Operation of the platform and server infrastructure; data stored in the platform.
  Germany, European Union
• Amazon Web Services (Amazon SES) — Delivery of transactional and informational emails; email address and message content.
  Frankfurt region, European Union
• Sentry — Application error monitoring; technical data about the error and the state of the application.
  European region, European Union
• Dealfront (Leadfeeder) — Identification of the company a website visitor comes from, based on their IP address; visitor's IP address.
  Finland and Germany, European Union
• Brevo (Sendinblue) — Delivery of e-books and management of newsletter subscriptions; email address, name and language.
  France, European Union
• Pavel Gula — External consultant administering the measurement tools; access to website traffic data.
  Czech Republic, European Union
• Stripe, Inc. — Payment processing; billing and payment data.
  United States — EU-US Data Privacy Framework
• Google LLC — Tag manager on the website (visitor's IP address) and Google Workspace as the provider of outbound mailboxes (email address and message content).
  United States — EU-US Data Privacy Framework
• Meta Platforms, Inc. — Measurement of advertising campaign effectiveness; IP address and behavior of the website visitor.
  United States — EU-US Data Privacy Framework
• Microsoft Corporation — Analysis of website visitor behavior including session recording (Microsoft Clarity); IP address, visitor behavior and the content of the pages displayed.
  United States — EU-US Data Privacy Framework
• HubSpot, Inc. — Records of business contacts and business communication; first name, surname, work email, phone number, job title and employer.
  United States — EU-US Data Privacy Framework
• ZenLeads, Inc. (Apollo) — Sourcing of business contacts; first name, surname, work email, phone number, job title, company and LinkedIn profile.
  United States — EU-US Data Privacy Framework
• 521 Products Pty Ltd (Smartlead) — Delivery of business email campaigns; first name, email address, company, website and communication content.
  Australia — standard contractual clauses pursuant to Article 46 GDPR
• HeyReach Inc OÜ — Outreach to business contacts on LinkedIn; LinkedIn profile, name, company, job title and message content. The service is hosted in the United States and its sub-processors include the language model providers OpenAI and Anthropic, which process communication content for sentiment analysis and support triage.
  Estonia, hosted in the United States — standard contractual clauses pursuant to Article 46 GDPR
• Guideflow — Embedded interactive product demo on the home page; visitor's IP address. The player is only downloaded from the provider's servers after the visitor clicks the button that starts the demo, so no data is transferred for visitors who never start it. IP address tracking is switched off in the controller's account settings, but loading the demo still sends the visitor's IP address to the provider.
  France, data stored in Belgium, European Union
• Calendly, LLC — Booking calendar embedded on the Contact page; name, email address, meeting time, answers to the booking form questions and the IP address of the page visitor. The calendar loads as soon as the Contact page is opened. The provider's sub-processors include Amazon Web Services, SendGrid and Twilio.
  United States — EU-US Data Privacy Framework

Processors listed with a European Union country process personal data within its territory and no transfer to a third country takes place. The controller operates the platform on servers located in the European Union.

Personal data is transferred to a third country in the case of processors established or hosted outside the European Economic Area. Transfers to Google LLC, Stripe, Inc., Meta Platforms, Inc., Microsoft Corporation, HubSpot, Inc., ZenLeads, Inc. (Apollo) and Calendly, LLC, all established in the United States, rely on the European Commission's adequacy decision under Article 45 GDPR, namely the EU-US Data Privacy Framework, in which these recipients are certified participants. Transfers to 521 Products Pty Ltd (Smartlead) in Australia and to HeyReach Inc OÜ, which is hosted in the United States, rely on standard contractual clauses pursuant to Article 46 GDPR; no adequacy decision is available for those two countries. The Google Tag Manager script is downloaded from the provider's servers as soon as the page loads, so the visitor's IP address is transferred to Google LLC regardless of whether the visitor accepted or declined cookies. The same applies to the Calendly booking calendar on the Contact page: it is loaded from the provider's servers as soon as that page is opened, because the calendar cannot be displayed without it. Calendly, LLC publishes its data processing agreement in pre-signed form, and it incorporates standard contractual clauses as a fallback mechanism should the adequacy decision cease to apply.

Under the conditions set out in the GDPR, you have:

• the right of access to your personal data pursuant to Article 15 GDPR,
• the right to rectification of personal data pursuant to Article 16 GDPR, or restriction of processing pursuant to Article 18 GDPR,
• the right to erasure of personal data pursuant to Article 17 GDPR,
• the right to object to processing pursuant to Article 21 GDPR,
• the right to data portability pursuant to Article 20 GDPR,
• the right to withdraw consent to processing in writing or electronically to the address or email of the controller specified in Article III of these terms.

You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe that your right to personal data protection has been violated.

The controller declares that it has taken all appropriate technical and organizational measures to secure personal data.

The controller has taken technical measures to secure data storage and storage of personal data in paper form, in particular:

• use of antivirus programs,
• secure storage of backups,
• secure access passwords,
• encryption of sensitive data.

The controller declares that only persons authorized by it have access to personal data.

By entering the platform, that is, by registering a user account, accepting an invitation to a company account or subscribing, you confirm that you are familiar with the terms of personal data protection and that you accept them in full.

When registering a user account, you confirm your acceptance of the terms and conditions and your familiarity with this policy by ticking a box that is not pre-filled. The controller keeps a record of that confirmation, including its date and the version of the documents it relates to. Consent to receiving commercial communications is independent of that confirmation, is voluntary and is given separately.

The controller is entitled to change these terms. The controller will publish a new version of the personal data protection terms on its website, or will send you a new version of these terms to the email address you have provided to the controller.

This website uses cookies and third-party measurement tools. We obtain your consent to their use via the cookie banner. The Google Tag Manager tag manager loads as soon as the page opens, that is, before you decide in the banner. The Google tools it manages follow your choice through Consent Mode. The tools of the other providers listed in art. 9.3 run only after consent is granted to the relevant cookie category. The Calendly booking calendar is an exception: it loads as soon as the Contact page is opened, that is, before you decide in the banner, because the calendar cannot be displayed without it. The embedded Guideflow demo, by contrast, does not load on page open at all: it is downloaded only after you click the button that starts it. Umami loads only after you grant consent to analytics cookies.

Cookie categories:

• Necessary cookies — Ensure basic website functionality (login, language, settings). They cannot be disabled.
• Analytics cookies — Allow us to measure traffic and analyze user behavior. The specific tools are listed in art. 9.3.
• Marketing cookies — Used to display relevant ads and measure campaign effectiveness. The specific tools are listed in art. 9.3.

Measurement and marketing tools and embedded third-party services in use:

• Google Tag Manager (GTM) — Tag management system. It stores no cookies itself, but it loads as soon as the page opens and therefore transfers the visitor's IP address to the provider regardless of the choice made in the banner.
  Provider: Google LLC, USA
• Google Analytics 4 — Measurement of traffic and visitor behavior on the website. Stores cookies. Follows your analytics cookie choice through Consent Mode.
  Provider: Google LLC, USA
• Google Ads — Conversion measurement and remarketing for advertising campaigns. Stores cookies. Follows your marketing cookie choice through Consent Mode.
  Provider: Google LLC, USA
• Meta Pixel — Measurement of advertising campaign effectiveness on Meta platforms and building of advertising audiences. Stores cookies. It runs only after consent is granted to marketing cookies.
  Provider: Meta Platforms, Inc., USA
• Microsoft Clarity — Analysis of visitor behavior including session recording, that is, mouse movement, clicks, scrolling and the content of the pages displayed. Stores cookies. It runs only after consent is granted to analytics cookies.
  Provider: Microsoft Corporation, USA
• Leadfeeder — Identification of the company a visitor comes from, based on their IP address. Stores cookies. It runs only after consent is granted to analytics cookies.
  Provider: Dealfront (Leadfeeder), Finland and Germany
• Umami Analytics — Open-source web analytics tool. It does not use third-party cookies, does not track users across websites and the data is stored on our server in the EU. The script loads only after you grant consent to analytics cookies.
  Provider: cyrcID self-hosted instance
• Guideflow — Embedded interactive product demo on the home page. May store third-party cookies. It does not load when the page opens — the player is downloaded from the provider's servers only after you click the button that starts the demo.
  Provider: Guideflow, France, data stored in Belgium
• Calendly — Booking calendar embedded on the Contact page. May store third-party cookies. It loads as soon as the Contact page is opened, before you make a choice in the banner, because the calendar cannot be displayed without it.
  Provider: Calendly, LLC, USA

Revoking consent:

You can change or revoke your cookie consent at any time by clicking the cookie settings button in the website footer, or by deleting cookies in your browser.