1. Who we are
The controller of your personal data is Complify AI s.r.o., Na příkopě 392/9, Staré Město, 110 00 Praha 1, Czech Republic. Company ID (IČO) 29959985. Registered with the Municipal Court in Prague, file C 455146.
Privacy questions and requests: privacy@complif.ai [FOUNDER INPUT: confirm the privacy mailbox exists (#7)], or by post to the address above.
We have not appointed a data protection officer. We are not a public body, we do not monitor people on a large scale, and we do not process special categories of data. The law therefore does not require one (GDPR Article 37).
2. What we process, why, and for how long
The website itself does not ask you for any personal data. We process personal data only when you contact us, and in the technical logs described in section 6.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Contact or demo request: your name, company, work email, country, product category and message. | To answer your request, arrange a demo and prepare an offer. | Our legitimate interest in responding to business enquiries (Article 6(1)(f)). If you contact us for yourself as a sole trader, the basis is pre-contract steps at your request (Article 6(1)(b)). | 12 months after our last exchange about your request. If a contract follows, for the life of the contract and the statutory accounting and tax periods. |
| Email to or from our addresses. | To communicate with you. | Legitimate interest as above. | 12 months after the last message, unless a contract follows. |
| Delivery records of emails we send you (message ID, your address, delivery status). | To confirm delivery and detect failures. | Legitimate interest in reliable communication (Article 6(1)(f)). | 30 days. |
| Technical records of calls to our contact form (time, status, city-level location, no IP address). | To keep the service secure and working. | Legitimate interest in security (Article 6(1)(f)). | 90 days. |
| Your requests under this notice and our replies. | To show that we handled them correctly. | Legal obligation to demonstrate compliance (Article 5(2), Article 6(1)(c)). | 3 years after we close the request. |
Our legitimate interest is to receive, answer and follow up business enquiries from companies that ask about our product. We have weighed this interest against your rights. You can ask us for a summary of that assessment.
On the contact form, name, company, work email, country and product category are required; the message is optional. If you leave a required field empty, we cannot answer you. There is no legal or contractual duty to give us any data.
We never use your details for marketing emails without your prior consent. If you become a customer, we send you news about similar products only with a clear way to opt out in every message (Act No. 480/2004 Coll., Section 7).
3. Who receives your data and where it is processed
We use Microsoft as our hosting and email provider. Microsoft acts as our processor under a data processing agreement with EU standard contractual clauses.
- Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland: Azure Static Web Apps, Azure Functions and Azure Monitor. The hosting resource is currently in the Azure region East US 2 (United States) while access to an EU region is pending; it serves page requests only. The contact form currently opens an email in your own mail program, so no form data is processed by our hosting. [FOUNDER INPUT: once the form backend runs in an EU region, state the region here (#19)] The website pages are delivered from Microsoft’s global edge network, so a page request is served from the location closest to you.
- Microsoft Ireland Operations Limited: Azure Communication Services Email, data location Europe [FOUNDER INPUT: confirm ACS data location (#19)]. It sends your request to our mailbox.
- [FOUNDER INPUT: mailbox provider and location for the hello and privacy mailboxes (#7)].
Your contact-form data and our emails are stored in the European Union. Microsoft’s own operational logs are pseudonymised and handled under its EU Data Boundary commitment. Where Microsoft transfers data outside the EU, it relies on EU standard contractual clauses. You can obtain a copy of the clauses from us or from Microsoft’s Data Protection Addendum.
Our source code is hosted on GitHub. GitHub does not receive any visitor data.
We disclose personal data to public authorities only when the law requires it. We do not sell personal data.
4. Your rights
You have the right to:
- access your personal data and get a copy (Article 15);
- correct inaccurate data (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive the data you gave us in a machine-readable format, where we process it by automated means on the basis of a contract (Article 20). For contact requests, this usually does not apply.
Right to object. Where we rely on legitimate interest, you can object at any time on grounds relating to your situation (Article 21). We then stop, unless we show compelling legitimate grounds that override your interests. Write to privacy@complif.ai.
We do not process data on the basis of consent. If that changes, you will be able to withdraw consent at any time.
How to exercise your rights: email privacy@complif.ai or write to our address. We reply within one month. In complex cases we can extend by two months, and we tell you if we do. Requests are free of charge. We reply to the email address you used, so that we know the request is yours.
5. Complaint to the supervisory authority
You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic; posta@uoou.gov.cz; data box qkbaa2n; uoou.gov.cz. A complaint must be signed: electronically, through a data box, or on paper. You can also complain to the authority of the EU country where you live or work.
6. Cookies, analytics and logs
This website sets no cookies and uses no analytics. There are no third-party scripts, fonts or embeds.
We do not store your IP address. Our contact-form service records the time, the result and a city-level location of each call, with the IP address replaced by zeros. Microsoft keeps its own pseudonymised system logs to run and secure its platform.
7. Automated decisions and children
We make no decisions about you by automated means and we do not profile you. This website is intended for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 15.
8. Changes
We update this notice when our processing changes. The date at the top shows the current version. Material changes to how we use your data are announced on this page before they take effect.