Privacy Policy | Spotflow.io

1. What is this page?

This page explains everything you need to know about your privacy and security while visiting our website www.spotflow.io. In particular, we (Spotflow, s.r.o., company registration number: CZ19630735, registered in the Commercial Register of the Czech Republic, maintained by the Municipal Court in Prague, section C, entry no. 389453, with its registered seat at Banskobystrická 2080/11, Dejvice, 160 00 Praha, the Czech Republic), want to inform you how we process your personal data and what rights you have in this respect. We also want to assure you that we take personal data protection very seriously and we do our best to comply with all applicable legislation, such as the GDPR. If you do not agree with the data practices described in this Privacy Policy, you should not use our website.

2. What information do we process and how?

In order for us to be able to provide you with high-quality services, we need to collect and process information about you. We may do so in the following ways:

2.1. Information you directly give us

If you contact us by using the contact form on our website, you may need to provide us with your name, e-mail address, name of your company, and the content of your question (request). In the follow-up, we may ask for further information necessary for answering your question (e.g., technical details related to your electronic devices).

The information you provide through these contact forms, including any personal data, may be stored in Webflow, a third-party service provider that we use to manage our website. We take appropriate measures to protect the confidentiality and security of the information collected. Here is more information on Webflow’s privacy practices.

We use CRM Pipedrive, where we store data for marketing and sales purposes. If you want to know how they process personal data on our behalf, you should read the Pipedrive Privacy Policy and the Pipedrive Data Processing Addendum.

We also process incoming requests received via email for the purpose of responding to inquiries, providing customer support, and addressing other communication needs. The information shared with us via email, including any personal data provided by the sender, may be stored in our email inboxes for record-keeping purposes and to facilitate ongoing communication. We take appropriate measures to protect the confidentiality and security of email communication.

We use Stripe, a payment processing platform, to facilitate payments for products and services you order from us. Stripe may collect “transaction data” that are needed to process your payment, such as your name, email address, and card number. If you are interested in Stripe’s approach to personal data protection, you may find their privacy policy.

If you use single sign-on (hereinafter “SSO”) to login into the platform, we provide your email address to the identity provider of your choice [e.g. Microsoft, Google, Github, LinkedIn, or X (formerly Twitter)] to validate your credentials. If the identity provider asks you to authenticate (e.g. with your user name and password), the authentication process is managed by the identity provider and according to their rules, including their respective privacy policies. We do not receive nor do we process your credentials with the identity provider (e.g. the password to your Google account).

2.2. Information we collect from your use of our website

When you use our website, we and service providers acting on our behalf automatically record information that your device or browser sends out (hereinafter “the Log Data”).

The Log Data may include information such as:

IP address;
the type of device you are using (e.g., computer, smartphone, tablet);
the type and version of the operating system,
the type and version of the Internet browser;
your browser language;
country;
location;
referring and exit pages, and URLs;
time spent on a page;
the number of clicks on a page or feature.

We may combine the Log Data with other information we collect or have about you.

For processing the Log Data, we use Google Analytics (including Google Analytics Demographics and Interest Reporting), which is a web analysis service provided by Google. Google utilizes the Log Data collected to track and examine the use of our website, prepare reports on users’ activities and share them with other Google services. Google may use the Log Data collected to contextualize and personalize the ads of its own advertising network. If you are interested in Google’s approach to personal data protection, you may find more in Google Privacy Policy and Data Protection.

We use reCAPTCHA, a security feature provided by Google, to protect against automated spam and abuse on our website. reCAPTCHAcollects certain information about user interactions with our website, such as IP address, browser type, and cookies (for more information about cookies, see section C below), in order to determine whether a user is a human or a bot. Google can also use this information in order to improve its reCAPTCHA services. If you are interested in Google’s approach to personal data protection, you may find more in Data Protection and Privacy Policy. You can learn more technical details about reCAPTCHA on Google's web developer page.

We use Leadfeeder, a tracking tool, on our website to collect information about visitors' interactions with our site. Leadfeeder may collect and process personal data, such as browser information, website usage information, name of the owner of the IP address, the reverse domain of the IP address, and others, in order to identify potential leads and track website engagement. Leadfeeder may also use cookies (for more information about cookies, see section C below). This information may be used to improve our marketing efforts and provide a better user experience. If you are interested in Leadfeeder’s approach to personal data protection, you may find more information in Leadfeeder´s Privacy Notice and by Dealfront Group GmbH (Leadfeeder´s Data Controller).

We use Lucky Orange, an analytics software, to collect information about visitors' behavior on our website. LuckyOrange may collect and process personal data, such as browser information, website usage information, the name of the owner of the IP address, the reverse domain of the IP address, and others, in order to track website engagement. LuckyOrange may also use cookies (for more information about cookies, see section C below). This information may be used to improve our marketing efforts and provide a better user experience. If you are interested in LuckyOrange’s approach to personal data protection, you may find their privacy policy.

2.3. Information collected from cookies
Our service providers use cookies or similar technologies to collect information relating to you and your use of our website. Cookies are small files that enable storing and collecting specific information related to you and your use of our website. Cookies assist us in improving our website and tailoring it to your needs.

We use the opt-in method of cookie consent (also known as explicit consent), which means that cookies or tracking technologies are not set or used by default when you visit the website unless you have explicitly provided your consent by clicking the “Accept” button. We use four categories of cookies on our website: essential (or technical) cookies, analytical cookies, marketing cookies, and personalization cookies.

You may find more information on the use of cookies by Google Analytics and reCAPTCHA, by Leadeeder Privacy Notice, and by Pipedrive Cookie Notice.

3. Why and how do we use the collected information?

Answering your questions and addressing your needs
We use the information you directly give us by filling in the contact form on our website to communicate with you and reply to your requests for information or any other kind of request as indicated by the form’s content.
We use the SSO or Stripe for making your life easier.
We use the Log Data and cookies to better tailor the website to our users’ needs.
Legal compliance and addressing claims
We need to process (store) your information in order to comply with the law, to be able to address your claims (e.g. that we did not meet our commitments), or to prove that we addressed illegal activities of our users.
Safe, secure, and well-functioning website
We use the Log Data to monitor and analyze the use of our website for its technical administration, to develop and improve its functionality, and to protect it.

4. What is the legal basis for the processing of your personal data?

As can be seen from the previous section, there are numerous reasons for processing your personal data. These reasons result in the following legal grounds justifying the data processing that we do:

you have given us your consent (e.g., to use cookies or the SSO), or
it is necessary for pursuing our legitimate interests (e.g., for being able to address your claims or claims of third parties), or
for the performance of the contract or taking steps prior to entering into a contract (e.g., for answering your questions).

5. Whom do we share your personal information with?

Generally, we do not share any personal information with third parties unless you give us prior consent.

We may share your personal information with contractors who assist us in running our website (e.g., providers of infrastructure or IT services such as Google, Weblow, Leadfeeder or Pipedrive). If we do so, we share only the information that our contractors need for performing their tasks. All of our contractors are bound by strict confidentiality and are committed to complying with the personal data protection legislation.

We may share your personal information with public authorities when the law requires us to do so. In such cases, we share only the information that we have to, and we communicate with the concerned users as soon as allowed.

We may also disclose personal information in order to identify, contact, or bring legal action against a person or entity who may be causing us harm or endangering our interests.

If we are involved in a corporate reorganization (e.g., acquisition, merger, asset sale), personal information may be transferred to the acquiring entity and become subject to a different privacy policy. Before the data transfer, we will give you a notice and option to opt out of the transfer.

6. For how long do we retain your data?

We store your personal data for as long as required by the purpose they have been collected for. More specifically:

If the processing is based on your consent, we delete the data when you withdraw the consent, unless there are reasons to delete them earlier.
If the processing is necessary for enforcing legal claims or complying with legal regulations, we retain the data for the periods required by the law, for the duration of the prescription periods, or for the duration of the legal proceedings.
All cookies have their expiration times that you may find for Google Analytics and reCAPTHA, for Leadfeeder, and for Pipedrive.

7. What rights do you have in relation to your personal data?

You may be entitled to exercise some or all of the following rights free of charge (such rights may vary depending on various factors, e.g. on the way how we collected your personal information):

require information about whether your personal information is retained and access to and/or duplicates of your personal information retained, including the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipients to whom the personal information is disclosed and where possible, the envisaged period for which the personal information will be stored, or, if not possible, the criteria used to determine that period;
request proper rectification, removal, or restriction of your personal information, e.g. because (i) of the incomplete or inaccurate nature, (ii) it is no longer needed for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have taken advantage of an existing right to object to the data processing; in case your personal information is processed by third parties, we will also forward your request for rectification, removal, or restriction to such third parties unless this proves impossible or involves a disproportionate effort;
receive the personal information concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance from our side; where technically feasible you shall have the right to have the personal information transmitted directly from us to another controller;
refuse to provide and – without impact to data processing activities that have taken place before such withdrawal – withdraw your consent to the processing of your personal information at any time;
not to be subject to any automated decision-making that would have legal effects on you or that could similarly significantly affect you.

You may exercise the rights referred to above or ask any questions or make any complaints regarding the data processing by contacting us. You also have the right to bring a claim before the competent data protection authority.

8. Contact information

If you have any additional questions or concerns about our Privacy Policy, please email us at info@spotflow.io or send a letter to Spotflow, s. r. o, Vítězné náměstí 577/2, Dejvice, 160 00 Praha 6, the Czech Republic.