Privacy policy

PRIVACY POLICY

We are Pointee Interactive s.r.o. (“We“ or “Us”) and We, as a controller of your personal data, inform you as users of our websites https://www.pointee.com, costumers, distributors, suppliers and users of our platform about how We process personal data.

Firstly, some basic information about Us:

Pointee Interactive s.r.o., ID No.: 09146067, U Jezu 525/4, 460 01 Liberec, Czech Republic, entered in the Commercial Register maintained by the Regional Court in Ústí nad Labem, section C, insert 45321;

Contact e-mail: support@pointee.com

This privacy policy gives you information on how We collect and process your personal data through your use of this website, including any data you may provide through this website when you sign up to a free trial, or purchase a products or services from Us.

WHAT and WHY?

We collect the following information:

• Information you provide to Us. This includes personal data you disclose to Us when contacting Us, requesting Our support or showing interest in Our services. As a rule, you provide this information to Us by completing and sending a certain form on Our website, during signing up to an account, in a contract or in a request for support. These data include, for example, the name, surname, signature, e-mail address, telephone number, name of organisation, position or website. If you have requested support from Us, We have information on your individual requirements. These information are processed mainly due to the contractual relationship between Us, under Our legal obligations or under Our legitimate interest which consist of securing communication with you and protecting Our own legal interests.
• Organization and log data. Like many site operators, We collect information that your browser sends whenever you visit Our website or platform. This log data may include information such as your computer's Internet Protocol address, browser type, browser version, the pages of Our website that you visit, the time and date of your visit, the time spent on those pages and other statistics. In addition, We may use third party services such as Google Analytics that collect, monitor and analyze this. We will process information for analytics purposes (Google Analytics) only when you give Us your consent. Some of the log data may be also used under Our legitimate interest for protection of website and platform and to provide smooth services.
• Google Analytics. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of Our services. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page.
• Newsletters. We may also send you news and other marketing communication. We will only do that if you give Us your consent. You also have an option to withdraw the consent at any time in any e-mail We will send you. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

We process your personal data based on the performance of Our mutual contract or your requirement, based on the performance of Our statutory duties or based on Our legitimate interest. We will always inform you and ask for your consent before using such information for a purpose not specified in this Policy.

FOR WHAT PERIOD OF TIME WE PROCESS THE COLLECTED INFORMATION?

Your personal data are always used only for a period necessary to achieve the purpose for which they were collected – for example, for the duration of the business partnership, until you have expressed disagreement with receiving Our marketing communications or as long as We are dealing with your requests for support. Some information about data retention may be also found in Our Terms of service in Article 6.

WHO HAS ACCESS TO INFORMATION?

Your personal data may be processed by Our following recipients in order to improve the quality of Our services and ensure certain activities: 

• Microsoft company providing cloud services;
• Our contractors;
• the contact forms on Our website are run in cooperation with HubSpot, Inc. (see their Privacy Policy) which provides Us with an online forms platform. We also use G Suite apps from Google LLC (see their Privacy Policy);
• Elasticsearch BV company providing software named Kibana.

We process your personal data only on the territory of the European Union or the European Economic Area. However, some of Our partners that We pass on your personal data may be from third countries. However, We always ensure that your data is passed on to Our partners in these countries in accordance with legal regulations in the field of personal data protection, so We only cooperate with partners from countries providing an adequate level of protection, based on decisions of the European Commission or partners who provide other appropriate guarantees for transfer.

If you want to determine where your specific information is located, you can contact Us at any time at the following e-mail address support@pointee.com and We will resolve your request together.

WHAT RIGHTS YOU HAVE IN RELATION TO THE COLLECTED INFORMATION AND HOW YOU SHOULD EXERCISE THEM

You have the following rights in relation to Our processing of your personal data: 

1. right of access to personal data; 
2. right to rectification;
3. right to erasure (‘right to be forgotten’);
4. right to restriction of data processing;
5. right to data portability;
6. right to object to processing; and
7. right to file a complaint with respect to personal data processing.

Your rights are explained below so that you can get a better idea of their contents. You can exercise all your rights by contacting Us at the following e-mail address: support@pointee.com. You can file a complaint with the supervisory authority, i.e. the Office for Personal Data Protection (www.uoou.cz).

The right of access means that you can ask Us at any time to confirm whether or not personal data concerning you are being processed and, if they are, you have the right to access the data and to information for what purposes, to what extent and to whom they are disclosed, for how long We will process them, whether you have the right to rectification, erasure, restriction of processing or to object; from which source We obtained the personal data, and whether automated decision-making, including any profiling, occurs on the basis of processing of your personal data. 

The right to rectification means that you may request Us at any time to rectify or supplement your personal data if they are inaccurate or incomplete. 

The right to erasure means that We must erase your personal data if (i) they are no longer necessary for the purposes for which they were collected or otherwise processed; (ii) the processing is unlawful; (iii) you object to the processing and there exist no overriding legitimate grounds for processing; (iv) this is required of Us based on a legal duty or (v) if you withdraw your consent you have given. 

The right to restriction of processing means that until any disputable issues concerning the processing of your personal data are resolved, We must restrict the processing of your personal data. 

The right to data portability means that you have the right to obtain personal data that concern you and which you have provided to Us and which are processed in an automated manner and on the basis of consent or contract, in a structured, commonly used and machine-readable format, and the right to have these personal data transferred directly to another controller.

The right to object means that you may object to the processing of your personal data that We process for the purposes of Our legitimate interests, especially for the purposes of direct marketing. If you object to processing for the purposes of direct marketing, We will no longer process your personal data for those purposes.

‍

DATA PROCESSING TERMS

BASIC INFORMATION

1. Under the Terms of service that are available here: https://www.pointee.com/terms (the “Terms”), or under separate Service agreement, we as Pointee Interactive s.r.o. (the “Pointee”, “We” or “Us”) provide SaaS platform designated especially for automation development teams under which we provide analysis of automated processes (the “Services”).
2. During provision of the Services, We may process personal data. By personal data We mean personal data of data subjects, which are in particular Your employees and other associates and other data subjects whose personal data have been transferred to Us for the purpose of providing the Services and fulfilling other obligations under the Terms (the "Personal Data"). This DPT regulates the conditions for the processing of personal data by Us as a processor of personal data within the meaning of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).
3. Capitalized words have the same meaning as stated in the Terms, unless stipulated otherwise in the DPT.
4. Please do not forget that our Services are not mainly focused on processing of Personal Data, so this DPT is applicable only in cases where You designate Us to do so.

WHAT IS THE SCOPE OF THIS DPT?

1. Firstly, some basic information:
   
   • We are the processor or sub-processor of Personal Data,
   • You are the controller or processor of Personal Data,
   • we both undertake to fulfil obligations under the applicable legislation applicable to the processing of Personal Data.
2. If You act as a processor, You guarantee Us that the competent controller has approved instructions and actions in connection with Personal Data, including the mandate of Us as another processor.
3. We will process Personal Data in accordance with applicable law and for the purpose of providing the Services, and as further stated in other written instructions given by You. Instructions should be made via e-mail or other means of communication, tool etc., that we chose or agree on. 

FOR HOW LONG WE PROCESS PERSONAL DATA?

The rule is simple, We will process Personal Data only for the duration of the provision of Services under Terms or Service agreement or until all Personal Data are deleted by Us according to this DPT. Please note down, that your account will be archived for 90 days, so during this period, We may still process Personal Data.

WHY WE PROCESS PERSONAL DATA AND HOW WE DO THAT?

1. For the purposes of providing the Services, We may process Personal Data in electronic form through Our Platform, Website or through other means determined by You, while the subject-matter of the processing will be viewing Personal Data, storage of Personal Data, logging of Personal Data, analysis of Personal Data, providing support services and other activities necessary for providing the Services.
2. As we mentioned above, during the Services we do not focus on processing of Personal Data as our main goal. You are obliged to provide all data in such a way that they do not contain any personal data at all.

TYPES OF PERSONAL DATA

The following Personal Data may be processed in accordance with this DPT:

1. identification data;
2. log data;
3. information gathered from automated processes analysis;
4. information provided by robotic processes;
5. other data that will be made available in connection with the provision of the Service.

‍CATEGORIES OF DATA SUBJECTS

Personal Data will cover the following categories of data subjects:

1. Your employees;
2. Your data subjects that are processed by robotic processes;
3. other data subjects about which You have obtained Personal Data and which was transmitted to Us in connection with the provision of the Services.

RIGHTS AND OBLIGATIONS

1. We declare and undertake to:
   
   • if We become aware of a breach or impending breach of the security of Personal Data, accidental or unlawful destruction, loss, alteration or unauthorized provision or disclosure of the processed Personal Data, immediately, but no later than 48 (forty-eight) hours, inform You in writing and describe as best as possible the resulting or imminent security risk, informing You of appropriate measures to prevent or minimize the breach of the security of the Service and taking all necessary measures to minimize damage;
   • Personal Data shall be secured in accordance with Article 8 of this DPT;
   • Personal Data will be processed only in accordance with this DPT or on the basis of Your other written instructions;
   • assist You in implementing and maintaining appropriate technical and organizational measures to secure Personal Data, reporting Personal Data breaches to the supervisory authority or data subject, assessing the data protection impact assessment and in previous consultations with the supervisory authority;
   • ensure cooperation with You through appropriate technical and organizational measures, no later than 14 (fourteen) days after Your request has been made, in order to fulfil Your obligation to respond to requests for the exercise of the rights of the data subject;
   • provide You, at request, without delay, but not later than 14 (fourteen) days after Your request has been made, with all the cooperation necessary to prove that the Personal Data are sufficiently organizationally and technically secured.
2. If We receive any request from the data subject in relation to Personal Data when processing Personal Data as a data processor, We shall inform the data subject to contact You directly with the request. You are responsible for handling such request. We undertake to provide You with all the cooperation necessary for the settlement of the rights of data subjects.
3. You agree that We will involve other processors for the processing of Personal Data and, if these other processors are involved, We ensure that they comply with the same data protection obligations as those set out in this DPT. You expressly agree that we will involve cloud service providers (e.g. Microsoft), service providers for monitoring and logging, our workers (e.g., working under cooperation agreement) and company that helps us with providing algorithms for analysis (located in Italy).
4. Should We involve other processors not listed in this DPT, We will inform You in advance and, if necessary, allow You to object to such involvement. If You do not object even within 14 (fourteen) days of the notification of the involvement of the additional processor, We shall involve the additional processor in the processing of the Personal Data. If You object, We shall evaluate the objection and, if We find it to be justified, We shall not involve the additional processor.
5. We shall enable You or a person authorized by You to check (including audit or inspection) compliance with this DPT, in particular the obligations for processing Personal Data arising therefrom, and shall contribute to such checks as reasonably instructed by You or the person checking.
6. You are obliged to send any request for an audit exclusively to the e-mail address support@poitntee.com. Upon receipt of the audit request, we agree in advance on: (a) the possible date of the audit, security measures and how to ensure compliance with confidentiality obligations during the audit, and (b) the expected beginning, scope and duration of the audit. In the event that no agreement is reached within 30 days from the date of submission of the application, the terms of the audit shall be determined by Us.
7. We may object in writing against any auditor appointed by You, if the auditor is not sufficiently qualified in Our opinion, is not independent, is in a competitive position with Us or is otherwise obviously unsuitable. On the basis of the objection raised, You are obliged to appoint another auditor or to carry out the audit himself.
8. You are responsible for fulfilling all obligations in relation to the processing of Personal Data, in particular for properly informing data subjects about the processing of Personal Data, obtaining consent to the processing of Personal Data, if necessary, processing requests of data subjects about the realization of their rights (such as the right to information, access, rectification, erasure, restriction of processing, object, etc.). 
9. If you provide Us with Personal Data, that are not necessary for the provision of Services, we will not process them for any purpose. However, due to the fact that we are not able to control this, you are responsible for any Personal Data that you send to Us.

HOW DO WE SECURE PERSONAL DATA?

1. We have taken the following measures and undertakes to maintain them to ensure the security of the processing of Personal Data throughout the processing process.
2. Organisational measures:
   
   • We and Our workers are regularly trained on the principles of data protection and cybersecurity;
   • We and Our staff are also obliged to confidentiality in connection with the processing of Personal Data;
   • We have a policy of working with Personal Data, where only selected workers are allowed to access Personal Data;
   • We regularly review data access and remove access to workers who no longer work with Us.
3. Technical measures:
   
   • HDD is encrypted on the work devices on which processing activities are carried out;
   • using sufficiently strong passwords when working with Personal Data;
   • use of two-factor authentication to log into systems where Personal Data are processed;
   • only a secure connection is used to access the infrastructure;
   • We regularly have penetration tests done by an external specialized company;
   • We use the security mechanisms offered by MS Azure.
4. We will take such technical, personnel and other necessary measures to prevent unauthorized or accidental access to, alteration, destruction or loss of Personal Data, unauthorized transfers, other unauthorized processing or other misuse of Personal Data.

WHAT WILL HAPPEN IN THE END?

Upon termination of the Terms, Service agreement or other contract, regardless of the manner and reason for its termination, We will, within 14 (fourteen) days, return all Personal Data to You and permanently destroy the Personal Data on all other devices and media outside the devices and media owned or used by You, except where storage of the Personal Data is required by the law of the Czech Republic or the European Union or except in cases where the Personal Data are processed by Us (for own data analysis).

FINAL WORDS

1. The limitation of liability as set out in Article 7 of the Terms will apply also on processing of Personal data as set out in this DPT. 
2. We reserve the right, at Our sole discretion, to modify or replace these DPT at any time. If a revision is substantial, We will try to provide at least a 30 day notice prior to any new terms taking effect. What constitutes a substantial change will be determined at Our sole discretion. You can always find the most recent version on the Website.
3. Failure to exercise any right under this DPT shall not be deemed a waiver of such rights or an established practice.

‍