Privacy Policy

We are company TOPefekt s.r.o. with its registered seat at B. Němcové 767/13, 787 01 Šumperk, Czech Republic, ID no.: 29444268. We operate a multi-channel communication platform for successful business communication called BulkGate (the "Application") and we would like to inform you about how we process your personal data provided. For more information about our Application, please visit www.bulkgate.com.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC („GDPR“) we process personal data in two different positions – as a personal data controller and a processor.

What is the difference between personal data controller and processor?

The personal data controller is natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data. In other words, it is the controller who decides what personal data to process, how to process it, how long to store it and what to use it for. When handling personal data, the personal data processor is guided only by the instructions of the controller (or what is provided for by law or other legal regulation or as agreed in the processing agreement).

In this document, we will introduce you to how we process personal data as personal data controller. As personal data controller, we need your personal data in order to create an account for you on the Application, to keep our records, and to perform other duties related to the provision of our services. We will also describe you the reasons why we need the personal data, how we handle it, how long we keep it, who has access to it, or what rights you have in relation to GDPR.

However, because you provide us with additional personal data about the people you wish to send messages to through the Application (you provide us with their phone number, you set up accounts for your employees and workers, request us to provide marketing campaigns for you, etc.), we process personal data as personal data processor. You act as a personal data controller in relation to these persons and personal data. Our services consist of sending text messages, marketing campaigns, integrations into your other systems, etc. The relationship between us as a processor and you as a controller is governed by separate Data Processing Terms, which are available here. By agreeing to the Data Processing Terms, when you create an account within our Application, we enter into a data processing agreement in accordance with Article 28 of the GDPR.

If you have any questions or concerns about privacy and personal information, please contact us at dpo@topefekt.com.

1. WHAT PERSONAL DATA WE PROCESS AND WHERE?

If you use our services, register an account on our Application or contact us with various requests, we will process your personal data or the personal data of your representatives who provide us with their personal data. Specifically, this includes the following situations:

• Setting up a user account and using our services. In this case, we will process your name, surname, e-mail, phone number, or other identification data. At the same time, while using our services, we may request your billing information, IP address, time zone information, browser information, language preferences, and other information that the Application allows you to enter or that you choose to insert into the Application. We may also request other personal information not mentioned herein if, for example, we want to verify that you are authorized to conclude a contract with us.

• When you contact us via the forms on the BulkGate website, on the Application or via the support contacts. In this case, we will process your email, the information you enter in the message or give us when you contact our support, the country you choose to contact us from and the information you provide in the message. We have different types of contact forms on the website, so the scope of personal data may vary depending on the type of enquiry you have for us.

• While using the Application or while browsing the website mentioned above. In this case, we may also store, through various scripts, information in your browsers, then return to it, or use third-party tools that do the above mentioned for us. For the purposes of this Privacy Policy, we will refer to this stored information as cookies and a detailed description of these cookies can be found in Appendix A of this Privacy Policy.

When using the Application, you may enter phone numbers, other contact details, message texts and information about the people you wish to send messages to or request us to carry out marketing campaigns. However, we will process this personal data on the Application as personal data processor and the way we process it is governed by the Data Processing Terms mentioned above. You are obliged to comply with all obligations and legal requirements in relation to those persons whose personal data you have provided to us. Please refer to the Data Processing Terms for details of your responsibilities.

2. PURPOSE OF PROCESSING AND LEGAL BASIS FOR PROCESSING

We only process personal data for specified purposes. The GDPR then requires us to have a legal basis, or lawfulness of processing, for each of these purposes. There are several different legal bases under the GDPR, and we explain below what specific legal basis for which purposes we have.

• Personal data provided while creating account in the Application and while using our services.

• We will process this personal data as we want to set up an account for you and enable you to use our services. Although it may not seem so at first glance, the creation of a user account creates a contractual relationship between you and us. We therefore need the personal data to perform our contractual obligations, to provide you with the functionality of the Application, to provide you with the services and to perform other obligations arising from our contractual relationship. The legal basis for this processing is the necessity for the performance of the contract between you and us pursuant to Article 6 (1) (b) of the GDPR. Certain information may be marked as mandatory when using the Application, you must provide this personal data. Without providing it we would not be able to enter into a contract together or perform our legal obligations under the next clause.

• At the same time, we will need billing and other information to comply with our legal obligations. We are subject to various regulations that require us to retain information for possible audits or to comply with legal obligations. Thus, we also store your personal data in our internal systems for this purpose, the legal basis being the fulfillment of legal obligations under Article 6 (1) (c) of the GDPR.

• Before creating your account in the Application, you can voluntarily decide whether you want to give us your consent to receive commercial communications, either by email, SMS, Viber or RCS. The processing will be based on your voluntary consent within the meaning of Article 6 (1) (a) of the GDPR, and you can withdraw your consent at any time by contacting us or in each individual commercial communication.

• In addition to the above-mentioned under this purpose, we may use your personal data to continuously improve our Application, provide better services, improve them and ensure they are sufficiently secure. Thus, this processing will be based on our legitimate interest to promote our business and provide better services. Although we do not anticipate it, there may be a dispute between us. In this case, we will use your personal data to protect our own legal and other claims based on legitimate interest under Article 6 (1) (f) of the GDPR.

• We use the personal data collected from contact forms in different ways for different purposes. It always depends on the type of enquiry you are contacting us with. We may use it to pass it on to our partners, provide you with support, answer your questions, etc. If your enquiry is related to your user account, support, or otherwise to a mutual contractual relationship, we will process personal data on the basis of the performance of the contractual relationship pursuant to Article 6 (1) (b) of the GDPR. However, if you are not our customer and you only have a general enquiry, we will process personal data based on our legitimate interest under Article 6 (1) (f) of the GDPR to ensure mutual communication.

• We may also use information obtained from our mutual contractual relationship, such as information about orders, use of our services, types of services used, etc., to segment our customers to offer relevant content and services. We may also use third party tools to help us automate this processing. The processing is based on our legitimate interest under Article 6 (1) (f) of the GDPR to improve our business activities. Personal data is processed for the duration of the mutual contractual relationship and for the necessary period after the end of this contractual relationship.

• How we process your e-mail address in connection with the sending of newsletters and other communications from us, please see Article 3 of this Privacy Policy.

• Cookies are used for the purposes set out in the Annex A of this Privacy Policy.

As personal data controller, we determine the purposes and means of the aforementioned processing, where applicable, these purposes and means are determined by law. Although you act as the controller and we only act as the processor in relation to the personal data of persons about whom you give us contact details and ask us to send them a certain message or carry out marketing, we will also process this data beyond your instructions for the purposes set out by law. As the law obliges us to retain communications for a specified period of time, we will continue to retain this personal data as controllers for any requests from law enforcement authorities and other entities listed in Section 97 of the Electronic Communications Act.

3. HAVE YOU RECEIVED AN E-MAIL FROM US?

If you have received an email from us, one of the following situations may have occurred:

• We have sent you information relating to your payment for our services, usage of the Application, a technical or security notice or other email relating to our contractual relationship. We sent you this email because we have a contractual relationship with you. However, there is no way for you to unsubscribe from these emails as they relate to our contractual relationship.
• If you have received a newsletter, email from us offering additional services or similar communications relating to the promotion of our products or services, this is because:
• You have given us your consent in accordance with Article 6 (1) (a) of the GDPR (see above or you can give us your consent separately by signing up to the newsletter). You can subsequently withdraw your consent by writing to us at dpo@topefekt.com, via the button provided in each individual unsubscribe email or in your profile in the settings under "Terms and Consents".
• An incorrect e-mail address has been entered by a third party (incorrect email address entered during registration). In this case, please report it to dpo@topefekt.com.
• Your email address has been misused by someone else. In this case, please report it to dpo@topefekt.com.

We may also process your telephone number in a similar way, so it always depends on whether the information is sent in connection with a contractual relationship or a commercial communication. The lawfulness of our processing is then determined accordingly. If we ask for consent, we will distinguish whether the communication is to be by e-mail or SMS (or similar). However, we will also provide messaging through the Application to you and your contacts. Be aware that it is solely your responsibility to send communications to the telephone numbers you have provided. We only provide you with the Application through which you may do so. For a more detailed definition and set of obligations in connection with such transmission, please refer to the Data Processing Terms available here.

4. WHO HAS ACCESS TO YOUR PERSONAL DATA?

We may share your personal data with others in connection with the provision of our services, the operation of the website or the operation of the Application. These recipients may either provide us with various services or we may have to send them personal data in order to comply with our legal or similar obligations. All persons to whom we provide your personal data are called recipients of personal data under the GDPR.

SMS communication

We use your mobile phone number to send one-time verification codes (OTP) when you register an account or when you sign in from a device we do not recognise, as described in our SMS Terms. SMS opt-in and consent data will not be shared with third parties for marketing or promotional purposes.

Used recipients:

• Storage providers where your personal data is stored so that we can store your established user account, your account activity and provide you with our further services . We use several providers as we also need to keep a backup of this data. All storage providers are located in the Czech Republic, so there is no transfer of personal data outside the EU.

• Service providers for sending/receiving messages that we send to you by phone or email.

• Service providers related to the security of the Application and the website.

• Our workers involved in the development of the Application and the provision of services.

• The payment service providers and gateways through which you may make your payments for using our services (processing is governed by their terms and we are not able to control this).

• Our other partners which provide us with communication services, support services and more.

• Government and security authorities to whom we may transfer your personal data upon their official request if it is suspected of a crime, related to the detection of a crime, or related to a judicial or other proceedings.

• Companies with which the we cooperate – see table below.

• Provider of the accounting system and internal reporting and tracking system.

If you are an employee of a company for which a user account has been set up, personal data may also be transferred to the company with which you have an employment relationship. However, we are not able to control this, as it always depends on who sets up the user account in the Application.

The range of recipients may vary depending on which of our services you subscribe to, where you are located, etc. Therefore, if you are wondering where your specific personal data is stored and processed, please do not hesitate to contact us via email at dpo@topefekt.com.

We may transfer your personal data to the country in which you request us to send a message on your behalf.

When we send different types of messages to different recipients based outside of the EU, your personal data may be transferred to third countries to fulfill your service request. This may involve the local communication service providers who arrange the sending of the messages.

However, the GDPR is quite strict about how we can transfer personal data outside the EU. There must be a mechanism for transferring personal data, called appropriate safeguards.

First of all, it depends on the specific destination. It may be a country that has data protection laws equivalent to those in the EU. A list of these countries is available here. If it is one of the countries on this list, the transfer is based on appropriate safeguards as they have an equivalent level of data protection settings to those in the EU.

However, if the country is not on this list, the exception for the possibility of transferring personal data within the meaning of Article 49 (1) (b) of the GDPR applies, as the transfer of personal data is necessary for us to provide you with our services. In other words, we may also transfer personal data to these countries because it is necessary for us to provide the service you require from us. Please note this and if you are in any doubt about what data we have sent to a third country, please do not hesitate to contact us.

5. PERIOD OF PERSONAL DATA PROCESSING

Your personal data will only be processed for the time necessary for the individual purposes set out above.

We will process personal data for the duration of the user account in the Application or for the duration of the mutual contractual relationship. Where applicable, we may also process personal data for the necessary period in order to defend ourselves against any claims and demands you may make against us (based on our legitimate interest in protecting our own legal and property claims). After we have finished providing our services, your personal data will be stored securely, in accordance with the law, to comply with accounting and tax requirements, as well as requirements that apply to us in connection with the provision of electronic communications services. We will also keep a history of the activities that have been carried out by you in the context of your use of the Application. We also retain this data after the end of the relationship for any proceedings with government authorities.

We will keep your enquiries via the contact forms for as long as necessary to deal with the enquiry and, if they are related to the contractual relationship, for the duration of the contractual relationship.

If you are wondering whether we are still processing any personal data about you, please do not hesitate to contact us at dpo@topefekt.com.

6. YOUR RIGHTS

You have following rights:

• the right of access to personal data;
• the right to rectification;
• the right to erasure ("right to be forgotten");
• the right to restriction of data processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent;
• the right to lodge a complaint about the processing of personal data.

Description of each right is provided below.

The right of access means that you can ask us at any time to confirm whether or not the personal data concerning you are being processed and, if so, for what purposes, to what extent, to whom they are disclosed, for how long we will process them, whether you have the right to rectification, erasure, restriction of processing or to object, where we obtained the personal data and whether automated decision-making, including possible profiling, is taking place on the basis of the processing of your personal data. You also have the right to obtain a copy of your personal data.

The right to rectification means that you can ask us to correct or complete your personal data at any time if it is inaccurate or incomplete.

The right to erasure means that we must erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, (iv) we are under a legal obligation to do so, or (v) in relation to personal data for which you have given consent to the processing, you withdraw that consent.

The right to restrict processing means that until we have resolved any disputed issues regarding the processing of your personal data, we may not process your personal data other than by storing it and, where appropriate, using it only with your consent or for the establishment, exercise or defense of legal claims.

The right to object means that you can object to the processing of your personal data that we process on the grounds of legitimate interest, including profiling based on our legitimate interest. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. If you object to processing based on other grounds, we will evaluate the objection and then inform you whether we have complied with the objection and will no longer process your data, or that the objection was not justified and processing will continue. However, until the objection is resolved, the processing of personal data will be restricted.

The right to data portability means that you have the right to obtain personal data relating to you which you have provided to us on the basis of consent or contract and which is also processed by automated means, in a structured, commonly used and machine-readable format, and the right to have that personal data transmitted directly to another controller.

The right to withdraw consent to the processing of personal data means that you can withdraw your consent at any time within the meaning of Article 6 (1) (a) of the GDPR under the terms set out in Article 3 of this Privacy Policy.

If you have a comment or complaint about data protection or a question about the person responsible for data protection in our company or exercise any of your rights, please contact us at dpo@topefekt.com.

We will respond to your questions or comments as soon as possible, within one calendar month at the latest.

Our activities are also supervised by the Office for Personal Data Protection, to which you can file a complaint in case of your dissatisfaction. You can find out more on the website of the Office. At the same time, if you are dissatisfied, we ask you to contact us first, as we believe that we can solve most problems together.

7. CHANGES OF THIS PRIVACY POLICY

If we change any part of this policy in the future and it is a material change, we will keep you informed, for example by email.

ANNEX A

USING COOKIES ON OUR WEBSITE AND ON THE APPLICATION

1. What are cookies?

Cookies are small text files that the website and our Application store on your computer or mobile device when you start using the website or the Application. The website or the Application remember your preferences and the actions you take on the website or the Application (such as login information, language, font size and other display preferences) for a period of time so that you do not have to re-enter this information and jump from one page to another. They may also be used to help us analyze how you use our website or the Application or to make the website or the Application sufficiently secure.

2. Why do we use cookies?

Our website or the Application use cookies to give you the best user experience. Specifically, our cookies help us to:

• ensure that our website and the Application performs as expected;
• make our website and the Application faster and more secure;
• continually improve our website and the Application and the services associated with them. We do not use cookies for:
• collecting any sensitive data;
• any sale of information obtained from individual cookies.

Description of used cookies is provided below.

3. More information about cookies

3.1. Cookies necessary for the proper functioning of the website

We use some cookies to enable our website and the Application to function properly, for example:

• to verify whether or not you are logged into the Application;
• to ensure the functionality and security of the website and the Application;

Unfortunately, there is no way to prevent the use of these cookies other than to stop using our website or the Application.

3.2. Third-parties functionalities

Our website and the Application includes functionality provided by third parties.

All data is collected through our website and the Application using Google Analytics and tools from LinkedIn. These tools are used solely to improve existing services and for marketing purposes, but do not allow the identification of a specific user or the collection of their personal data.

Our websites and the Application use the following third party services, and you can find specific information about the cookies used (including their purpose and how long they are stored) at the following links:

Google Analytics – More information about this tool is available here. Google Analytics is one of the most commonly used tools and is used to see who visits our site and who uses our Application, to generate various statistics and to keep track of how successful our website and the Application are. The information collected may be shared with Google Ireland Limited who provides this service.

Google Tag Manager – Please see the following websites for details on this tool:

• https://marketingplatform.google.com/about/tag-manager/
• https://support.google.com/tagmanager/answer/9323295?hl=en&ref_topic=13548179
• https://support.google.com/tagmanager/topic/7158784?hl=en&ref_topic=13548179

This is a system for managing the measurement codes on our website. Only one code is placed on the website and then individual measurement codes are inserted via the web interface. The information collected may be shared with Google Ireland Limited who provides this service.

LinkedIn's Insight Tag – Details of what cookies are stored can be found on this page.

We use the information obtained from these tools for the purposes of improving the website and the Application and for basic analytics on the website and the Application. The legal basis is our legitimate interest under Article 6 (1) (f) of the GDPR to improve the services we provide.

3.3. How to reject cookies?

When you access our website or the Application, you have the option to manage cookies. It is possible to accept all cookies or choose which ones to allow or disallow. However, you cannot refuse necessary cookies as they are essential to the basic functioning of our website and also help us ensure security and compliance. Even if you have consented to the use of cookies that track your behaviour on the website and the Application, you can subsequently block their use. If you choose to block cookies, you may not be able to log in or use certain features and may lose preferences that are based on cookies. The use of cookies can be set using your internet browser and you can also refuse the use of cookies or set only certain cookies to be used in this way.

You can find information about browsers and how to set preferences for cookies on the following websites:

• Chrome
• Firefox
• Microsoft_Edge
• Safari
• Opera / Security and privacy
• Brave
• Android