Privacy notice

01Who is responsible for your data

The controller of personal data processed through this website is OCTOPUSMEMORY s.r.o., IČO 17922194, with its registered office at Na Folimance 2155/15, Vinohrady, Praha 2, 120 00 Praha, Czech Republic. In this notice we refer to the company as “Octopus Memory”, “we” or “us”.

For any question about this notice or about your personal data, write to Placeholder: [privacy contact to be designated]. Until a dedicated contact is published, you can reach us through the contact form.

Data protection officer: Placeholder: [whether a DPO is required to be assessed by counsel; details to be added if one is appointed].

02What this notice covers

This notice applies to the website at octopusmemory.com and to the communication that follows from using it, for example when you ask us for a conversation or a demo.

It does not cover the Paměť product. When a customer deploys Paměť, the records it reads are processed on that customer’s behalf and under its instructions, with the customer typically acting as controller and Octopus Memory as processor. That processing is governed by a separate data processing agreement between the customer and Octopus Memory Placeholder: [data processing agreement to be published or provided on request], not by this notice.

03What personal data we collect

Information you give us

When you use the contact form to request a conversation, we collect what you enter: your name, work email address, company, role, approximate company size, the systems your company uses, what you would like to solve, and your message. We ask only for what we need to reply and to prepare a relevant conversation.

Your name, work email address, company, company size and what you would like to solve are needed for us to reply; role, systems and message are optional. You are not obliged to provide any of this information, but without the required fields we cannot respond to your enquiry.

Information collected automatically

Like most websites, the servers that host this site keep technical logs. These may include your IP address, the date and time of your visit, the pages you requested, the referring page, and information about your browser and device. We use these logs to run the website securely and to diagnose problems. We do not use them to build profiles of individual visitors.

Cookies and local storage

The website stores two small items in your browser’s local storage: your cookie consent choice and your preferred interface language. Analytics and marketing cookies are not currently configured and would only ever be set with your consent. The cookie policy describes each item.

What we do not collect

We do not ask for special categories of personal data, such as information about health, political opinions or religious beliefs, and we ask you not to include any in your message. We do not buy personal data from third parties.

04Why we process your data and on what legal basis

Under the General Data Protection Regulation (GDPR), every use of personal data needs a legal basis. These are ours.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object to processing based on legitimate interests at any time; see Your rights.

05Who receives your data

We share personal data only with service providers who process it on our behalf under a written agreement, and only to the extent needed for the purposes above. The categories of processors we use or expect to use are:

• website hosting and content delivery — Placeholder: [provider to be confirmed];
• email and business communication tools — Placeholder: [provider to be confirmed];
• a customer relationship system, if contact form submissions are forwarded to one — Placeholder: [system to be confirmed, if any];
• analytics or marketing tools — none at present.

Placeholder: [list of processors to be completed]

We may also disclose personal data where the law requires it, for example to a court or a public authority, and to professional advisers bound by confidentiality. We do not sell personal data and we do not share it with third parties for their own marketing.

06International transfers

Our starting point is to keep personal data in the European Union. Where a service provider processes data outside the European Economic Area, we rely on a transfer mechanism recognised under Chapter V of the GDPR, such as an adequacy decision of the European Commission or the Commission’s standard contractual clauses, together with any additional safeguards that are appropriate. Placeholder: [transfer details to be confirmed once the list of processors is final]

07How long we keep your data

• Contact enquiries — kept for Placeholder: [e.g. 12 months] after our last exchange, so that we can follow up on a conversation. If the enquiry leads to a business relationship, the related records are kept for the duration of that relationship and for as long as the law requires afterwards.
• Technical logs — kept for Placeholder: [e.g. 30 days], unless a specific security incident requires longer retention.
• Consent choice and language preference — stored in your browser until you clear site data, change your choice, or the cookie policy version changes and we ask again.
• Records we must keep by law — kept for the statutory period, for example under Czech accounting and tax legislation.

When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.

08Your rights

Under the GDPR you have the following rights in relation to your personal data. They are not absolute: some apply only in particular situations, and each is subject to the conditions set out in the Regulation.

• Access — to be told whether we process your data and to receive a copy (Art. 15).
• Rectification — to have inaccurate data corrected and incomplete data completed (Art. 16).
• Erasure — to have your data deleted, for example when it is no longer needed for the purpose it was collected for (Art. 17).
• Restriction — to have processing limited while a question about accuracy or lawfulness is resolved (Art. 18).
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format (Art. 20).
• Objection — to object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Withdrawal of consent — where processing is based on consent, to withdraw it at any time. Withdrawal does not affect processing carried out before it (Art. 7(3)).
• Complaint — to lodge a complaint with a supervisory authority (Art. 77); see Supervisory authority.

To exercise any of these rights, contact us using the details in Who is responsible for your data. We respond without undue delay and within one month. Where a request is complex, that period may be extended by up to two further months, in which case we will tell you. We may need to confirm your identity before acting on a request.

09Supervisory authority

If you believe that we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work, or where the alleged infringement took place.

The supervisory authority for the Czech Republic, where we are established, is the Úřad pro ochranu osobních údajů (the Office for Personal Data Protection). It oversees compliance with the GDPR and Czech data protection law, handles complaints from individuals, and can investigate and sanction controllers and processors.

We would welcome the chance to address your concern first, but you are not required to contact us before approaching the authority.

10Children

This website is intended for businesses and the people who work in them. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of Placeholder: [15 — the age of digital consent under Czech law, to be confirmed by counsel]. If you believe a child has provided us with personal data, contact us and we will delete it.

11Automated decision-making

We do not use personal data collected through this website to make automated decisions that produce legal or similarly significant effects on you (Art. 22), and we do not profile visitors.

12How we protect your data

We apply technical and organisational measures appropriate to the risk, designed to protect personal data against unauthorised access, loss and misuse. Access to contact enquiries is limited to the people who need it to reply. No method of transmission or storage is completely secure, so we cannot promise absolute security; we can tell you how we approach it. Our security page sets out the principles that guide the product as well as this website.

13Changes to this notice

We may update this notice when our website, our services or the law change. The date of the current version is shown at the top of the page. Where a change materially affects how we use your personal data, we will draw attention to it on the website and, where appropriate, contact the people whose data is affected.

14Contact

Questions, requests and complaints about personal data can be sent to Placeholder: [privacy contact to be designated] or through the contact form. By post: