AQUNAMA Privacy Policy — GDPR-Compliant Data Practices

This Privacy Policy describes how EndorphinIT a.s. (operating under the AQUNAMA brand) collects, uses, stores, shares, and protects personal data when you visit aqunama.com, use our services, or otherwise interact with us.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), Czech Act No. 110/2019 Coll. on the Processing of Personal Data, and any other applicable law.

1. Who we are (Data Controller)

The data controller for personal data processed in connection with this website and our services is:

EndorphinIT a.s.
IČO: 21906998
Registered office: Švábova 772/18, Hlubočepy, 152 00 Prague, Czech Republic
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 28977
Represented by: Daniel Čečetka, Member of the Board of Directors

“AQUNAMA” is the trading name under which EndorphinIT a.s. delivers its services. References in this Privacy Policy to “we”, “us”, “our”, or “AQUNAMA” refer to EndorphinIT a.s.

2. Data protection contact

For all data protection matters — including requests to exercise your rights — contact us at:

Email: start@aqunama.com
Postal address: Švábova 772/18, Hlubočepy, 152 00 Prague, Czech Republic

We respond to all data protection requests without undue delay and in any case within one month of receiving them, as required by Article 12(3) GDPR. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months. In that case we will inform you of the extension and the reasons for the delay within one month of receiving your request.

3. Definitions

For the purposes of this Privacy Policy:

• “Personal data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• “Controller” means the entity that determines the purposes and means of processing personal data.
• “Processor” means a third party that processes personal data on behalf of the Controller.
• “Data subject” means the natural person whose personal data is being processed.

4. Personal data we collect

We collect the following categories of personal data:

a) Identification and contact data

• First name and surname
• Job title or role (where provided)
• Company or organization name
• Business email address
• Telephone number (where provided)
• Postal or business address (where provided)

b) Communication data

• The content of any messages you send us via contact forms, email, scheduling tools, or phone
• Records of correspondence and, where applicable and lawful, call recordings or transcripts (including calls with our AI voice assistant)
• Metadata about your communications (timestamps, channels used)

c) Booking and scheduling data

• Date and time of any scheduled calls or meetings
• Topic of interest (optional; for example filled in by our savings calculator) and the page from which you submitted the form
• Conferencing platform details

d) Technical and usage data

• IP address
• Browser type, version, and language preferences
• Operating system and device type
• Pages visited, time spent on pages, and click paths
• Referring website and exit pages
• Campaign parameters of your visit (UTM parameters and the Meta ad click identifier “fbclid”) and the landing page, stored together with a booking request
• Date and time of access
• Approximate geographic location (derived from IP)

e) Marketing data (only where you have consented, or are an existing customer receiving marketing about similar products — see “Direct marketing”)

• Subscription preferences
• Engagement with marketing communications (opens, clicks)
• Source and campaign attribution

We do not knowingly collect special categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). If you provide such data voluntarily through correspondence, we will only process it as strictly necessary to respond to your request.

Booking and contact forms. When you submit the “Book a free call” form, we store your name, email address, phone number, the optional topic, the page from which you sent it, and the campaign parameters of your visit in our own database. Our virtual assistant “Hannah” then sends you a welcome email (through Resend) with a link to book a time on Calendly. Shortly after you submit the form, an AI voice assistant (provided by Vapi) may call the phone number you entered to arrange that time, at most once per phone number per day; Vapi receives your name, email address, phone number and the language of the page. The contact form sends your message by email (through Resend) to our inbox start@aqunama.com; it is not stored in that database.

5. How we collect personal data

We collect personal data through the following channels:

• Directly from you — when you submit a form, send us an email, book a call, speak with our AI voice assistant, or otherwise communicate with us
• Automatically — when you visit our website, via cookies and similar technologies
• From third parties — including business directories, LinkedIn, and publicly available business information used solely for B2B outreach to professional contacts at companies that match our target client profile
• From your employer — if you are introduced to us as a representative of an organization that is a client, supplier, or partner

Where personal data is collected from third parties, we ensure that the source had a lawful basis to share it and provide notice in accordance with Article 14 GDPR.

6. Why we process personal data — purposes and legal bases

We process personal data only when at least one of the legal bases under Article 6 GDPR applies. The table below sets out our processing purposes and the corresponding legal bases:

Where processing is based on legitimate interest, we have conducted a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. You may object to such processing at any time (see Section 15).

7. How long we keep personal data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:

After the applicable retention period expires, personal data is securely deleted or fully anonymized.

8. Who we share personal data with

We do not sell, rent, or trade personal data. We share personal data only with the following categories of recipients:

a) Processors (acting on our behalf):

• Calendly Inc. (USA) — scheduling of calls booked through the link in our welcome email
• Resend — email delivery: the welcome email sent after you submit the booking form, internal notifications of form submissions to our inbox, and the emails of the AI Concierge (when it is available)
• Vapi — the AI voice assistant that may call the phone number you enter in the booking form (it receives your name, email address, phone number and language)
• Email service providers (e.g., Microsoft, Google Workspace) — email infrastructure
• PostHog (EU-hosted) — website analytics, only with your consent to analytics cookies
• CRM and customer support platforms — managing client and prospect relationships
• Hosting and infrastructure providers — including an affiliated ISO 27001- and ISO 9001-certified data center in the Czech Republic
• AI model and abuse-protection providers (only when the AI Concierge is available) — OpenAI (by default; the provider may change) generates its replies, and Cloudflare (Turnstile) checks that a visitor is a person and not an automated program
• Legal, accounting, audit, and IT service providers — under data processing or confidentiality agreements

b) Analytics and advertising platforms:

• Google Ireland Limited (Google Analytics, Google Tag Manager) — website analytics with your consent, counting of submitted forms, and the cookieless Consent Mode pings described in “Cookies and tracking technologies”
• Advertising platforms — Google Ireland Limited (Google Ads), Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company — conversion measurement and remarketing, only with your consent

Depending on the service and its settings, Google, Meta and LinkedIn act as our processors or as independent or joint controllers. Where they act as controllers, their own privacy policies apply.

c) Other recipients:

• Affiliates and group companies — where strictly necessary for service delivery
• Public authorities, regulators, and courts — where required by law
• Acquirers or successors — in the event of a merger, acquisition, or sale of business assets (subject to the same protections as set out in this Privacy Policy)

All processors operate under written data processing agreements that comply with Article 28 GDPR. A current list of our material processors is available on request from start@aqunama.com.

9. International data transfers

Some of our processors and other recipients are based outside the European Economic Area (“EEA”) or may process personal data there — for example, Calendly, Resend and Vapi and, when the AI Concierge is available, OpenAI and Cloudflare may process personal data in the United States, and the Google, Meta and LinkedIn services may involve transfers to the United States. When personal data is transferred outside the EEA, we ensure that one of the following safeguards is in place, as required by Chapter V GDPR:

• The European Commission has issued an adequacy decision for the destination country
• We rely on the European Commission's Standard Contractual Clauses (SCCs) with the recipient
• The recipient is certified under an applicable transatlantic data privacy framework
• Another lawful safeguard recognized under GDPR is in place

A copy of the relevant transfer safeguards is available on request from start@aqunama.com.

10. Cookies and tracking technologies

This website uses cookies and similar technologies. Cookies are small text files placed on your device to enable the website to function, measure performance, and (where you consent) personalize content and advertising.

We use three categories of cookies:

a) Necessary cookies

Required for the website to function. These cookies do not require consent and cannot be disabled.

Examples: session management, cookie consent record, security tokens, load balancing.

b) Analytics cookies

Help us understand how visitors interact with our website. Set only with your prior consent.

Examples: Google Analytics, PostHog (EU-hosted; loaded only after you consent), or equivalent measurement tools.

c) Marketing cookies

Used by us and our advertising partners (Google, Meta, LinkedIn) to measure conversions from our ads — for example, that a form was submitted after an ad click — and to show you relevant ads on their platforms (remarketing). Set only with your prior consent.

Examples: Google Ads conversion tracking and remarketing, Meta Pixel, LinkedIn Insight Tag.

Google Tag Manager and Consent Mode

Google Tag Manager loads on every visit so that it can apply your choice. We use Google Consent Mode v2 in its “advanced” mode: until you consent, all consent signals (analytics storage, ad storage, ad user data and ad personalization) are set to “denied”. In that state Google tags neither store nor read cookies and send only cookieless pings: they use no cookie or other identifier stored on your device but, as with any web request, they include technical data such as your IP address, the address of the page and basic browser information. These pings are sent before you make a choice, and Google may use them for aggregated modelling of statistics and conversions. Meta and LinkedIn tags do not run without your marketing consent, and PostHog does not load without your analytics consent. When you change your choice, the signals are updated immediately. Without JavaScript none of these tools loads.

Measurement of form submissions

When you successfully submit the booking or contact form, our server sends Google Analytics a single event recording that a form was submitted, the page it was on, the campaign parameters in the page address (utm_source, utm_medium, utm_campaign, utm_content) and which ad platform you came from (Google Ads, Meta, LinkedIn or none). The event contains no name, email, phone number, IP address or ad click identifier, and nothing is stored on your device. If you have consented to analytics cookies, the event reuses the Google Analytics identifier already stored in your browser, so it is linked to your other analytics data and is therefore pseudonymous, not anonymous; otherwise a random one-off identifier is used, which cannot be linked to your other visits. Legal basis: our legitimate interest in knowing how many enquiries the website and our campaigns generate (Art. 6(1)(f) GDPR); where the event is linked to your analytics data, the consent you gave to analytics cookies (Art. 6(1)(a) GDPR).

Enhanced conversions

Only if you have consented to marketing cookies: when you submit the booking or contact form, the email address and phone number you entered (and, where available, your first name, last name and country) are passed to the advertising tags on the page (Google Ads and, where we use their equivalent features, Meta and LinkedIn), which hash them (SHA-256) in your browser before sending them to the respective platform. The platforms use them only to match the conversion with an ad interaction by the same user and do not receive them in readable form. Without marketing consent, none of these data reach an advertising platform. Legal basis: your consent (Art. 6(1)(a) GDPR).

You can review and manage your cookie preferences at any time via the cookie banner shown on your first visit or via the “Cookie Settings” link in the footer of every page. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. Direct marketing

We send electronic direct marketing communications relating to our services only in the following cases:

• With your consent — to people who have consented to receive them
• To existing customers — to an email address we obtained from a customer in connection with the sale of our product or service, and only about similar products or services of ours, on the basis of our legitimate interest, provided that the customer was given a clear and simple opportunity to refuse such use, free of charge, when the address was collected and in every communication

If you have only sent us an inquiry or booked a call, you are in neither group, and we do not send you direct marketing unless you consent to it.

Every direct marketing communication includes an unsubscribe link. You may withdraw your consent or object at any time by clicking unsubscribe or contacting start@aqunama.com.

We send direct marketing in line with Czech Act No. 480/2004 Coll. on certain information society services and applicable EU law on electronic communications.

12. Profiling and automated decision-making

We do not engage in automated individual decision-making, including profiling, that produces legal or similarly significant effects on you as defined in Article 22 GDPR.

We may use aggregated, anonymized analytics to improve our website and services. This processing does not involve personal data.

13. Data security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, accidental loss, or destruction. These measures include, where appropriate:

• Encryption of data in transit (TLS) and, where applicable, at rest
• Access controls based on the principle of least privilege
• Multi-factor authentication for administrative access
• Regular security testing and vulnerability management
• Staff training on data protection obligations
• Confidentiality agreements with all employees and processors
• Hosting in ISO 27001- and ISO 9001-certified data center infrastructure
• Audit logging and monitoring of access to personal data

Despite our reasonable efforts, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

14. Data breach response

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will:

• Notify the Czech Data Protection Authority (Úřad pro ochranu osobních údajů) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR
• Notify affected data subjects without undue delay, where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 GDPR
• Document the breach, its effects, and remedial actions taken in our internal breach register

15. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) — request confirmation of whether we process your data and obtain a copy
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your data, subject to applicable legal exceptions
• Right to restriction of processing (Art. 18) — request that we limit how we process your data
• Right to data portability (Art. 20) — request a copy of your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest or direct marketing
• Right to withdraw consent (Art. 7(3)) — withdraw any consent previously given, at any time, without affecting the lawfulness of processing before withdrawal
• Right not to be subject to automated decisions (Art. 22) — (see Section 12 — we do not engage in such processing)

16. How to exercise your rights

To exercise any of your rights, contact us at start@aqunama.com. We may need to verify your identity before responding to your request, in order to protect your data from unauthorized disclosure.

We will respond without undue delay and in any case within one month of receiving a verifiable request. Where necessary, this period may be extended by two further months, in which case you will be informed of the reason for the delay.

Exercising your rights is free of charge, except in cases where requests are manifestly unfounded or excessive (in which case we may charge a reasonable administrative fee or refuse the request, as permitted under Article 12(5) GDPR).

17. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority — particularly in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

The relevant authority in the Czech Republic is:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Website: www.uoou.cz

18. Children's privacy

This website and our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, contact us at start@aqunama.com and we will take appropriate steps to delete it.

19. Visitors from outside the EU/EEA

This Privacy Policy is drafted in accordance with EU law. Where you access this website from outside the EU/EEA, please be aware that personal data may be transferred to and processed in the European Economic Area, where data protection laws may differ from those in your jurisdiction. Where we transfer personal data outside the EEA, we rely on the safeguards described in “International data transfers”, and a copy is available on request from start@aqunama.com.

20. Aggregated and anonymized data

We may aggregate or anonymize personal data so that it can no longer be associated with an identifiable individual. Such aggregated or anonymized data is not subject to this Privacy Policy and may be used or shared without restriction.

21. AI Concierge chat (Nama)

Our website includes an AI chat widget (“Nama”), an AI agent built by AQUNAMA that runs a short pre-assessment conversation. This section applies only while the assistant is available on the website. When you use it, we process: your name and email address (only if you choose to share them in the chat), the content of your conversation, the page from which the chat was started, timestamps, and pseudonymous technical identifiers — a hashed IP address used for abuse prevention and, only if you enabled analytics cookies in the cookie banner, a random widget identifier used for server-side measurement of widget usage (if you withdraw consent we remove it from your device and from our records). We also keep technical widget preferences on your device (for example that you closed it) and a reference to your ongoing conversation.

Purpose and legal basis. We use this data to prepare and send the written AI assessment you request in the chat (processing at the request of the data subject, Art. 6(1)(b) GDPR) and for possible follow-up contact by our sales team (legitimate interest, Art. 6(1)(f) GDPR). Marketing communications are sent only with your separate, freely given consent (Art. 6(1)(a) GDPR), where such an option is offered.

Retention. The conversation, the extracted lead record, and your contact details are kept for 90 days and then automatically deleted — or earlier once the record has been transferred to our customer relationship system.

Recipients. The AQUNAMA (EndorphinIT a.s.) sales team; and, as processors: Resend (email delivery, including the internal email asking our sales team to approve an assessment before it is sent to you), our hosting and database providers, PostHog (EU-hosted analytics, only with your consent to analytics cookies), Cloudflare (Turnstile, which checks that a visitor is a person and not an automated program and, for that purpose, processes technical data such as your IP address and browser information), and the AI model provider that processes the conversation text to generate replies (OpenAI by default). Transfers outside the EU/EEA are covered by Standard Contractual Clauses where applicable.

You can exercise all rights described in “Your rights under GDPR” for this data at start@aqunama.com.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Last updated” date at the top of this Privacy Policy reflects the most recent revision.

We publish the updated version on this page with a new “Last updated” date, and we inform you of material changes by a prominent notice on the website.

23. Recruitment and candidate data

When you contact us about a role — including via careers@aqunama.com — we process the personal data you send us: your name, contact details, CV or portfolio, work history, and anything else you choose to include.

Purpose and legal basis. We process this data to assess your suitability for a role and to communicate with you about it. The legal basis is our legitimate interest in recruiting staff (Article 6(1)(f) GDPR) and, where you apply for a specific position, steps taken at your request prior to entering a contract (Article 6(1)(b) GDPR).

Retention. We keep candidate data for the duration of the recruitment process and for 180 days afterwards, so we can reconsider you if a suitable role opens. We retain it longer only with your explicit consent, which you may withdraw at any time.

Your rights. The access, rectification, erasure, restriction, portability and objection rights described elsewhere in this Privacy Policy apply in full to candidate data. To exercise them, write to us at the contact address below.

24. Contact

For any questions about this Privacy Policy, our data processing practices, or your personal data, contact us at:

Email: start@aqunama.com
Postal address: EndorphinIT a.s., Švábova 772/18, Hlubočepy, 152 00 Prague, Czech Republic