Privacy policy

Who processes the data

The controller of personal data is inbs s.r.o., with its registered office at třída Tomáše Bati 299, Louky, 763 02 Zlín, Czech Republic, company ID 23447923, registered in the Commercial Register kept by the Regional Court in Brno, file C 145989 (the “Provider”, “we” or “us”). This document describes how we process the personal data of this website's visitors and of the customers of the inmake SaaS/PaaS platform, in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data. In matters of personal data you can reach us at inmake@insightbase.cz.

1. This website

Contact form

When you write to us through the form, we process your full name, work e-mail, where given your phone number and the name of your company or website, and the text of your message. The purpose is to reply to you and arrange a demo if you want one; the legal basis is steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in communicating with people who ask us something (Art. 6(1)(f)). We keep the data for 12 months from the last communication; if we start working together, for as long as the cooperation lasts and then as set out in section 2.

News by e-mail

The e-mail address you leave with us for news is used only to send it, at most once a month. The legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time through the link in every message or by e-mail to the address above. After you unsubscribe, we delete the address.

Visiting the website

A visit creates technical records (IP address, time, requested page, browser type) for the security and operation of the website; we keep them for at most 30 days on the basis of legitimate interest. Without your consent the website stores only the necessary cookie with your choice in the cookie bar in your browser.

Measuring visits

If you allow analytics cookies in the cookie bar, we use two tools. Google Analytics 4 (Google Ireland Limited) tells us how many people visit the website, where they come from and which pages they read. Microsoft Clarity (Microsoft Ireland Operations Limited) shows how you move around the pages: clicks, scrolling and recordings of visits, from which we see what on the website is unclear. Clarity does not record the text you type into forms.

In doing so we process device and browser identifiers from cookies, a shortened IP address, an approximate location derived from it, the pages visited and the interactions with them. The legal basis is your consent (Art. 6(1)(a) GDPR); without it neither tool is loaded. You can change or withdraw your consent at any time through the Cookies link in the website’s footer.

We keep data in Google Analytics for 14 months, visit recordings in Clarity for 30 days and the summaries made from them for at most 13 months. Google and Microsoft may transfer data to the USA; both companies are certified under the EU-US Data Privacy Framework.

2. The inmake platform: when we act as the controller

We act as the controller of the personal data of our customers (self-employed individuals) and of the representatives or team members of our customers (legal entities).

The data we process

• Identification and contact data: first name, surname, e-mail address, phone number, job title, photo/avatar.
• Billing and transaction data: company name, company ID, VAT ID, registered address, payment history, account number, subscription details.
• Data on the use of the Service: login logs, admin operation logs (which user accounts made which changes to the settings), the history of prompts in AI sessions and the use of Credits.

Purpose and legal basis of processing

1. Performance of a contract (Art. 6(1)(b) GDPR): account registration, providing the platform's features, customer support, subscription management.
2. Compliance with legal obligations (Art. 6(1)(c) GDPR): bookkeeping, tax obligations, handling complaints.
3. Legitimate interest (Art. 6(1)(f) GDPR): the security and stability of the inmake platform, fraud prevention, protecting the Provider's legal claims, sending news and operational information to existing customers.

Retention

• Data for the performance of the contract: for the duration of the contract and then 3 years after it ends, to protect legal claims.
• Accounting and tax documents: for 10 years following the year in which the supply took place.
• Admin operation logs: for at most 180 days from their creation.

3. The inmake platform: when we act as the processor (DPA)

When customers use the Service to run their Shops, we process all personal data of the shoppers, visitors and users of those Shops (e.g. e-shop customers, contact forms, orders) solely as a processor. The controller of that personal data is the customer. The relationship between the Provider (as processor) and the customer (as controller) is governed by a separate data processing agreement (DPA), which forms part of the Terms of Use. The customer is fully responsible for having a valid legal basis for collecting data in their Shop and for having informed their end users.

Did you buy in a Shop that runs on inmake? If you wish to exercise your rights (e.g. to have your e-mail deleted from the e-shop's customer database), contact the operator of that Shop (our customer) directly — they are the controller of your data.

4. Cookies and tracking technologies in the admin

1. To run the Service's admin we use strictly necessary (technical) cookies and local storage (LocalStorage) solely for authentication, keeping the user signed in and remembering user preferences. These technologies do not require consent.
2. To analyse traffic and improve the admin's user interface we may use analytics tools. Users are informed about their use, and can set their consent, through a cookie bar on their first visit to the admin.

5. Recipients of personal data (sub-processors) and transfers to third countries

1. To run the Service reliably and securely we use vetted sub-processors, in particular providers of cloud infrastructure, database hosting, payment processing and artificial intelligence features.
2. Storage in the EU: All primary data of the Service and the Customer Content are stored and processed on servers located in the European Union (EU).
3. Processing by artificial intelligence (AI): Data sent to the AI modules through their APIs are processed solely to generate a response and are not used by the providers of those AI models to train their public models (in line with the API providers' terms).
4. Transfers to third countries: Where, exceptionally (e.g. when specific external APIs or payment gateways are used), data are transferred to countries outside the European Economic Area, this happens only in accordance with applicable law, as a rule on the basis of a European Commission adequacy decision (e.g. the Data Privacy Framework) or of standard contractual clauses (SCC).

6. Data security and encryption

The Provider applies appropriate technical and organisational measures to keep data secure:

• The customer's sensitive configuration data (e.g. API keys, SMTP passwords, secured variables) are stored in a separate database and protected by strong encryption.
• User passwords and sensitive access tokens are hashed with modern, proven cryptographic functions.
• All communication with the platform runs over the encrypted HTTPS protocol (TLS 1.3).

7. Your rights

As a data subject you have the following rights under the GDPR:

• the right of access to personal data (Art. 15 GDPR),
• the right to rectification of inaccurate or incomplete data (Art. 16 GDPR),
• the right to erasure (“the right to be forgotten”) (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing based on legitimate interest (Art. 21 GDPR),
• the right to lodge a complaint with the supervisory authority (the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).

To exercise your rights, contact us at inmake@insightbase.cz.

8. Changes to this policy

We may update this policy when the way we process data or the law changes. The current version is always on this page, with the date of the last change at the top.