Privacy Policy

1. Who we are

This Privacy Policy explains how Appspire d.o.o. za usluge (hereinafter, "Appspire d.o.o.", "us" or "we") collects, uses, shares, and otherwise processes personal data in connection with the website https://appspire.tech and any related communications (collectively, the "Services").

The website presents Appspire d.o.o. and links to our products, and you can register interest in upcoming products by email. It does not offer user accounts or payments. Our products (for example TrueToValues) are separate services with their own privacy policies.

The controller of your personal data is:

For the purposes of this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person.

2. How to read this Privacy Policy

We process personal data in accordance with applicable data protection law, including Regulation (EU) 2016/679 - the General Data Protection Regulation ("GDPR").

The categories of personal data we process depend on how you interact with us. We only process personal data where we have a valid legal basis to do so, such as:

• to take steps at your request before entering into a contract or to perform a contract with you;
• to comply with legal obligations;
• for our legitimate interests, where those interests are not overridden by your rights and freedoms; or
• with your consent, where consent is required.

3. What personal data we collect

Depending on how you use our Services, we may collect the following categories of personal data:

3.1 Information you provide directly

We may collect:

• your name and email address, when you register interest in one of our products by email (for example the Coaching Toolkit);
• your name and the content of messages or enquiries you send to us by email.

3.2 Website usage and device information

When you visit our website, we may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• referring URL;
• pages viewed;
• approximate geolocation derived from IP;
• interactions with the website;
• cookie identifiers and similar online identifiers.

3.3 Marketing and communications information

We may collect:

• your email subscription status, including the products you registered interest in;
• communication preferences;
• records of whether emails were delivered, opened, or clicked, where such tracking is used lawfully.

4. How we use your personal data

4.1 To respond to enquiries

If you contact us, we use your personal data to communicate with you and respond to your request.

Categories of data

name, email address, message content, related correspondence.

Legal basis

pre-contractual steps at your request and/or our legitimate interest in handling enquiries.

Retention

for as long as necessary to handle the request and for a reasonable period afterwards to manage follow-up, record-keeping, and legal claims.

4.2 To send you information about products you registered interest in

If you register interest in one of our products (for example by emailing us through the "Register interest" link for the Coaching Toolkit), we use your name and email address to send you information about that product, such as launch news, early access and related updates.

Categories of data

name, email address, the products you registered interest in, subscription status, communication preferences, email engagement data where lawfully used.

Legal basis

your consent, which you give when you register interest and ask us to keep you informed.

Retention

until you unsubscribe or withdraw your consent, and for a limited period afterwards where necessary to maintain suppression lists and compliance records.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us.

4.3 To operate and secure the website

We use personal data to host the website, deliver it quickly and securely, and protect it against abuse, bots and attacks.

Categories of data

IP address, browser and device information, requested pages and request metadata.

Legal basis

our legitimate interests in operating, securing and maintaining the website.

Retention

server and security logs are kept only for a limited period of up to 30 days unless needed to investigate abuse.

4.4 To analyse website use and improve performance

We use analytics to understand how visitors use the website, improve usability, measure performance, and troubleshoot issues.

Categories of data

IP address, device and browser information, visited pages, approximate geolocation, session and interaction data, cookie identifiers.

Legal basis

our legitimate interests in improving the website (see section 6.3).

Retention

in accordance with our Cookies Policy or the relevant tool settings.

4.5 To comply with law and protect our rights

We may process personal data to comply with applicable law, enforce our terms, establish or defend legal claims, prevent misuse, and protect the security of the website and our business.

Categories of data

any data relevant to the issue.

Legal basis

legal obligations and our legitimate interests in compliance, security, and legal protection.

Retention

for as long as required by law or reasonably necessary for the relevant purpose.

5. Cookies and similar technologies

We use cookies and similar technologies to operate the website and measure traffic. We do not use advertising or marketing cookies on this website.

Some cookies are strictly necessary for the website to function and stay secure. Our self-hosted analytics is used on the basis of our legitimate interests, as described in section 6.3.

For more information about the cookies we use, how long they remain on your device, and how to manage your choices, please see our Cookies Policy.

6. Third-party tools and services

6.1 Netlify

We use Netlify, Inc. ("Netlify") to host the website. Netlify may process technical data such as IP addresses, request metadata and server logs.

Netlify is based in the United States. Where this involves a transfer of personal data outside the European Economic Area, we rely on the safeguards described in Section 8. Further information is available in Netlify's privacy policy.

6.2 Brevo

We use Brevo to manage subscriber lists, newsletters, service emails and related communications for people who have registered interest in our products.

Depending on how you interact with us, Brevo may process data such as your email address, subscription status, communication preferences, and email engagement information.

Brevo acts on our behalf for these communication services and processes personal data in accordance with our instructions and applicable agreements. Marketing emails and any related tracking are used with consent where required by law. Further information about how Brevo processes personal data is available in Brevo's privacy policy at https://www.brevo.com/legal/privacypolicy/.

6.3 Umami

We use Umami, self-hosted on our own infrastructure, an open-source analytics platform, to understand how visitors use our website and to measure traffic and performance. Your data is not sent to or processed by any third-party analytics provider, and we do not share it with any external party.

Umami may collect information such as visited pages, referrer URLs, browser and device type, operating system, approximate country derived from IP address, and session interaction data. Umami uses a session identifier to associate page views within a single session, which helps us understand how the website is used and improve it. Because all analytics data stays on our own servers, is never shared with any third party, and is used solely to operate and improve the Services, we rely on our legitimate interests as the legal basis and do not require separate consent for it.

6.4 Cloudflare

We use Cloudflare, Inc. ("Cloudflare") for DNS management, reverse proxy, content delivery network (CDN), and distributed denial-of-service (DDoS) protection. Traffic to our website passes through Cloudflare's network before reaching our hosting provider.

In the course of providing these services, Cloudflare may process technical data such as IP addresses, HTTP request and response headers, browser and device information, requested URLs, and security-related metadata. Cloudflare may also set strictly necessary cookies for security purposes (such as bot detection and challenge pages).

Cloudflare is based in the United States. Where this involves a transfer of personal data outside the European Economic Area, we rely on the safeguards described in Section 8. Further information about how Cloudflare processes personal data is available in Cloudflare's privacy policy.

7. Who we share personal data with

We may share personal data with the following categories of recipients, where relevant:

• hosting and infrastructure providers;
• analytics and performance providers;
• email and communications providers;
• legal, accounting, audit, and professional advisers;
• courts, regulators, law enforcement, and public authorities where required by law or necessary to protect our rights.

We do not sell your personal data.

8. International data transfers

Some of our service providers or their sub-processors may process personal data outside the European Economic Area. In particular, our hosting provider (Netlify) and Cloudflare are based in the United States (see Sections 6.1 and 6.4).

Where personal data is transferred to a country that does not benefit from an adequacy decision by the European Commission (including to a United States provider that is not certified under the EU-US Data Privacy Framework), we rely on an appropriate safeguard recognised under applicable law, such as:

• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules; or
• another lawful transfer mechanism available under the GDPR.

You can contact us for more information about the safeguards we use.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and defend legal claims.

• contact enquiries are kept for as long as needed to handle the enquiry and related follow-up;
• marketing and communications data is kept until you unsubscribe or withdraw consent, plus a limited period to maintain suppression records;
• server and security logs are kept for a limited period, as described in section 4.3;
• cookie-related and analytics data is retained according to our Cookies Policy and the configuration of the relevant tools.

10. Automated decision-making and profiling

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR, and we do not build individual profiles of website visitors.

11. Your rights

Subject to applicable law, you have the following rights in relation to your personal data:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to lodge a complaint with a competent supervisory authority, such as the Croatian Personal Data Protection Agency (AZOP, https://azop.hr) or the authority in the EU country where you live or work.

To exercise your rights, please contact us at contact@appspire.tech. We may ask for information necessary to verify your identity before processing your request.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures may include access controls, encryption in transit, secure hosting, and administrative safeguards. However, no method of transmission over the internet or method of storage is completely secure.

13. Third-party links and services

Our website contains links to third-party websites and services, including our products. We do not control those third parties and are not responsible for their privacy practices. Their use of your personal data is governed by their own terms and privacy policies.

14. Children

Our Services are not directed to children under the age of 16, and we do not knowingly collect personal data from children under 16 without appropriate authorisation where required by law. If you believe that a child has provided us with personal data in breach of this policy, please contact us so that we can take appropriate steps.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements, or operational practices. The updated version will be posted on this page with a revised "Last modified" date.

16. Contact

If you have questions about this Privacy Policy or our processing of personal data, or if you want to exercise your rights, you can contact us at: