Contact+ Privacy Policy

This English version is a translation; the Slovak version is binding.

Article 1 — Who we are and how to reach us

1.1 The Contact+ service is operated by RESINOS & GO UP SYSTEMS INC., 228 Park Ave S #86399, New York, NY 10003, USA, EIN 981914999, NYBE ID 265604920 (hereinafter "we"). It comprises the web application at https://app.plus.contact (hereinafter the "service"), the website https://plus.contact and the address https://link.plus.contact, through which the links in emails sent from the service lead. For the personal data described in Articles 3 to 8 and 12, we are the controller under Regulation (EU) 2016/⁠679 (the General Data Protection Regulation, hereinafter "GDPR"). For the data that companies upload to the service or obtain in it, we are their processor (Articles 9 and 10).

1.2 For all matters concerning the protection of personal data, write to us at quick@plus.contact, call +421 910 468 787 or send a letter to the address of our registered office. You can write to us in Slovak, Czech or English.

1.3 Our representative in the European Union under Article 27 GDPR is ERIOS, s.r.o., IČO 29789770, Rybná 716/⁠24, Staré Město, 110 00 Praha 1, Czech Republic. In matters of the processing of personal data you may contact the representative instead of us or alongside us; correspondence for the representative may also be sent to quick@plus.contact. ERIOS, s.r.o. is also our legal representative under Article 13 of Regulation (EU) 2022/⁠2065 (the Digital Services Act).

1.4 We have not designated a data protection officer (DPO), because Article 37 GDPR does not require us to: we are not a public authority, we do not process special categories of personal data or data relating to criminal offences on a large scale, and our core activity does not consist of large-scale regular and systematic monitoring of individuals. We launched the service recently and the scope of processing is still small; when it changes substantially, we will repeat the assessment. We handle questions and requests concerning data protection directly through the contact details in Article 1.2.

Article 2 — What this policy covers

2.1 This policy informs you, in accordance with Articles 13 and 14 GDPR, about the personal data whose purposes and means of processing we determine. It concerns:

• visitors to the website plus.contact (Article 3);
• people interested in registering (Article 4);
• users of the service and company owners, including those who were invited to a company by someone else (Article 5);
• the security and operation of the service (Article 6);
• orders, payments and invoicing, and customers' contact persons (Article 7);
• people who write to us or call us, for example with a question, an enquiry about the Enterprise plan or a request (Article 8);
• cookies and content that your browser loads in the application from other servers (Article 12).

2.2 It is different for the data that a company using the service (hereinafter the "company") uploads to the service or obtains in it: contacts and the recipients of its emails, their replies, contacts from its advertising forms, and the people in photos, recordings and videos. The company decides about this data as the controller, and we process it only on its behalf as the processor (Article 9). If you have received an email that a company sent through Contact+, see Article 10.

2.3 Related documents:

• the terms and conditions, including the Data Processing Agreement (Annex 2): https://plus.contact/en/podmienky; the same text is also at https://app.plus.contact/podmienky;
• the list of processors: https://plus.contact/en/spracovatelia;
• cookies and browser storage: https://plus.contact/en/cookies.

2.4 For each purpose we state what data we process, on which legal basis under Article 6⁠(1) GDPR, and for how long we keep it. The legal bases are as follows:

• contract (point (b)) — we need the data to conclude or perform a contract to which you are a party, or to take steps prior to its conclusion at your request;
• legal obligation (point (c)) — the processing is required of us by Union or Member State law, for example VAT law, consumer protection law or the GDPR itself;
• legitimate interest (point (f)) — the processing is necessary for our legitimate interest or for the interest of a third party, for example the security of the service or the conclusion and performance of a contract with the legal person on whose behalf you act, and your rights do not override that interest; you may object to such processing (Article 17.1a);
• consent (point (a)) — nothing described in this policy is currently based on consent. If we were to ask you for consent in the future, you could withdraw it at any time; the lawfulness of processing before withdrawal would not be affected.

Article 3 — Visitors to the website plus.contact

3.1 The website plus.contact does not use cookies or browser storage and does not run any scripts in your browser; it only tells the browser to return to it exclusively over an encrypted connection (HSTS), which the browser remembers for one year. It loads fonts and images only from our server. It has no analytics or traffic measurement, no third-party advertising or tracking pixels (for example Google Analytics or Meta Pixel), and it does not embed content from other services, for example YouTube videos.

3.2 On every visit your browser passes your IP address and the technical details of the request to our server, for example the page address, the preferred language and the browser type.

Purpose: to deliver the page to you in the right language and to protect the server against abuse.

Legal basis: legitimate interest in the operation and security of the website (point (f)).

How long: we do not write visits to the database or to an access log, and we do not produce statistics or profiles from them. An IP address may end up in the server's technical records (logs), for example in the event of an error; these records are stored to a limited extent and are continuously overwritten by newer records (Article 6.6).

3.3 If you send an enquiry about the Enterprise plan through the form in the price list, Article 8 applies. The registration buttons on the website redirect you to the service, where Article 4 applies.

Article 4 — Registration

4.1 Any person who is at least 18 years old and has full legal capacity may register. Registration takes place in the service at https://app.plus.contact/registracia. Registration creates your account and a company on the free Start plan. During registration we draw your attention to this policy by a link; we do not ask you to agree to it.

4.2 What data:

• your email address and your name;
• the name of the company or of the natural person on whose behalf you are registering;
• the paid plan and period, if you chose them during registration (this is possible only when paid plans are being sold);
• your agreement to the terms and conditions, including the data processing agreement, by which you also confirm that you are at least 18 years old, together with the version and hash (SHA-⁠256) of the text of the terms;
• the hash of the one-⁠time link for completing registration; we do not hold the link itself in the database;
• to limit the number of registrations, also your IP address and email address (Article 6.1).

Purpose: to verify that the email address belongs to you, to conclude the contract for the free plan, to set up the account and the company, and to be able to prove which wording of the terms you agreed to.

Legal basis: if you conclude the contract on your own behalf (for example as a consumer or a sole trader), steps prior to concluding the contract at your request and its conclusion (point (b)); if you register on behalf of a legal person, our legitimate interest in concluding and performing the contract with it (point (f)); for the record of agreement to the terms, our legitimate interest in proving the conclusion and content of the contract (point (f)).

How long: the link for completing registration, which we send you by email, is valid for 24 hours. A registration that you do not complete is deleted automatically after 7 days. We keep a completed registration for the duration of the contract and, after the company is cancelled, we retain it as evidence of the conclusion of the contract and of agreement to the terms until the limitation periods expire, at most 4 years from the end of the contract; if a dispute or proceedings are under way at that time, until they end.

4.3 If you set up another company under your account, we store its name and record in the activity log (Article 6.2) your agreement to the terms and conditions (with confirmation that you are at least 18 years old), together with their version and hash. We keep this record for as long as the registration record (Article 4.2).

4.4 We send the email with the link for completing registration through our system mail (Article 13).

Article 5 — Users and company owners

5.1 Everyone who works in the service has an account. The company owner manages its users, plan and contract. Other people are invited to the company by its owner, and in the course of support also by our authorised staff (Article 6.5): if you were invited, your name and email address were entered by the person who invited you, not by you, and we sent you the invitation by email.

5.2 What data:

• email address, name, role in the company (owner or user), the status of the account and of membership in companies, and who invited you or who created the account;
• password, which we store only as a hash produced by the scrypt function with a salt, never in readable form;
• the time of the last sign-⁠in, the company you last worked in, your default email signature and your choice of whether you want to receive notifications by email;
• the sign-⁠in session: the hash of a random key stored in a cookie, the company you are currently working in and the validity of the session; we do not store an IP address or browser type with the session;
• hashes of the one-⁠time links in the invitation and in password reset;
• notifications in the service (the bell);
• the actions you take in the service that we record in the activity log (Article 6.2).

5.3 Sign-⁠in with Google. If it is enabled in the service and you use it, Google confirms to us the email address of your Google account and also sends the profile details you have in it (name and a link to your profile photo). We use the address only to sign you in to an existing account with the same address; no new account is created by it, and we do not store the name or photo from Google.

5.4 Purpose: to provide you with the service, that is sign-⁠in, work in the companies you are a member of, system emails and notifications in the service (for example an invitation, password reset, confirmations and notices concerning the service, the plan, payments, advertising and the cancellation of a company) and service notices, for example about a change to the terms.

5.5 Legal basis: for a company owner who concluded the contract with us on their own behalf, performance of the contract (point (b)); for an owner acting on behalf of a legal person and for other users invited to the company by its owner, the company's and our legitimate interest in enabling the company's people to work in the service and in enabling us to perform the contract with the company (point (f)); for notices required of us by law, legal obligation (point (c)).

5.6 How long:

• we keep the account for as long as you are a member of at least one company. The company owner, and in the course of support also our authorised staff, may disable your account in the company and then remove it. An account that is not in another company is deleted by removal from the last company or by the deletion of a cancelled company (Article 15.2); a disabled account remains until it is removed from the company or the company is deleted;
• your name attached to actions in the company, for example the approval of a campaign or a video, remains in the company's data even after the account is deleted, until the company deletes that data or the whole company is deleted;
• in the activity log (Article 6.2), your name and email address remain attached to the actions you took or that concerned you even after the account is deleted, to the extent and for the period set out in Article 6.2;
• a session is valid for at most 30 days; signing out invalidates it, and expired sessions are deleted continuously;
• the link in an invitation is valid for 7 days, the password reset link for 60 minutes;
• notifications in the service are deleted after 90 days.

5.7 We do not use account data for advertising or profiling and we do not sell it. We currently do not send you newsletters or other commercial communications; if we wished to send them, we would do so only to the extent permitted by law and with an easy way to refuse them. You can switch off email notifications from the service (for example about a finished video, a publishing error, an exhausted plan allowance or a failed payment) on the Notifications page; you will then see notifications only in the service.

Article 6 — Security and operation of the service

6.1 Attempt limiting. On sign-⁠in, registration, password reset and the creation of another company we count attempts by IP address and by email address or account in 15-⁠minute windows. Once the limit is exceeded, we temporarily refuse further attempts. After a successful sign-⁠in we immediately delete the counter for your IP address and account; other attempt records are deleted automatically after 30 days. The purpose is to protect accounts against password guessing and the service against abuse. Legal basis: legitimate interest in security (point (f)).

6.2 Activity log. We record who (name and email address) took which action in the service and when, for example approving and launching a campaign, connecting an account or mailbox, changing users and access rights, deletions, advertising, plans and changes to settings, and also every entry by our authorised staff into a company they are not a member of. With each action we also record its subject and a short description, which may contain, for example, the email address of a user or a contact, the name of a campaign or, on registration, the name of the company. The purpose is security, the investigation of errors and incidents, and proof of who did what. Legal basis: legitimate interest (point (f)). The log is accessible in the service only to our authorised staff.

We keep log records for 4 years from the entry, because until then it may be necessary to prove who took an action, for example in the event of a recipient's complaint or in a dispute; if a dispute or proceedings are under way at that time, until they end. After that we delete them. The record of agreement to the terms and conditions on the creation of another company is kept for as long as the registration record (Article 4.3). When a cancelled company is deleted, in the entries made by accounts deleted together with the company we replace their name and email address with a note about a deleted account. Other entries remain as they were; these include entries by our authorised staff and by other members concerning those accounts, the company name recorded on registration, and the addresses of the contacts concerned by the action. When the owner removes an individual account from the company, the entries in the log do not change. At the company's request we delete from the log earlier the data that we can attribute to its company (Data Processing Agreement, clause 2.27).

6.3 Application errors. In the event of an error we record where it occurred, its type and message, from which we remove email addresses, tokens and long numbers before recording, and the number and time of occurrences. We send a summary of new errors by email to our authorised staff. An error record is deleted 30 days after its last occurrence. In the event of an error, the Video Editor sends the error text, its version and the browser type to the server's technical record. Legal basis: legitimate interest in the functioning and security of the service (point (f)).

6.4 Record of calls to external services. For calls to the interfaces of external services (artificial intelligence, videos, payments, social networks, advertising and stock libraries; Article 13) we record the address, the service, the time and the beginning of the request and of the response (at most 4,000 characters), without access keys. It may also contain part of the data that the function sends or receives, for example text for artificial intelligence, the beginning of a face photo when creating a character, or data from an advertising form. For voice control and dictation we do not record the content of calls. The record serves only for resolving errors and for the security of the service. Legal basis: our legitimate interest in the functioning and security of the service (point (f)). We do not use the companies' data that ends up in the record for other purposes (Data Processing Agreement, clause 2.27). Records are deleted automatically after 30 days.

6.5 Access by our staff. Our authorised staff enter companies in the service only with their own named accounts, and only when this is necessary for operation and support, for handling your request, for security, or for supervising compliance with the terms and conditions and the law. Every entry of theirs into a company they are not a member of is recorded in the activity log with their name, the time and the company code (Article 6.2).

6.6 Server technical records. The programs on the server write operational messages to technical records (logs), which are stored to a limited extent and are continuously overwritten by newer records. They may contain, for example, an email address to which a system email could not be delivered, or an IP address in the event of an error. During server maintenance our authorised staff view the last lines of these records and overviews of the service, for example campaign names, through the GitHub code management tool. GitHub retains these maintenance outputs and deletes them automatically after the period set in our account, at the latest after 400 days. In evaluating them, our staff are assisted by Anthropic's Claude assistant (Article 13.1). The purpose is the operation, error resolution and security of the service. Legal basis: legitimate interest (point (f)). Backups are described in Article 15.

6.7 Deletion at the avatar service after a company is deleted. When we delete a company (Article 15.2), we keep a record of its characters, voices and videos in our account at Argil that we are to delete there (Article 9.5): the company code and name (for a natural person, their name), the type of object, its identifier at Argil and the date the company was deleted. The purpose is to delete them there in accordance with the Data Processing Agreement, clause 2.29, and to be able to demonstrate it; we do not use the record for anything else. Legal basis: legitimate interest (point (f)) in fulfilling the obligation to delete the company's data that we have towards the company under that agreement and under Article 28⁠(3)⁠(g) GDPR. We delete the record once their erasure at Argil is confirmed, at the latest 90 days after the company is deleted or, if because of a fault the notice to our administrators to delete them is sent later than 60 days after the company is deleted, at the latest 30 days after that notice is sent.

Article 7 — Orders, payments, invoicing and customers' contact persons

7.1 This Article concerns anyone who orders a paid plan or a top-⁠up on behalf of a company or for themselves, who withdraws from the contract or cancels the company, and the customer's contact persons with whom we negotiate a contract, for example for the Enterprise plan. If your details as a contact person were not provided by you, we received them from the customer or from your colleague who is negotiating the contract with us.

7.2 What data:

• order: who ordered (name and account, for a subscription also the email address), what, at what price and for what period, for a subscription also your declarations at the time of the order (whether you are ordering as a business, the request to begin performance and consent to automatic renewal) together with the version and hash of the terms and conditions, and the order confirmation;
• payment: payments are processed by Stripe. From us it receives the company name and the email address of the person ordering. You enter the billing address, VAT identification number and payment card details directly on the Stripe payment page, and the card details do not reach us. From Stripe we hold the customer, subscription and invoice identifiers, the invoice number and amounts, links to the invoice in Stripe and Stripe's messages about the progress of payments, which may also contain billing details;
• withdrawal from the contract: name, email address, time and amounts;
• cancellation of the company: who announced it, their email address, the times and who, if anyone, revoked the cancellation;
• contact persons: name, position, email address, telephone and the content of communication about the contract.

Purpose and legal basis:

• conclusion and performance of the contract, payment, order confirmation, withdrawal from the contract and complaints — contract (point (b)); for persons acting on behalf of a legal person and for the customer's contact persons, our legitimate interest in concluding and performing the contract with the customer (point (f));
• issuing the invoice, applying VAT correctly according to where you are established or reside and whether you have a VAT identification number, and keeping records of sales — legal obligation under Union and Member State VAT law (point (c)); keeping accounts and fulfilling tax obligations in the country of our registered office — our legitimate interest (point (f));
• obligations towards consumers, for example confirming the order and handling withdrawal — legal obligation (point (c));
• establishing and defending legal claims — legitimate interest (point (f)).

How long:

• we keep invoices, records of sales and other accounting documents, including payment data, for 10 years from the end of the year in which the sale took place. For sales to consumers in the Union this is required by VAT law (Article 369k of Council Directive 2006/⁠112/⁠EC). We keep the other documents for the same period on the basis of our legitimate interest in fulfilling tax and accounting obligations and in proving payments;
• we keep orders, declarations at the time of the order, confirmations, withdrawals and the record of the cancellation of a company for the duration of the contract and then until the limitation periods expire, at most 4 years from the end of the contract, and during an ongoing dispute until it ends; if they form part of accounting documents, for as long as those;
• these documents remain even after a cancelled company is deleted (Article 15.2);
• we keep communication with contact persons during the negotiation and the duration of the contract and then as evidence for as long as orders.

7.3 For payments, Stripe is also an independent controller and retains the data you enter with it in accordance with its own privacy policy.

7.4 Without the order data and billing details we cannot sell you paid services; billing details are required by VAT law.

Article 8 — When you write to us or call us

8.1 This Article concerns emails, letters and telephone calls, enquiries about the Enterprise plan from the form in the website's price list, complaints, requests to exercise rights, notices of illegal content and correspondence for our representative in the Union.

What data: your name, email address, possibly telephone and company, the content of the message or call, attachments and our reply. For an Enterprise enquiry, the name, company, email address, telephone, message and the language of the website from which you sent the enquiry.

Purpose: to handle your message and reply to you.

Legal basis: for an enquiry about a contract, steps prior to concluding the contract at your request (point (b)), and if you write on behalf of a legal person, our legitimate interest in replying to its enquiry (point (f)); for customer support, performance of the contract (point (b)), and if the customer is a legal person, our legitimate interest in performing the contract with it (point (f)); for a complaint, a request under the GDPR and a notice under the Digital Services Act, legal obligation (point (c)); for other questions, legitimate interest in replying to whoever contacts us (point (f)).

How long: for as long as necessary for handling and the follow-⁠up communication. If the message relates to a contract, a complaint, a request to exercise rights or a notice, we keep it as evidence of how we handled it until the limitation periods expire, at most 4 years from handling; if a dispute or proceedings are under way at that time, until they end. Messages are stored in our email mailbox at Google Workspace (Article 13.1).

8.2 Our server sends an enquiry from the Enterprise form by email to our mailbox quick@plus.contact through the system mail (Article 13). We do not store it in the service's database. We use the IP address of your connection only to limit the number of enquiries against abuse; we hold it only in the server's working memory and do not write it to the email or to the database.

8.3 Providing the data is voluntary; without contact details, however, we cannot reply to you.

Article 9 — Data we process for companies

9.1 A company that uses the service is the controller of the data it uploads to the service or obtains in it. We process that data only on its instructions under the Data Processing Agreement, which is Annex 2 to the terms and conditions (https://plus.contact/en/podmienky). This mainly concerns:

• contacts of companies and persons, for example name, company registration number, address, website, telephone numbers, name, position and email address together with its origin and the address of the page where it was found, and the custom fields the company creates;
• campaign recipients, sent emails, data on their opening and on clicks on links, unsubscriptions and undeliverable addresses;
• replies that the service reads from the company's mailbox;
• contacts from the company's advertising forms on Facebook and Instagram, once we make advertising available in the service;
• photos, voice recordings and videos of people that the company uploads to the service, and the record of their consent;
• content that the company creates in the service, for example emails, signatures, posts, advertisements, approvals and transcripts of voice commands.

9.2 The company is responsible for having a legal basis for processing this data and for having provided the data subjects with the necessary information. A company that is our customer must, before its first live email, fill in the sender identification and the address of its own privacy policy in the service and confirm the legal basis for outreach. The service will not send an email to contacts from advertising forms until the company records a legal basis for them as well. The service will not create a character from a photo or a voice from a recording until the company records the consent of the person concerned.

9.3 We do not use this data for our own purposes other than the security of the service and the resolution of its errors (Articles 6.2 and 6.4), we do not sell it, we do not make it available to other customers, and we do not use it to train artificial intelligence models. The company can download it at any time (Article 17.2) and deletes it by cancelling the company, subject to the exceptions set out in Articles 9.5 and 15.2, in particular unsubscription records. The service does not yet have the deletion of an individual person from contacts as a separate function; we carry it out at the company's request without undue delay, at the latest within 14 days. We always keep the address of an erased person in the company's unsubscription records, so that the company sends them nothing more through the service (Data Processing Agreement, clause 2.20).

9.4 If you contact us with a request concerning a company's data, for example you want to know what data the company holds about you or you want it deleted, we forward it to the company without undue delay and inform you of this. The company decides on the request as the controller. An unsubscription from emails that you request through the link in an email is recorded by the service itself (Article 10.3).

9.5 The characters, voices and videos that the service creates through the avatar video processor (Argil) are, together with the video scripts, also stored in our account at Argil. Removing them in the service does not delete them there by itself. We delete them there at the company's request within 30 days and, after the company is deleted, within 30 days even without a request (the record we keep for this is described in Article 6.7); until we confirm their erasure, but for no longer than until that record is deleted, we do not assign them to another company in the service. Characters and voices that the company did not create in the service but received from our account at Argil are not deleted there after the company is deleted. Nor do we delete there, after the company is deleted, characters and voices created by the company that at the time of its deletion are still used in the service by another company or by us (for example as the default character or voice in the service settings). If you are the person in the photo or recording and want to withdraw your consent, contact the company; if you write to us, we will forward the request to it.

Article 10 — Have you received an email sent through Contact+?

10.1 Who is responsible for the email. The email was sent to you by a company that uses Contact+. It leaves from the company's own email mailbox and in its name. The company decided to contact you and knows where it got your address; it is the controller of your data. We provide it with the tool and process your data only on its behalf. If the email was sent to you through Contact+ directly by RESINOS & GO UP SYSTEMS INC. as the operator of Contact+, we are the controller of your data; we give you the information under Article 14 GDPR (where we got your address, why and on which legal basis we are contacting you, and how long we keep the data) in that email.

10.2 Who must inform you. The information under Articles 13 and 14 GDPR is given to you by the company: who it is, why and on which legal basis it is contacting you, where it got your data, how long it keeps it and what rights you have. A company that is our customer must have the sender identification and the address of its own privacy policy filled in in the service; without them the service will not send its campaign emails live. The service inserts the sender identification and a link to its policy into the footer of campaign emails and single emails. If the company sends an email in its own graphic template, it is responsible for ensuring that this information is included; if you cannot identify the sender from the email, proceed under Article 10.6. Replies that the company writes to your message do not have a footer. Alongside your address the service also records its origin and the address of the page where the company found it, so that the company can tell you where it got it.

10.3 How to unsubscribe. Every campaign email and every single email that a company sends from the service contains an unsubscribe link. It opens a page with the sender's name and a confirmation button; after confirmation the service records the unsubscription immediately. The email also carries information by which your email program can offer you one-⁠click unsubscription. The company will then not send you another campaign email, single email or reply through Contact+. Unsubscription applies broadly: it also stops emails to the other addresses of the organisation to which the company has assigned you in its contacts, and to the whole domain of your address (except public domains, for example gmail.com), in all campaigns of that company. It applies to the company that sent you the email; another company using Contact+ has its own contacts, so unsubscribe from its emails separately. You can also refuse further emails by writing to the sender; the link in the email, however, is the fastest way.

While the company uses the service, the unsubscription record (address, time, campaign, reason and method of unsubscription) ensures that it will not send you further emails through Contact+. When the company stops using the service and we delete its data (Article 15.2), we retain the unsubscription record (address, possibly domain, reason, method and time) on its instruction as evidence that you unsubscribed and that it respected this. Likewise, we retain your address that the deletion of your data on the company's instruction entered in the unsubscription records (Article 10.6), as evidence that the company had your data deleted. We use these records for nothing else, they are not used in another company, and we delete them within 30 days of the company revoking that instruction.

10.4 Measuring opens and clicks. Into campaign emails and single emails that a company sends from the service, the service inserts an invisible image and routes the links in the body of the email through a redirect at https://link.plus.contact. The unsubscribe link, the links in the signature and in the footer added by the service, and links whose text shows the address itself are not redirected. Replies that the company writes to your message in the service's Mail have neither the image nor redirected links. Both the image and the redirected link carry a random code by which the company can see whether and when you opened the email and which link you clicked. For each email only the time of the first and last opening and their number, the time of the first click, the number of clicks and the address of the last clicked link are recorded. We do not record the IP address, device or browser and we do not set a cookie. From this data the company sees the results of the campaign and may use it to choose whom to send the next email to. To the links in the body of the email (except the unsubscribe link) the service also adds source and campaign tags (utm parameters), by which the target page can see that you came from an email; these tags do not identify you. Measurement is currently switched on in every campaign email and every single email (except replies from Mail) and the sender cannot switch it off. You can stop open measurement by switching off the automatic loading of images in your email program; a click on a redirected link is still recorded, and the link takes you to the correct page. The company is responsible for whether and how it informs you about the measurement and whether it needs your consent for it.

10.5 Your replies. If you reply to the sender, the reply arrives in the sender's mailbox. The service reads it from there and stores for the company the sender's address and name, the subject and the text of the reply without the quoted previous message (at most 8,000 characters). If the company uses an AI-⁠generated reply suggestion, the text of your message, its subject and the name of your organisation are sent to the AI processor (Article 11.1). If people from the company control the service by voice, the AI processor may also receive your name, the name of your organisation and the subject of your reply if it is among the 20 most recent (Article 11.1).

10.6 Whom to contact. With a question or a request, for example for access to your data or its deletion, contact the company that sent you the email; you will usually find its contact details in the footer of the email and in its policy. If you cannot identify the company or it does not reply, write to us at quick@plus.contact and state your address, or forward us the email you received. We will forward the request to the company without undue delay and inform you of this (Article 9.4). If the company decides to delete your data, we delete it on its instruction; we keep your address in the company's unsubscription records, so that it sends you nothing more through Contact+. If the company sends you emails through Contact+ despite your unsubscription or otherwise in breach of the law, let us know; we may suspend its sending. You may also lodge a complaint with a supervisory authority (Article 18).

10.7 We do not use your address from the company's data for our own purposes and we do not provide it to other companies.

Article 11 — Artificial intelligence and automated processing

11.1 Artificial intelligence (AI) functions run only when a user uses them in the service. The results are produced by external services (processors, Article 13), to which we pass only what the given function needs:

• text suggestions for emails, posts, advertisements and video scripts and reply suggestions for a received message are produced by Anthropic. It receives the brief and texts, the description of the company and its brand profile, and for a reply suggestion also the text of the received message, its subject and the name of the sender's company. For post suggestions Anthropic also searches the web;
• avatar videos are produced by Argil: it creates a character from a photo and a voice clone from a recording, and shoots a video according to the script. Commentary in preset voices is read by ElevenLabs. Speech in videos is transcribed and video captions are written by Groq. The character photo is adapted to the chosen style by Google Gemini, which we ask not to store the photo;
• voice control and dictation: speech is first recognised by your browser. Some browsers, for example Chrome, send the audio to their maker under its terms when doing so. If the browser cannot do this, the audio of the command or of the dictated text is transcribed by Groq. The voice command is then interpreted by Anthropic, which also receives an overview from the company including the names and companies of the senders of the 20 most recent replies and their subjects; dictated text goes only into the field you are dictating into. We do not store audio; the transcript of the conversation with the voice assistant, together with the name and email address of the person who spoke, is deleted after 30 days.

11.2 AI results are suggestions. A campaign email does not go out live, and a social media post or an advertisement is not published, until its wording is approved or confirmed by a person from the company. Nothing can be approved, launched, sent or deleted by voice; these actions are performed by a person in the service's interface.

11.3 We do not use data to train AI models. How long the processors retain data is governed by our contracts with them; characters, voices and videos at Argil are deleted in accordance with Article 9.5.

11.4 We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The service only applies technical rules automatically: it limits the number of sign-⁠in attempts, enforces plan limits, stops emails after unsubscription or for an undeliverable address, and suspends a campaign from which too many undeliverable emails are returned. A decision to restrict an account or a company for a breach of the terms or the law is always made by a person.

Article 12 — Cookies and browser storage

12.1 The website plus.contact does not use cookies or browser storage (Article 3). Links to https://link.plus.contact do not set cookies.

12.2 The application at https://app.plus.contact uses only three of its own cookies:

• itc_kontakty_relacia keeps you signed in. It contains a random key, of which we hold only the hash on the server. It is valid for 30 days from sign-⁠in so that you do not have to sign in again after closing the browser; if you do not want this, sign out with the Sign out button, the cookie is deleted and the sign-⁠in is invalidated on the server as well;
• itc_kontakty_google protects sign-⁠in with Google against forgery. It is set only during that sign-⁠in and is valid for 10 minutes;
• jazyk remembers the language you chose in the application. It is valid for 1 year from the last choice and the browser sends it only over an encrypted connection.

12.3 The application also remembers in your browser some display settings and work in progress, for example a draft post or projects in the Video Editor. This data stays on your device and is not sent to the server by itself.

12.4 We do not use analytics, advertising or tracking cookies, social network pixels or third-party tools for measuring traffic. Everything we store in the browser is necessary for the service you have requested, or we store it on your instruction (the language choice). We therefore do not ask for consent and do not display a consent banner (Section 109⁠(8) of Act No. 452/⁠2021 Coll. on Electronic Communications (zákon č. 452/⁠2021 Z. z. o elektronických komunikáciách) and Article 5⁠(3) of Directive 2002/⁠58/⁠EC).

12.5 If you yourself choose sign-⁠in with Google, payment through Stripe or the connection of Facebook and Instagram, you go to their pages, which use their own cookies under their own policies. The fonts you use in the Video Editor are loaded from our server. In some parts of the application, however, your browser loads content directly from another server:

• previews of characters and voice samples for avatar videos from the servers of Argil, which creates avatar videos for us, or of its storage provider;
• previews of footage search results in the Video Editor from the servers of Pexels, Pixabay and Vimeo;
• samples of music and sounds that you play in the Video Editor from the servers of Jamendo and Freesound.

Those servers then see the IP address of your connection and basic details about your browser. The image servers of Pexels and Pixabay may in doing so store their own technical cookies in your browser (for example __cf_bm and _cfuvid) if you do not block third-party cookies; we neither set nor read these cookies. Speech recognition for dictation and voice control is described in Article 11.1.

12.6 A detailed list of cookies, data in the browser and content from other servers is at https://plus.contact/en/cookies.

Article 13 — To whom we disclose data

13.1 Processors. In operating the service we are assisted by processors, who process data only on our instructions and on the basis of a contract under Article 28 GDPR:

• Hostinger — the service's server in a data centre in the Netherlands (database, files and backups);
• Google Workspace — our mail: system emails (for example registration verification, invitations, password reset, confirmations and notifications), delivery of enquiries from the website, and the mailbox quick@plus.contact, in which the emails you send us and our replies are stored;
• GitHub — code management and server maintenance; it retains maintenance outputs, which may contain an email address from the server's technical record, for example for an unsent email, or a campaign name (Article 6.6);
• Anthropic, Argil, ElevenLabs, Groq and Google Gemini — artificial intelligence functions, avatar videos and speech transcription, only when you use them (Article 11); Anthropic also during maintenance of the service, when the Claude assistant helps our authorised staff evaluate maintenance outputs (Article 6.6);
• Stripe — payments, only when you pay; for payments it is also an independent controller.

The complete and current list, with the processors' registered offices, the place of processing, the data they receive and the safeguard for transfers, is at https://plus.contact/en/spracovatelia.

13.2 Providers you choose yourself. Data is also received by, or provided to us by, providers whose use you or your company choose:

• Google for sign-⁠in with Google;
• Meta (Facebook and Instagram) and LinkedIn, when you connect a company page or profile to the service and the service publishes a post on the company's instruction;
• Google and Meta, once we make advertising available in the service, the company connects its advertising account to the service, and the service assembles and launches an advertisement in it on the company's instruction and after confirmation by a person from the company; they receive its texts, images and videos, including the people in them, the budget and the campaign settings; Meta also when the service takes over contacts from the forms of those advertisements;
• the provider of the email mailbox that the company connects to the service.

They are not our processors. They process data under their own terms and policies and under the contract that you or your company have with them; Google, Meta and LinkedIn, for most processing, as independent controllers.

13.3 Other recipients:

• people from the company you are a member of, to the extent the service shows them, for example the company owner in the list of its users;
• our representative in the Union (Article 1.3), if necessary for handling your matter;
• accounting, tax and legal advisers bound by confidentiality, if we engage them for keeping accounts or protecting our rights;
• public authorities and courts, where the law requires us to.

13.4 We do not sell personal data and we do not provide it to anyone for their marketing.

13.5 Some services we use do not receive personal data from us: Pexels, Pixabay, Freesound and Jamendo receive from our server only the search terms when searching for photos, videos, sounds and music (the exceptions for previews and samples that your browser loads directly from them are described in Article 12.5); Cloudflare only resolves our domain names to the server address, and the service's traffic does not pass through it; Let's Encrypt issues certificates for the encrypted connection and receives only our domain names.

13.6 Data from Google. Data we obtain through Google interfaces (sign-⁠in with Google, Google Ads and the uploading of videos for advertisements to YouTube) is used only for the service functions you have chosen. We disclose it further only to the extent necessary for those functions, for security or as required by law, and we do not use it for advertising or for the development or training of general artificial intelligence models. The use of this data is governed by the Google API Services User Data Policy, including the Limited Use requirements.

Article 14 — Transfer of data outside the European Union

14.1 We are established in the USA. We obtain the personal data under this policy directly from you, from the company you are a member of, from the customer on whose behalf you negotiate with us (Article 7.1), or from services you use yourself (Google for sign-⁠in with Google, Stripe for payment). Because we offer the service to people in the European Union, the GDPR applies to us in full (Article 3⁠(2) GDPR). You may contact our representative in the Union in accordance with Article 1.3.

14.2 We operate the service on a Hostinger server in a data centre in the Netherlands. That is where the service's database, the companies' files and the database backups are. We have no other server of our own. Some data is also retained by the processors under Article 13.1, for example Argil the characters, voices and videos (Article 9.5), Google Workspace our mail, and GitHub the server maintenance outputs (Article 6.6).

14.3 Data leaves the European Economic Area (EEA) when it is processed by a processor established or processing in a third country, in particular the USA (Article 13). The transfer relies:

• for a recipient certified under the EU-⁠US Data Privacy Framework, on the Commission's adequacy decision (Commission Implementing Decision (EU) 2023/⁠1795);
• otherwise, on the standard contractual clauses under Commission Implementing Decision (EU) 2021/⁠914, which form part of the data processing agreement we have with the processor concerned.

Which safeguard applies to which processor is stated in the list of processors. We will send you a copy of the safeguards on request.

14.4 In the service our authorised staff access data only with named accounts and connect to the server only over an encrypted connection. If a government authority outside the Union were to request access to personal data from us, we would examine whether the request is lawful, provide only the extent that the law strictly requires of us and, if the law allows, inform the company or the person concerned.

Article 15 — Backups, cancellation of a company and deletion

15.1 We back up the service's database once a day on the same server in the Netherlands. We make further database backups before deploying a new version, before restoring the database and during maintenance. Each backup is deleted automatically after 14 days, so deleted data disappears from backups within 3 weeks at the latest. We use a backup only to restore the service after an error or incident; if we restored one, we would delete again the data deleted after it was created. Companies' files (images and videos) are not yet backed up, and off-⁠server backup is not yet enabled; if we enable it, we will update this policy.

15.2 A company is cancelled by its owner in the section Plans › Contract and data › Cancel company (https://app.plus.contact/balik/zrusenie-firmy). A company can be cancelled if it has no active paid plan, no open payment and no running advertisement. Campaigns are suspended immediately. For a further 30 days you can download all the data (Article 17.2) and revoke the cancellation. After that we delete the company's data together with the accounts that are not members of another company (an account that confirmed an advertisement in another company remains there disabled as evidence), and we send an email about the deletion. Only the following remain:

• documents relating to the contract and payments, including the company name, which we must retain by law or for the defence of legal claims (Article 7), and the record of registration and agreement to the terms (Article 4);
• records of unsubscriptions and undeliverable addresses (address, possibly domain, reason, method and time), including the addresses of persons erased on the company's instruction (Article 10.6), which we retain on the company's instruction as evidence that it respected the recipient's objection or had their data erased (Article 10.3; Data Processing Agreement, clause 2.28);
• data on the advertising accounts linked to the company and agreement to the advertising terms, without access credentials;
• the activity log to the extent and for the period set out in Article 6.2;
• the records of attempts and of calls to external services (Articles 6.1 and 6.4), which are deleted after 30 days;
• characters, voices and videos created in the service, which we delete in our account at Argil within 30 days after the company is deleted, except characters and voices that at the time of its deletion are still used in the service by another company or by us (Article 9.5), and the record of them, which we delete once their erasure is confirmed, at the latest 90 days after the company is deleted or, if because of a fault the notice to our administrators to delete them is sent later than 60 days after the company is deleted, at the latest 30 days after that notice is sent (Article 6.7);
• content that the company published on social networks or used in advertising; it remains with Meta, LinkedIn or Google until the company removes it directly there;
• messages you sent us (Article 8) and server maintenance outputs (Article 6.6) for the periods we state for them.

Deleted data disappears from backups in accordance with Article 15.1.

Article 16 — How we protect data

16.1 We have taken the following measures:

• the connection to the service and to the website is encrypted (HTTPS), and the application instructs the browser to use only an encrypted connection;
• the database runs on a server in the Netherlands and is not directly accessible from the internet;
• we store passwords only as hashes (scrypt with a salt) and require a password of at least 12 characters;
• the keys for sessions, invitations, password reset and registration are held in the database only as hashes;
• passwords for email mailboxes and access tokens for networks and accounts are encrypted in the database (AES-⁠256-⁠GCM) with a key that is not in the database;
• each company's data is separated in the database, and a user works only in the companies they are a member of;
• we limit the number of sign-⁠in attempts (Article 6.1);
• our staff enter companies only with named accounts, and the activity log records their actions and every entry of theirs into a company they are not a member of (Article 6);
• we keep the record of application errors (Article 6.3) without email addresses and tokens;
• we back up the database daily (Article 15.1).

16.2 The service does not yet offer two-⁠factor sign-⁠in. Therefore use a strong password that you do not use anywhere else.

16.3 We will notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals. If it is likely to result in a high risk, we will also notify you without undue delay. We document every breach. For a company's data we inform the company in accordance with the Data Processing Agreement.

Article 17 — Your rights and how to exercise them

17.1 You have the right:

• of access — to find out whether and what data we process about you and to receive a copy of it (Article 15 GDPR);
• to rectification of inaccurate data and completion of incomplete data (Article 16);
• to erasure, for example if we no longer need the data, if you have successfully objected, or if it is processed unlawfully (Article 17); we will not erase what we must retain by law or for the defence of legal claims;
• to restriction of processing, for example while we verify the accuracy of the data or your objection (Article 18);
• to portability — to receive the data you have provided to us and that we process by automated means on the basis of a contract or consent, in a structured and machine-readable format, or to have it transmitted to another controller where technically feasible (Article 20);
• to object to processing based on legitimate interest (Article 21; Article 17.1a);
• to withdraw consent, if we were to process data on its basis, at any time and without affecting the lawfulness of processing before withdrawal;
• not to be subject to a decision based solely on automated processing (Article 22; Article 11.4).

17.1a Right to object. You may object at any time, on grounds relating to your particular situation, to processing we carry out on the basis of legitimate interest (point (f)), for example by email to quick@plus.contact. We will then cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. If we were ever to process your data for direct marketing, you could object at any time without giving reasons, and we would always cease processing for that purpose.

17.2 Directly in the service you can:

• as a company owner, download all the company's data, including the list of its users, in a single JSON file in the section Plans › Contract and data (https://app.plus.contact/api/export/firma);
• download contacts in CSV or XLSX format in the Companies and People lists;
• change your password with the Forgotten password function;
• switch off email notifications on the Notifications page;
• as a company owner, disable or remove the company's users and cancel the whole company (Article 15.2);
• as a company owner, disconnect connected social network pages and accounts and, if you connected them, also advertising accounts, in the section Settings › Service connections. You can also revoke our access directly with the provider, for example in your Facebook settings or your Google account; campaigns running in an advertising account are stopped directly there.

17.3 Send other requests, for example for a copy of your account data, for correction of your name or email address, for deletion of your account, or an objection, to quick@plus.contact, by letter to the address of our registered office, or to our representative in the Union (Article 1.3). So that we do not release data to the wrong person, we may ask you to verify your identity, for example by replying from the email address of your account. We will handle the request without undue delay, at the latest within 1 month of receiving it. In complex cases or where there are many requests we may extend the period by a further 2 months; we will inform you of the extension and its reasons within 1 month. Handling is free of charge; for a manifestly unfounded or excessive request, in particular a repeated one, we may charge a reasonable fee or refuse it. If we do not grant your request, we will inform you within 1 month of the reasons and of the possibility of lodging a complaint with a supervisory authority (Article 18) or seeking a judicial remedy. We will communicate any rectification, erasure or restriction to the recipients to whom we have disclosed the data, unless this proves impossible or involves disproportionate effort, and we will inform you of those recipients on request.

17.4 Requests concerning data we process for a company (Article 9) are forwarded to the company (Article 9.4).

17.5 Data from Facebook and Instagram. If you want us to delete the data we obtained through your connection to Facebook or Instagram, disconnect the connection in the service or in your Facebook settings and write to us at quick@plus.contact. We will delete the data within 30 days, except what we must retain by law; contacts from the company's advertising forms are deleted on the company's instruction.

Article 18 — Complaint to a supervisory authority

18.1 If you believe that we process your personal data in breach of the GDPR, you may lodge a complaint with a supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk. You may also lodge a complaint with the supervisory authority of the Union Member State of your habitual residence, place of work or the place of the alleged infringement.

18.2 We would appreciate it if you first gave us the opportunity to resolve the matter (Article 1.2); this is not, however, a condition for lodging a complaint.

Article 19 — Do you have to provide us with data?

19.1 The data provided on registration and in the account (name, email address, password and the company name or personal name) is a contractual requirement: without it you cannot register or use the service.

19.2 Billing details for a paid order are required by VAT law and are a contractual requirement; without them we will not sell you paid services.

19.3 We need the IP address and the technical details of the request to deliver the page; without them neither the website nor the service works.

19.4 Everything else is voluntary: sign-⁠in with Google, voice control and dictation, AI functions, the connection of social network accounts and advertising accounts, the Enterprise enquiry and the messages you send us. If you do not provide the data, you will not be able to use the function concerned, or we may be unable to reply to you.

Article 20 — Children

20.1 The service is not intended for persons under 18 years of age. Only a person who is at least 18 years old and has full legal capacity may register. If we find that an account belongs to a person under 18, we will cancel it and delete its data except what we must retain by law.

20.2 Companies must not upload children's data to the service (Data Processing Agreement, clause 2.9).

Article 21 — Changes to this policy

21.1 We update this policy when the service, its processors or the legal rules change. We publish the new version at https://plus.contact/en/ochrana-udajov with a new version designation and effective date. We will notify you, as a user of the service, of substantial changes that concern you in advance by email to the address of your account. Changes of processors are notified to companies in accordance with the Data Processing Agreement. We will send you the previous wording on request.

21.2 This policy in version 2026-⁠11-⁠05 is effective from 5 November 2026. If we publish it in another language as well, the Slovak wording prevails.