Privacy Policy

OneSAM s.r.o., Lidická 960/81, Veveří, 602 00 Brno, Czech Republic, Company ID 24899470 (“OneSAM”, “we”) provides services to businesses and other organisations.

Although our customers are generally legal entities, we may process personal data relating to their employees, representatives, authorised users and other business contacts.

For privacy-related questions or requests, contact us at info@onesam.ai.

This Privacy Policy primarily describes processing for which OneSAM acts as a data controller.

Where OneSAM processes personal data contained in customer data within the OneSAM platform on behalf of a customer, OneSAM acts as a processor and the customer normally acts as the controller. Such processing is governed by the applicable Service Agreement and Data Processing Agreement (“DPA”).

Depending on your relationship with us, we may process:

• identification and business contact information;
• account, authentication and access information;
• contract, billing and transaction information;
• support requests and business communications;
• platform usage, IP addresses, device information, logs and security records;
• software asset, licence and usage information where it relates to an identifiable person;
• marketing preferences and communication records; and
• website, cookie and consent information.

We obtain personal data directly from you, through your use of our services, from the organisation you represent or, where legally permitted, from business partners and public professional sources.

Where we obtain personal data indirectly, we provide the information required by applicable data-protection law within the applicable period, generally no later than the first communication with the individual or one month after obtaining the data.

Certain personal data is necessary to create or administer accounts, provide services and support, issue invoices or meet legal obligations. If required information is not provided, we may be unable to provide the relevant service or fulfil the relevant request.

If our sales team contacts you

Introduction pages. Our salesperson may send you a private link to a page showing your company's name, the salesperson's business contact details and, if added, your name and a short note. We count how often the page is opened, without recording who opened it, and use no cookies. The link works for 45 days unless the salesperson changes that. 30 days after it stops working we erase your name and the note, and 30 days after that any messages you sent from the page. The page is served by our database provider, Supabase.

Booking a call. Booking links lead to Cal.com, Inc. (USA), which processes your name, email address, the time you choose and any notes or guests you add, to schedule the call. The transfer is covered by the EU–US Data Privacy Framework. We store only the call's time and status with our sales record of your company.

We process this data based on our legitimate interest in communicating with business contacts about our services.

We process personal data only where we have an appropriate legal basis.

Our legitimate interests include operating and protecting our services, administering customer and business relationships, supporting authorised users, preventing misuse, protecting our legal rights and carrying out proportionate business communications.

Where processing is based on legitimate interests, we consider the impact on the individuals concerned and their reasonable expectations.

You may object to processing based on legitimate interests, and you may object to direct marketing at any time.

Customers may upload, connect or otherwise process personal data through OneSAM, including information relating to employees, contractors, users, devices, software installations, licences, entitlements or software usage.

Where OneSAM acts as a processor, we process such data only on the customer's documented instructions, as necessary to provide, secure, maintain and support the Service, or where required by law.

The customer is responsible for determining the purposes and legal basis of such processing, deciding which personal data is processed through OneSAM and providing required information to affected individuals.

OneSAM may separately process limited service-related information as a controller where necessary for account administration, security, billing, legal compliance or protection of its legal rights.

Processing of customer-controlled personal data is governed in more detail by the DPA.

We may share personal data where necessary with:

• providers supporting hosting, infrastructure, communications, authentication, customer support, security, billing, analytics and other business operations;
• professional advisers such as accountants, auditors, insurers and legal advisers;
• authorised representatives of our customers or business partners; and
• courts, regulators and other public authorities where required by law or necessary to protect legal rights.

Where another organisation processes personal data on our behalf, appropriate contractual data-protection obligations are applied as required by GDPR.

Where providers process customer-controlled personal data on behalf of OneSAM, their use is also governed by the sub-processing provisions of the applicable DPA.

Where personal data is transferred outside the European Economic Area (“EEA”), we use a transfer mechanism permitted by GDPR, such as an adequacy decision, European Commission Standard Contractual Clauses or another lawful safeguard.

Where required, additional safeguards are applied taking into account the nature of the processing and the destination of the data.

Information about the applicable transfer safeguards and how to obtain a copy is available from us on request.

We retain personal data only for as long as reasonably necessary for the relevant purpose.

In particular:

• account and business-relationship information is retained for the relationship and for a reasonable period afterwards where needed for administration, contractual records or legal claims;
• accounting and tax records are retained for the periods required by applicable law;
• security, audit and technical logs are retained according to documented security, troubleshooting and evidence requirements;
• marketing information is retained until it is no longer required for the relevant purpose or the recipient withdraws consent, unsubscribes or objects, as applicable; and
• customer data processed on behalf of customers is retained and deleted in accordance with the Service Agreement, DPA, customer instructions and applicable law.

We apply technical and organisational measures appropriate to the risks associated with the processing, including appropriate access, authentication, security, logging, backup and supplier controls.

No security measure can eliminate all risk, but we regularly review our safeguards in light of the nature of the processing and relevant technical developments.

We delete messages sent through the contact form on our website 3 years after the sender's last message to us. Messages sent from an introduction page are erased sooner, as described in section 2.

GDPR rights apply to individuals whose personal data is processed, rather than to customer companies themselves.

Subject to the conditions and exceptions under applicable law, you may have the right to:

• access and correct your personal data;
• request deletion or restriction of processing;
• receive certain personal data in a portable format;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent where processing is based on consent; and
• exercise applicable rights concerning automated individual decision-making.

Requests may be sent to info@onesam.ai. We may request reasonable information necessary to verify the identity of the person making a request.

Where OneSAM processes your personal data on behalf of a customer, requests concerning that data may need to be handled by the relevant customer. We will assist the customer as required by the DPA and applicable law.

You also have the right to lodge a complaint with a competent supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

Our website may use cookies and similar technologies.

Technologies necessary to provide, operate or secure the website may be used without consent where permitted by law. Where consent is required, non-essential technologies such as analytics or marketing cookies are activated only after consent has been obtained.

Where non-essential cookies are used, users are provided with cookie settings allowing them to manage or withdraw their consent. Detailed information is provided in our Cookie Policy.

We send electronic commercial communications only where permitted by applicable law. Public availability of a business email address or other contact detail does not by itself constitute permission to send marketing communications.

Where permitted for existing customers, we may send communications concerning our own similar products or services, subject to the applicable legal requirements.

Recipients can unsubscribe or object to commercial communications at any time using the method provided in the communication or by contacting us.

OneSAM does not, in its capacity as a controller, use automated individual decision-making within the meaning of Article 22 GDPR that produces legal or similarly significant effects on individuals.

The OneSAM platform may produce licence, compliance, optimisation, usage, cost or similar business analyses. These outputs are intended to support customer decision-making and do not by themselves make decisions concerning individuals.

Customers remain responsible for determining whether their use of OneSAM outputs in relation to employees, contractors or other individuals requires additional legal safeguards.

We may update this Privacy Policy where our services, processing activities, suppliers or legal requirements change. The current version and its effective date will be made available on our website.