Privacy Policy

Effective from: 10 May 2026

This English translation is provided for convenience only. The Czech version is the legally binding text and prevails in case of any discrepancy.

This policy describes how we process the personal data of users of the SimpleCRM service. It meets the requirements of Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the guidance of the Czech Office for Personal Data Protection (ÚOOÚ).

1. Personal data controller

Ing. Tomáš Plachý

Lidická 709/55, Veveří, 602 00 Brno

Company ID (IČO): 06437541

Natural person registered in the Trade Licensing Register, registering authority: Brno City Municipality (Magistrát města Brna).

Contact: podpora@simplecrm.cz.

2. What data we process and on what basis

a) Identification and contact data from user registration

first name, surname, e-mail, phone, company, Company ID (IČO), billing address

Purpose:: performance of the contract, invoicing
Legal basis:: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (accounting)
Retention period:: for the duration of the contract and thereafter for as long as we are required to keep accounting and tax documents (up to 10 years)

b) Service usage data

records of logins and of actions performed in the application (who, what and when)

Purpose:: security, audit, technical support
Legal basis:: Art. 6(1)(f) GDPR — legitimate interest in securing accounts, in being able to demonstrate changes to data and in resolving support requests
Retention period:: for the duration of the contract and thereafter until the organization is deleted

We do not store the IP address; we use it only while processing a request, to limit the request rate.

c) Commercial communications to existing customers

the customer's contact e-mail

Purpose:: sending, where applicable, information about our own similar services
Legal basis:: Art. 6(1)(f) GDPR — legitimate interest in informing existing customers, Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services
Retention period:: until you opt out, which you can do by replying to any such message

3. Recipients of personal data

We disclose your data to the following recipients:

Hetzner Online GmbH (Germany) — operation of the application and database,
Comgate, a.s. (Czech Republic) — payment gateway,
Zoho Corporation B.V. (Amsterdam data center, Netherlands) — sending e-mails from the application (confirmations, invoices, notifications),
Google Ireland Limited or Google LLC, as the case may be — sign-in with a Google account (e-mail, name, profile picture, account identifier) and optional connection to Google Calendar (event content, e-mail of the connected account, access tokens),
Cloudflare, Inc. — receipt of e-mails forwarded to an address in the in.simplecrm.cz domain (the Smart BCC feature), including the message content and attachments,
where applicable, an accountant, to the extent of billing data.

If you enter a Company ID (IČO), we query the public ARES register maintained by the Ministry of Finance of the Czech Republic.

We handle invoicing in our own application — no external invoicing system has access to your data. We operate the application and database with Hetzner Online GmbH in Germany. For the recipients Google and Cloudflare, data may be transferred to the United States of America; such transfers rely on the standard contractual clauses under Art. 46(2)(c) GDPR contained in these recipients' contractual terms.

4. Google account data

If you sign in with a Google account or connect SimpleCRM to Google Calendar, we obtain the data described below through the Google APIs. We set out which data we access and how we use, share, protect and delete it.

a) Sign-in with a Google account

We obtain:: e-mail, name, profile picture link and Google account identifier
Use:: creating your account and signing you in to it; the e-mail becomes your account's e-mail (we send system e-mails to it, use it for payments and to recognize your messages in the Smart BCC feature); we display your name and profile picture in the application to you and to other members of your organization, and update them from your Google account when you sign in
Access tokens:: we use the tokens issued by Google at sign-in only to load this data once, and we do not store them
Retention period:: for as long as your account exists, including after its deactivation, until the organization is deleted or until an erasure request is handled (see below)

b) Connection to Google Calendar (optional)

We obtain:: the e-mail of the connected Google account, access tokens and, for each event written to Google Calendar, its identifier and any Google Meet meeting link
Use:: we write to your primary Google Calendar only those of your SimpleCRM events for which the option to write to Google is switched on (it is preselected while your calendar is connected, it can also be switched on later, and only you, as the owner of the event, can change it); we do not read other events from your calendar. While the connection is working, we propagate changes to these events in SimpleCRM to Google, including edits made by an administrator of your organization. If you delete an event or switch off writing to Google for it, we also delete its copy in Google while the connection is working; copies of events deleted together with a deal or a company remain in Google.
We send to Google:: the event's title, description, location, time and reminders, where applicable a request to create a Google Meet meeting, and the names and e-mails of invited attendees; Google sends them an invitation and also informs them by e-mail about changes to and cancellation of the event
Retention period:: tokens and the e-mail of the connected account until the calendar is disconnected, your account is deactivated or the organization is deleted, including after the subscription ends (we then no longer use the access to Google Calendar); the event identifier and the Google Meet meeting link at most for as long as the event exists in SimpleCRM

Sharing

We do not sell data from Google and do not use it for advertising or to train artificial intelligence models. We pass it on only to the extent necessary for the features you use: to the recipients listed in Section 3 (the database at Hetzner Online GmbH, system e-mails via Zoho, payment via Comgate) and to other members of your organization, who see your name, e-mail and profile picture in SimpleCRM and can add you as an event attendee – we then send your name and e-mail to Google and Google shows them in the invitation to the other attendees. Our authorized persons may access it when providing technical support; we log access via the administration interface. Otherwise, we pass on data from Google only if the law requires us to do so.

SimpleCRM's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Protection

We store Google Calendar access tokens encrypted in the database, and we communicate with Google exclusively over an encrypted connection (HTTPS). Further measures are described in Section 6.

Erasure

You can disconnect the calendar at any time in Settings → Integrations → Google Calendar → Disconnect, or, after the trial period or subscription has ended, on the plan selection screen. We thereby ask Google to revoke access, we delete the stored tokens and the e-mail of the connected account, and we delete from the events in SimpleCRM the link to their copy in Google Calendar. The copies of the events in your Google Calendar remain there; Google Meet meeting links remain on the events in SimpleCRM until you delete the events. We do the same automatically if your account is deactivated (for example, when the number of users is reduced).
If an administrator deletes the organization (Settings → Privacy → Delete organization), we ask Google to revoke access, we delete the calendar connection and all events in SimpleCRM (their copies in Google Calendars remain), and we remove the name, e-mail, profile picture link and Google account identifier from user accounts. The e-mail remains on issued tax documents and in payment records (Section 2(a)).
You can revoke SimpleCRM's access at any time in your Google account settings; the stored tokens thereby cease to be valid.
You can request erasure of your account, including data obtained from Google, at any time at podpora@simplecrm.cz, even if you no longer have access to the application or are not a member of any organization.

5. Rights of data subjects

You have the right:

of access to your data (Art. 15 GDPR),
to rectification (Art. 16),
to erasure / “to be forgotten” (Art. 17),
to restriction of processing (Art. 18),
to data portability (Art. 20),
to object to processing (Art. 21),
to withdraw consent (Art. 7(3)),
to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

To exercise your rights, contact: podpora@simplecrm.cz.

6. Security

We protect personal data with technical and organizational measures appropriate to the risks of processing (Art. 32 GDPR), in particular encrypted data transmission, access control, separation of the data of individual organizations and logging of our authorized persons' access to customer data via the administration interface.

7. Data processing in the CRM (our role as processor)

If you upload personal data of your customers to SimpleCRM, we act as a processor under Art. 28 GDPR. The relationship is governed by a separate Data Processing Agreement (DPA), which is an annex to the Terms and Conditions.

If e-mail tracking is switched on in your organization, we, as processor, record message opens and link clicks associated with the recipient's e-mail address; details are set out in Section 9 of the DPA.

8. Current version

This policy is effective from 10 May 2026 and was last updated on 23 September 2026. The current (binding Czech) version is always published at simplecrm.cz/ochrana-osobnich-udaju.