1. Who we are and when this policy applies

The controller for personal data described in this policy is the legal entity identified in Company information on About us. That section provides its business name, registered office, company identifier and contact details and forms part of this notice. References to “we”, “us” and “our” in this policy mean that controller.

This policy applies when you visit easyiga.com, submit a contact or demonstration request, book an introductory call with us, email us, receive our marketing emails, or otherwise discuss easyIGA with us. It does not describe processing inside a customer's easyIGA deployment. For customer deployments, the customer normally decides why and how identity data is processed and we act under the applicable contract and data-processing agreement.

Privacy contact: hello@easyiga.com. We have not stated that a data protection officer has been appointed. If that changes, this page will identify the DPO and a dedicated contact.

2. Personal data we process

Information you provide

your name, work email address, company and selected enquiry topic;
the message and any other information you choose to include;
if you ask for an introductory call: the time you choose;
your correspondence with us and information needed to arrange a demonstration or discuss a potential contract.

Information we record about your enquiry

Every enquiry sent through the website is recorded in our customer-relationship system (CRM), which we operate ourselves on a company server in the European Union (see section 5). The record holds the details you submitted, the date and source of the enquiry, its topic, the lawful basis and the version of this notice in force when it arrived, the date by which a first response is due, the status of the enquiry and its next step, how it was resolved, and the notes our team keeps while answering it. It also keeps one contact record per email address, linked to your enquiries. A booked introductory call is recorded as a meeting linked to that enquiry, with the appointment time and the online-meeting link.

Marketing emails, only if you ask for them

The contact form has a separate box for marketing emails. It is optional and never ticked in advance, and your enquiry is answered the same way whether you tick it or not. If you tick it, we record in our CRM that you agreed, the date and time, and where you agreed: the contact form, the version of this notice in force and the reference of your submission. We then use your name, email address and company to send you the easyIGA newsletter from us: news from identity governance and identity and access management (IGA and IAM), changes in legislation, practical advice and news about easyIGA. For each of these emails our CRM records that it was sent to you, whether it was delivered or bounced, whether you clicked a link in it and whether you unsubscribed. We do not use tracking pixels to see when you open an email.

If you are already our customer

If you or your organisation bought easyIGA or our services from us, we may email the work address you gave us for that purchase about our own products and services similar to those you bought, without a ticked box. We rely on our legitimate interest (GDPR Art. 6(1)(f)), as allowed by Article 13(2) of Directive 2002/58/EC and § 116(15) of Slovak Act No. 452/2021 Coll. You can refuse these emails free of charge when we collect your address and at any time afterwards, with the unsubscribe link in every email or by writing to hello@easyiga.com; we then stop (GDPR Art. 21(2) and (3)). We send them for no longer than one year after the contract ends.

Technical and security information

IP address, request time, requested URL, browser and device information, security signals and diagnostic identifiers processed by Cloudflare when the site or API is accessed;
a one-time Turnstile response token and related validation information when you use a protected form;
a randomly generated submission and request identifier used to prevent duplicate delivery and troubleshoot a submission;
a cryptographic hash derived from an IP address or, if unavailable, the submitted email address, used by Cloudflare's rate-limiting service. The Worker does not store the original value in application storage.

Information we deliberately do not collect through the site

The savings calculator runs locally in your browser and its values are not sent to us. We do not sell form data or enrich it through data brokers. Contacting us does not add you to our marketing emails; they go only to people who ticked the separate box and to our existing customers, as described above. Optional Google Analytics 4, Bing UET and AI-assisted website activity processing remain blocked until the corresponding Cookie settings choice is made.

3. Purposes and legal bases

Purpose	Data	Legal basis
Answer an enquiry or provide the requested walkthrough	Contact details, company, topic, message and correspondence	Steps requested before entering a contract (GDPR Art. 6(1)(b)) and our legitimate interest in professional communication (Art. 6(1)(f))
Record, assign and follow up an enquiry in our CRM so that it is answered within one business day and is not lost	Contact details, company, topic, message, enquiry status, dates and internal notes	Steps requested before entering a contract (Art. 6(1)(b)) and our legitimate interest in organised, accountable follow-up (Art. 6(1)(f))
Arrange and hold an introductory call you request	Name, email address, chosen time and online-meeting details	Steps requested before entering a contract (GDPR Art. 6(1)(b)) and our legitimate interest in professional communication (Art. 6(1)(f))
Send you the marketing emails you asked for, and see which of them are useful	Name, email address, company, the record of your consent and the email log described in section 2	Your consent (GDPR Art. 6(1)(a)). Keeping the record of your consent, and of any withdrawal or objection, so that we can show it and respect it: our legal obligation to be able to demonstrate consent (Art. 7(1) with Art. 6(1)(c)) and our legitimate interest in not writing to people who have said no (Art. 6(1)(f))
Email our existing customers about our own products and services similar to those they bought	Name and work email address given for the purchase, and the email log described in section 2	Our legitimate interest in keeping our customers informed (GDPR Art. 6(1)(f)), as allowed by Art. 13(2) of Directive 2002/58/EC and § 116(15) of Act No. 452/2021 Coll. You may object at any time (Art. 21(2))
Protect forms and services from abuse	IP address, security signals, Turnstile token, hashed rate-limit key and identifiers	Our legitimate interest in operating a secure, available service (Art. 6(1)(f))
Maintain records and handle legal claims	Relevant correspondence and transaction records	Legal obligations (Art. 6(1)(c)) and legitimate interests in establishing, exercising or defending legal claims (Art. 6(1)(f))
Optional website measurement	Online identifiers, page and content interaction events	Consent (GDPR Art. 6(1)(a)) for the selected Analytics or Advertising measurement purpose
Optional AI training and optimisation	Website content and on-site activity covered by the optional choice; never contact-form message content unless separately requested	Consent (GDPR Art. 6(1)(a)); any activated recipient and its processing details will be published before visitor activity is shared

Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations. You may object to that processing as described below.

4. Sources and whether you must provide data

We normally receive the information directly from you. If you or your organisation buy from us, we receive your work contact details through the order or contract. We may also receive business contact information from a colleague who introduces you or from information you have made public in a professional context. Required form fields are marked. The marketing box is optional: you can send an enquiry without it, and leaving it unticked has no effect on our reply. Without a valid email address and the required message details, we cannot answer the request. You are not required to include sensitive personal data, credentials, production data or confidential customer information, and you should not put such information in a website form.

Access is limited to authorised members of our team who need the information to answer or administer the request. Inside the company, enquiries are handled in a customer-relationship system that we run ourselves; the people who answer them use named accounts with role-based permissions. The website workflow currently uses:

Cloudflare for authoritative DNS, TLS, content delivery, the easyiga-web and easyiga-api Workers, rate limiting and Turnstile abuse prevention;
Resend (Plus Five Five, Inc.) to deliver the submitted message from form@notify.easyiga.com to our mailbox, to send you one confirmation of your enquiry from hello@easyiga.com, to deliver our CRM's internal notifications about new enquiries to our team, and, if you ticked the marketing box or are our existing customer, to send our marketing emails from easyiga.com through its sending region in the European Union (Ireland);
Microsoft 365 to host the receiving hello@easyiga.com mailbox and correspondence and, if you book an introductory call, Microsoft Bookings, Exchange Online and Microsoft Teams to schedule the call, send the calendar invitation and host the online meeting;
Our CRM (EspoCRM, self-hosted), the enquiry register described in section 2. It is open source software that we install, administer and operate ourselves; it is not a cloud service of a third-party vendor. It runs on a company server rented from netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) in a data centre in Nuremberg, Germany; netcup provides the server infrastructure as our hosting provider;
Hetzner Online GmbH (Germany) holds encrypted backup copies of the CRM in a data centre in the European Union;
Google Analytics 4 for optional website measurement after Analytics consent;
Unsplash to deliver some article photographs. Loading a remote image discloses connection information, including the IP address and browser request information, to the image provider.

Resend and Microsoft 365 receive the form content needed to deliver and hold the email. The visitor's address is placed in Reply-To and is not used as the sender address. Resend and Microsoft 365 do not receive the Turnstile token from our Worker. The website writes an enquiry into the CRM server-to-server through a restricted integration account; your browser never connects to the CRM and never receives its credentials. A booked call is read from Microsoft Bookings and recorded in the CRM by the same server-side integration. We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims.

Google Analytics 4 is active only after Analytics consent. It receives the online identifiers and page events used for website measurement. Microsoft Advertising and AI-assisted visitor-activity processing are currently disabled. See the cookie inventory and preference controls, Google’s privacy policy and Unsplash’s privacy policy. Withdrawal stops optional measurement from this website; it does not retroactively erase provider records.

6. Processing outside the EEA

Our CRM runs on a server in Germany and its backups are kept in the European Union. Cloudflare, Resend, Microsoft, Google and Unsplash operate internationally, so support, security or service delivery may involve processing outside the European Economic Area. Where Chapter V GDPR applies, we require an applicable transfer mechanism such as an adequacy decision, participation in the EU-US Data Privacy Framework where valid for the recipient and data, or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required. Provider locations and subprocessors can change; we review the relevant contractual documentation and publish material changes to this notice.

7. How long we keep information

Enquiries and demo requests: while the conversation is active and for up to 24 months afterwards, unless a longer period is required for a contract, legal obligation or legal claim. This period is enforced automatically: a monthly job on our CRM server erases the personal data of every closed enquiry whose last activity is older than 24 months, together with the contact record the same enquiry created unless that contact belongs to a customer relationship, and records the date and the number of records erased. An enquiry that leads to a contract is kept under the contract's own basis and retention period.
Booked introductory calls: the appointment record follows the enquiry it belongs to.
Marketing consent: kept with your contact record until you withdraw it, or until that record is erased under the enquiry rule above, whichever comes first. If you unsubscribe or object, we keep a note that your address must not receive marketing emails, only for as long as we need it to respect that choice.
Emails to existing customers: we use your work address for them until you refuse them, and in any case for no longer than one year after the contract ends. If you refuse, we keep a note that your address must not receive marketing emails, only for as long as we need it to respect that choice.
Backup copies: encrypted backups of the CRM are kept with a separate provider for disaster recovery only. They are not used to bring back erased records: if a backup is ever restored, the erasures made since that backup are repeated before the restored copy is used.
Unsuccessful or abusive submissions: the Worker does not create a contact email. Technical security records are kept only for the shortest period supported by the applicable service and reasonably needed to investigate abuse or availability incidents.
Provider delivery and security records: retained according to the configured account settings and contractual service periods, then deleted or anonymised unless legally required.
Legal and accounting records: retained for the period required by applicable law.

We periodically review retained information. When it is no longer needed, we delete it or anonymise it.

8. Your data-protection rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You can withdraw your consent to marketing emails free of charge with the unsubscribe link in every one of them or by writing to hello@easyiga.com, and you may object at any time to the use of your data for direct marketing (GDPR Art. 21(2)). Either way we stop sending you marketing emails. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not use the website forms for such decisions.

Send a request to hello@easyiga.com. We may request proportionate information to verify identity and protect your data. For an access request we locate your records in our CRM and our mailbox by your email address and provide a copy of the personal data they hold; for an erasure request we erase the personal data in those records and keep a note that the request was fulfilled. We normally respond within one month; the GDPR permits an extension in complex cases, and we will explain if that applies.

You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, or with another competent supervisory authority, particularly in the EEA country where you live or work.

9. Security

We use HTTPS, restrictive browser security headers, origin checks, input limits, a hidden honeypot, rate limiting, Turnstile server-side verification and restricted runtime secrets. The form Worker does not log submitted names, email addresses, messages, Turnstile tokens or secrets. Our CRM runs on a company-controlled server with named user accounts and role-based permissions, TLS, key-only administrative access, a firewall, automatic security updates and nightly encrypted backups to a separate provider; the website's form Worker writes to it through a restricted integration account whose key is held only in protected server-side secret stores. No internet transmission or storage system is completely risk-free; if you believe information sent through this site is at risk, contact us promptly.

10. Children, external links and policy changes

The website and easyIGA business offering are directed to organisations and professional users, not children. External sites operate under their own privacy notices. We update this policy when the site, providers or legal requirements change. Material changes will be identified by the date and version at the top of this page.

Version history

Version 2.4, 14 October 2026: added emails to our existing customers about our own products and services similar to those they bought, without a ticked box. This version describes the legal basis, how to refuse these emails and the limit of one year after the contract ends.
Version 2.3, 3 October 2026: the marketing emails are now described as the easyIGA newsletter, with news from IGA and IAM, changes in legislation, practical advice and news about easyIGA.
Version 2.2, 2 October 2026: added marketing emails, which we send only to people who tick a separate, optional box on the contact form. This version describes what we record about that consent, its legal basis, Resend as the sending service, how long the consent record is kept and how to withdraw it.
Version 2.1, 1 October 2026: added our self-hosted CRM as the place where enquiries are recorded, its hosting and backup providers, the optional introductory call booked through Microsoft Bookings, how the 24-month retention period is enforced, and how access and erasure requests are carried out.
Version 2.0, 6 September 2026: previous version.

Questions or requests?

Email hello@easyiga.com or use our contact form. Please do not send passwords, access tokens or production identity data.

Your privacy, explained clearly.