Privacy Policy

Circula GmbH

This privacy policy describes the collection and use of personal data in connection with the use of our website https://www.circula.com/en ("Website") and our Circula App (“App”) in accordance with the requirements of the General Data Protection Regulation ("GDPR"). Processing activities that are not covered by this data protection declaration may be supplemented by further data protection declarations, which must be observed separately.

1.1 Responsible party

The responsible party within the meaning of the GDPR is

Circula GmbH ("Circula"/"we"/"us").
Oranienburger Str. 74,
10117
Berlin, Germany

1.2 Data Protection Officer

We have appointed an external data protection officer through Simpliant. Simpliant also advises us on the implementation and operation of our data protection management system. More information about Simpliant can be found at http://www.simpliant.eu.

You can reach our appointed data protection officer:

by mail at: Circula GmbH
- Data Protection Officer -
Oranienburger Str. 74,
10117
Berlin, Germany

or by e-mail at: [email protected]

1.3 Data subject rights and supervisory authority

You can exercise the following rights:

• Right to information about your data stored by us and its processing (Art. 15 GDPR),
• Right to correct incorrect personal data (Art. 16 GDPR),
• Right to have your data stored by us deleted (Art. 17 GDPR),
• Right to restriction of data processing if we are not yet allowed to delete your data due to legal obligations (Art. 18 GDPR),
• Right to portability of data if you have consented to data processing or have concluded a contract with us (Art. 20 GDPR),
• Right to object to the processing of your data by us (Art. 21 GDPR).

To exercise your rights, you can contact us by email at [email protected].

For identification purposes, we ask you to provide the following information:

• First and last name,
• e-mail address.

In individual cases, further information may be required for unique identification. The processing of your request and the identification of your person is based on Art. 6 para. 1 lit. c GDPR.

You may at any time pursuant to Art. 77 GDPR in conjunction with § 19 German Federal Data Protection Act (“BDSG”) to file a complaint with a supervisory authority, e.g., with the competent supervisory authority of the federal state in which you reside or with the authority responsible for us.

1.4 Processing of data, purpose, and legal basis

We process your personal data in accordance with the provisions of the GDPR and the BDSG.

The legal basis for all our processing activities is based on Art. 6 para. 1 GDPR.

We initially process personal data for the purpose of fulfilling contractual obligations or pre-contractual measures in accordance with Art. 6 para. 1 lit. b GDPR. This includes in particular:

• Provision of software
• Purchase of products and services
• Sending of a purchase confirmation
• Provision of Circula products

Furthermore, we use your data based on your consent pursuant to Art. 6 para. 1 lit. a GDPR for specific purposes, in particular:

• for sending newsletters with regular offers
• to receive special information and offers from Circula
• to support usage processes of the website
• for personalized use of the website and personalized offers
• for analytical purposes to optimize our offer for you.

Consent can be withdrawn at any time. The withdrawal of consent only takes effect for the future and does not affect the lawfulness of processing based on consent before its

withdrawal.

In some cases, our obligation to ask for your consent does not or not solely result from the GDPR but from the The Telecommunications Digital Services Data Protection Act (“TDDDG”) or the Act against Unfair Competition (“UWG”). We have taken into account the obligations arising from these laws without explicitly referring to them in the following.

In addition, we process your data to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR,

• for the assertion of legal claims including collection and defense in legal disputes,
• for purposes of compiling statistics to improve products and services,
• For contacting you, insofar as a permanent business relationship with you or your employer exists or is intended (business contacts).

In addition, we will process your data pursuant to Art. 6 para. 1 lit. c GDPR, insofar as we are legally obliged to do so, for example, in order to comply with our retention obligations under commercial or tax law.

1.5 Storage period

We take all reasonable steps to ensure that your personal data is only processed for the period required in each case according to the purpose of processing. If the storage period is not specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage ceases to apply. Personal data will not be deleted if storage is required by law (e.g., § 257 HGB, 147 AO). Furthermore, we may store your personal data until the expiry of the statutory limitation periods (usually 3 years; in individual cases, however, up to 10 years or longer), provided that this is necessary for the assertion, exercise, or defense of legal claims.

1.6 Data security

To protect the security of your data during transmission, we use technical and organizational security measures, in particular the encryption of our website to prevent unauthorized access by third parties. The encryption via HTTPS is enforced within the framework of an HSTS header. The data collected from you is generally hosted on ISO 27001 certified servers. Our security measures are continuously improved and adapted according to technological developments.

1.7 Transmission to service providers

We use service providers to offer our services. These service providers act only according to our instructions and are contractually obligated to comply with the provisions of Art. 28 GDPR. If not further specified below, service providers are contracted for the following services:

• fulfillment of our contractual obligations,
• maintenance of IT systems and related services,
• handling our customer service and managing inquiries,
• provision of the platform/app,
• measurement of website performance,
• delivery of products and processing of payments.

1.8 Data transfer to third countries

Unless otherwise stated below, your data will not be transferred to a third country outside the European Union (“EU”). Your personal data will only be transferred to third countries if the requirements of Art. 44 - 49 GDPR are met, in particular if standard contractual clauses, binding corporate rules or adequacy decisions of the European Commission are in place.

1.9 No obligation to provide data / No profiling

There is no legal or contractual obligation to provide us with data. However, some services can only be provided if you provide the required data. Your personal data will not be used for automated individual decision-making including profiling.

‍

Our website offers different areas with different functionalities for the visitor, which are described in more detail below.

2.1 Server protocols

Nature and purpose of data processing:

When you access our Website, information of a general nature is automatically collected. This information, known as server log files, includes:

• IP address,
• name of the access provider,
• browser type, browser software version and browser language,
• operating system,
• date and time of access,
• content of the access,
• amount of data transferred,
• access status (successful transmission/error),
• web page(s) to which the access was redirected,
• visited web pages.

Processing is performed for the following purposes:

• Ensuring a trouble-free connection to the Website,
• ensuring smooth use of our Website,
• evaluation of system security and stability.

Legal basis:

Processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in hosting the website and improving and monitoring the security, stability, and functionality of the website.

Recipient:

The recipient of the data is a technical service provider who is responsible for the operation (hosting) and maintenance of our Website. As a processor, the service provider is obliged to process the data only within the scope of our instructions.

Transfer to third countries:

The servers through which our website is offered are located in Frankfurt am Main, Germany. Under certain circumstances, however, usage data may occasionally be transferred to the United States of America (“USA”). The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. The data processing agreements with the service providers also contain standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

Server log files are deleted after 30 days at the latest.

2.2 Consent management

Nature and purpose of processing:

Our Website uses cookies - small text files - for various processing activities for which your consent is required. In order to obtain and save such consent, we use a so-called Consent Management Platform. As part of this, a cookie is set on your terminal device to register your selection/consent. For this purpose, we process your IP address, among other things. On our Website, you can make gradual privacy settings regarding these cookies.

Legal basis:

The processing is based on our legitimate interests in documenting compliance with the provisions of the GDPR regarding the obtaining of consent (Art. 6 para. 1 lit. f GDPR). The cookie may also be set without your consent in accordance with § 25 TDDDG, as consent management is an essential function.

You can find more information under the item "Cookies".

2.3 Newsletters

Nature and purpose of processing:

On our Website, we offer you the opportunity to sign up for an e-mail newsletter with news and updates regarding our branch, events, and our blog. For all the above purposes, we need to process your name and e-mail address. This data is processed in order to send you previously mentioned information.

In addition, we regularly send emails with news and product updates to our existing customers.

Legal basis:

The processing of your data in connection with your newsletter subscription is based on your consent (Art. 6 para. 1 lit. a GDPR).

The processing of your data in connection with the distribution of newsletters to our existing customers is based on Art. 6 para. 1 lit. f GDPR in conjunction with § 7 para. 3 UWG. We have a legitimate interest in maintaining existing customer relationships and in conducting targeted direct marketing to inform you about products, services, promotions, and news that may be relevant to you, and to further develop our services in a customer-oriented way.

Recipients:

The recipients of the data are technical service providers. As processors, the service providers are obliged to process the data only within the scope of our instructions.

Transfer to third countries:

Data is transferred to the USA. The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. The data processing agreements with the service providers also contain standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

We process your data until you unsubscribe from our newsletter, withdraw your consent, or request that we delete it.

Withdrawal of consent and objections to direct marketing from existing customers:

If you no longer wish to receive newsletters from us in the future, please use the "unsubscribe" link contained in each newsletter or send us an e-mail at [email protected].

2.4 Contact

Nature and purpose of processing:

In order to provide you with the best possible support in the context of using our offers, we offer you the possibility to contact our customer service in the form of a chat or contact form on the website or by e-mail. All communications addressed to us become support tickets. In this context, we process your name, e-mail address, if any, as well as contents of your request.

Legal basis:

The data is processed for the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR). It is also processed to protect our legitimate interests (Art. 6 para. 1 lit. f GDPR. We want to provide customers with a customer service available anywhere on the Website (in the form of chat or e-mail).

Recipients:

The recipients of the data are technical service providers. As processors, the service providers are obliged to process the data only within the scope of our instructions.

Transfer to third countries:

Data is transferred to the USA. The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. The data processing agreements with the service providers also contain standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

If there is no assignment to a user account, the data will be deleted within 12 months after data entry.

2.5 Online Learning Portal

Nature and purpose of processing:

You have the option to register with our online learning portal via the Website in order to complete online courses via Circula. For this, we need your name and e-mail address to provide you with the relevant materials and access to the course.

Legal basis:

The data is processed for the implementation of contractual measures (Art. 6 para. 1 lit. b GDPR, free user relationship of the online learning portal). It is also carried out to protect our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR in providing information regarding the implementation of our service. For this purpose, we require your name and e-mail address.

Recipients:

The recipient of the data is a technical service provider. As a processor, the service provider is obliged to process the data only within the scope of our instructions.

Transfer to third countries:

Data is transferred to Canada. For Canada, there is an adequate decision of the EU Commission regarding an adequate level of data protection.

Retention period:

Your data will be processed until the user account is deleted.

2.6 Website analysis

Nature and purpose of data processing:

This website uses cookie-based technologies to help us better understand how the website is used and how we can further optimize it for the benefit of performance and user experience. We do this by compiling reports about activity on the website that do not identify specific individuals. Analytics cookies process your IP address and data about usage behavior on our website (e.g., which pages were visited and which buttons were clicked) for this purpose.

Legal basis:

The processing is carried out with your consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can find more information under the item "Cookies".

2.7 Personalized advertising

Nature and purpose of data processing:

We use cookie-based technologies that help us deliver relevant and personalized advertising.

This enables us to determine the visitors to our online offering as the target group for the display of advertising (so-called "targeted advertising"). In addition, we can track the effectiveness of our online advertising by seeing whether users were redirected to our website after clicking on such advertising (so-called "conversion tracking"). We may also use service providers to identify users who have visited our website as potential customers and recipients of advertising (so-called "retargeting").

Legal basis:

The processing is carried out with your consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can find more information under the item "Cookies".

‍

Our Website uses so-called cookies. Cookies do not cause any damage to your device and do not contain viruses. Cookies serve to make our offer more user-friendly, effective, and secure. Cookies are small text files that are stored on your terminal device and in your browser.

Most of the cookies we use are so-called session cookies. These cookies are automatically deleted at the end of the session. Session cookies are used to assign successive page views to individual users accessing our Website at the same time. Other cookies are stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.

You can set your browser so that you are informed about the setting of cookies, decide on a case-by-case basis whether to accept them or exclude the acceptance of cookies for certain cases or in general, as well as activate the automatic deletion of cookies when closing the browser.

Google Chrome: https://support.google.com/accounts/answer/61416?hl=en

Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox

Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Opera: https://www.opera.com/help

We would like to point out that the use and especially the comfort of use may be limited without the use of cookies. The cookies are set via a consent management tool. The settings can be defined here.

The right to set cookies is not measured solely according to the GDPR, but primarily according to § 25 TDDDG. The standard distinguishes between cookies that are absolutely necessary for the operation of the online offer (essential) and those that are not. Essential cookies may be set up even without consent, but non-essential cookies always require consent - even if this is not required under the GDPR (e.g., if there is a legitimate interest as a legal basis or the data is not personal).

Before we store non-essential cookies on your terminal device, we ask you for your consent in accordance with the requirements of § 25 TDDDG.

‍

We maintain publicly accessible profiles on social networks. The social networks used by us in detail can be found below.

By visiting our social media presence, numerous data protection-relevant processing operations are triggered.

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside the respective social media presence. Provided you have an account with the respective social network, the interest-based advertising may be displayed on all devices on which you are or were logged in.

Please also note that we cannot track all processing on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis:

Our social media presence is intended to ensure the most comprehensive presence possible on the Internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which are to be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6 para. 1 lit. a GDPR).

Responsible party and assertion of rights:

If you visit one of our social media sites (e.g. Facebook), the social media operator and us are jointly Controllers tregarding the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. against Facebook).

Please note that despite the joint controllership with the social media operators, we do not have full influence on the data processingsof the social media operators. Our options are largely determined by the corporate policy of the respective operator.

Retention period:

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory legal provisions - in particular, retention periods - remain unaffected.

We have no influence on the storage period of your data, which is stored by the social networks operators for their own purposes. For details, please contact the social networks operators directly.

4.1.1 Facebook

We have a company profile on Facebook. We have concluded a joint controller agreement with Facebook for the processing of data (“Controller Addendum”). The Controller Addendumspecifies the data processing operations for which we or Facebook are responsible when you visit our Facebook fan page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum

4.1.2 LinkedIn

We have a company profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For details on how they handle your personal data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

4.1.3 Instagram

We have a business profile on Instagram. The provider is Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA, which in turn belongs to Facebook. For details on their handling of your personal data, please refer to Instagram's privacy policy: https://help.instagram.com/519522125107875

4.1.4 X (formerly Twitter)

We have a company profile on X. The provider is X Corp. San Francisco, USA. For details on how they handle your personal data, please refer to Twitter's privacy policy: https://twitter.com/de/privacy

4.1.5 Crunchbase

We have a company profile on Crunchbase. The provider is Crunchbase, 564 Market Street, Suite 700, San Francisco, CA 94104, USA. For details on their handling of your personal data, please refer to Crunchbase's privacy policy: https://about.crunchbase.com/terms-of-service/privacy-policy/

4.1.6 Xing

We have a company profile on Xing. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. For details on their handling of your personal data, please refer to the privacy policy of LinkedIn: https://privacy.xing.com/de/datenschutzerklaerung

4.1.7 YouTube

We have a company profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy for YouTube can be found at the following link: https://policies.google.com/privacy

4.1.8 Google My Business

We have a company profile on Google My Business. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy for YouTube can be found at the following link: https://policies.google.com/privacy

‍

Circula's App is distributed exclusively to companies. In the majority of data processings, Circula acts as a processor for the companies. These processings on behalf of companies are governed by data processing agreements between Circula and its customers as data controllers, who in turn are obliged to inform data subjects about the data processing.

However, the following processing activities are carried out by Circula as controller.

5.1 Admin account

Nature and purpose of the processing:

To enable the use of our app and the service processing, it is necessary to provide a so-called admin account. This is used to map all settings for the organization of our customers. As part of the provision of this account, name, company, e-mail address and usage data, as well as log files are processed.

Legal basis:

The processing is carried out in the context of the performance of the contract for the use of the App (Art. 6 para. 1 lit. b GDPR).

Recipients:

Recipient of the data is a service provider who operates a high-security data center in Frankfurt/Main. As a processor, the service provider is obliged to process the data only within the scope of our instructions.

Further recipients are Omni Analytics Inc. (“Omni”) and Metabase, Inc. (“Metabase”).

Transfer to third countries:

The data is transferred to Omni and Metabase in the USA. With regard to Omni, the data transfer is based on an adequacy decision by the EU Commission based on the Data Privacy Framework. Omni is certified under the Data Privacy Framework. In addition, the data processing agreements with Omni and Metabase contain standard contractual clauses approved by the EU Commission and appropriate safeguards for compliance with data protection obligations.

Retention period:

The personal data will be stored as long as your account exists. If necessary, we are obliged to process individual data longer due to legal retention periods (esp. tax obligations).

5.2 Service accounting and license management

Nature and purpose of the processing:

In order to process your order and payment, your data provided during the ordering process (name, address, account number, bank routing number, credit card number if applicable, invoice amount, currency, and transaction number) will be processed. In addition, we use a unique identification number (“UUID”) to be able to track whether the use of our software is through a valid license.

Legal basis:

The processing of your data is carried out according to Art. 6 para. 1 lit. b GDPR.

Recipients:

We transfer your payment data to the commissioned credit institution as part of the payment processing, insofar as this is necessary for the payment processing. Further recipients of the data are payment and invoice service providers such as Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”) and Chargebee, Inc., 909 Rose Avenue, Suite 610, North Bethesda, MD 20852, USA (“Chargebee”). As processors, Stripe and Chargebee are obliged to process the data only within the scope of our instructions.

Transfer to third countries:

Data is transferred to Chargebee, located in the USA. The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. Chargebee is certified under the Data Privacy Framework. Apart from that, the data processing agreement with Chargebee also contains standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

Personal data will be stored for as long as your user account exists or for as long as is necessary to pursue existing claims. We may be obliged to process individual data for longer periods due to statutory retention periods (in particular due to tax obligations).

5.3 Web app error correction (error tracking)

Nature and purpose of the processing:

We process personal data to ensure and improve the technical stability of our service, such as by monitoring system stability and identifying code errors. The processing is solely for these purposes and does not evaluate data for advertising purposes.

Legal basis:

Your data is processed pursuant to Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in the technical stability of our service.

Recipient:

The recipient of the data is Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (“Sentry”). As a processor, Sentry is obliged to process the data only within the scope of our instructions.

Transfer to third countries:

Data is transferred to Sentry, located in the USA. The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. Sentry is certified under the Data Privacy Framework. Apart from that, the data processing agreement with Sentry also contains standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

Your data is deleted after 90 days.

5.4 App analysis

Nature and purpose of the processing:

Our App uses cookie-based technologies to help us better understand how our App is used. We do this by compiling reports about activity in the App that do not identify specific individuals. Analytics cookies transmit your IP address and usage behavior data to a service provider for this purpose.

Legal basis:

The processing is carried out with your consent according to Art. 6 para. 1 lit. a GDPR.

You can find more information under the item "Cookies".

5.5 Customer service

Nature and purpose of the processing:

In order to provide you with the best possible support when using our service, we offer you the possibility to contact our customer service via chat on the Website or by e-mail. All communications directed to us become support tickets. In this context, we process your name, e-mail address, if any, as well as contents of your request.

Legal basis:

The data is processed for the fulfillment of contractual measures (Art. 6 para. 1 lit. b GDPR). It is also carried out to protect our legitimate interests, Art. 6 para. 1 lit. f GDPR. We want to provide our customers with straightforward and efficient customer service.

Recipient:

The recipient of the data is Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen's Green, Dublin 2, Ireland (“Intercom”). As a processor, Intercom is obliged to process the data only within the scope of our instructions.

Retention period:

To provide the best support possible, we process your data during the existing relationship.

5.6 Product Updates

Nature and purpose of the processing:

Depending on the feature usage and user activity of our registered customers, we offer regular product updates to improve the user experience. In this context, we process your name, user role, locale, app language, products in use and e-mail address to be able to compose relevant, specific, and localized content.

Legal basis:

We process your personal data pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in providing certain groups of our existing customers with relevant product news.

Recipients:

We use the services of Intercom and HubSpot, Inc, Two Canal Park, Cambridge, MA 02141, USA (“HubSpot”). As a processor, Intercom and HubSpot are obliged to process the data only in accordance with our instructions.

Transfer to third countries:

Data is transferred to HubSpot, located in the USA. The transfer is based on an adequacy decision by the EU Commission on the basis of the Data Privacy Framework. Hubspot is certified under the Data Privacy Framework. Apart from that, the data processing agreement with Hubspot also contains standard contractual clauses approved by the EU Commission and appropriate guarantees for compliance with data protection obligations.

Retention period:

We process your data for as long as you are registered as a user with us unless you unsubscribe from the product update mailing list beforehand.

5.7 Credit cards

Nature and purpose of the processing:

Circula provides its customers with credit card management software. Pliant GmbH, Saarbrücker Str. 36, 10405 Berlin, Germany (hereinafter "Pliant") is a cooperation partner of Circula that offers an online platform for connecting physical and virtual credit cards, which includes various functions. In cooperation with Pliant, Circula either offers a Circula Pliant credit card or a Pliant Credit Card to its customers. Pliant and Circula process data under joint controllership within the meaning of Art. 26 GDPR and, in this regard, have established agreements to comply with data protection obligations; we will provide you with the essential content upon request. Further information on the data processed via the partner application can be found in the partner's privacy policy. If you have any questions regarding the protection of data subject rights, you can contact us (including by e-mail to [email protected]) as well as the respective partner.

The issuer of the credit card is Pliant Oy, which issues corporate credit cards under a license from VISA Europe Limited. The privacy policy can be found here, the terms and conditions here and the attachment here. Pliant Oy, Kaisaniemenkatu 4, c/o Spacent, 8. kerros, 00100 Helsinki, Finland, is an e-money institution, authorized and regulated by the Finnish Financial Supervisory Authority (FIN-FSA) under the business ID 3266913-9.

Legal basis:

The data is processed for the fulfillment of contractual measures (Art. 6 para. 1 lit. b GDPR).

Recipients:

Personal data will be transferred to Pliant. Pliant, as a joint controller, is legally and contractually obligated to adequately protect your personal data. Information on further data recipients and on the processing of personal data in connection with the Pliant platform can be found here.

Retention period:

We delete personal data when it is no longer required for the aforementioned processing purposes and no legal retention periods prevent deletion.

5.8 Session recordings and behavioral analyses

Type and purpose of data processing:

To optimize the functionality of the App and user experience, we use session recording tools. These tools create anonymized reconstructions of user interactions (e.g., clicks, scrolls, navigation paths) to identify usability improvements. Sensitive data (e.g., passwords, payment details) is masked at the source and never transmitted.

Categories of data processed:

• Anonymized interaction sequences (e.g. screen transitions, button clicks),
• Technical metadata (e.g. device type, operating system, browser version),
• Screen recording sessions (anonymized recording of user interactions when using the service).

Legal basis:

Processing is carried out exclusively on the basis of your express consent (Art. 6 para. 1 lit. a GDPR). Consent can be given and withdrawn at any time via the app settings.

Recipient:

The data is processed by PostHog, Inc., 2261 Market Street, Suite 4008, San Francisco, CA 94114, USA (“PostHog”) under a data processing agreement in accordance with Art. 28 GDPR.

Transfer to third countries:

Although PostHog is a US company, all data for EU users is hosted on AWS servers in Germany.

In the event that data is nevertheless transferred to the USA, PostHog has certified itself under the Data Privacy Framework. In addition, the data processing agreement with PostHog contains standard contractual clauses approved by the EU Commission and adequate safeguards for compliance with data protection obligations.

Retention period:

Records are retained for 3 months and then automatically deleted. Longer retention only applies to irreversibly anonymized data used for aggregated statistical analyses.

Revocation of consent:

You can retroactively deactivate session recording in the app settings. Withdrawing your consent will not affect the legality of the processing prior to the withdrawal. To request the deletion of existing data, please contact us.

‍

Circula offers the possibility for customers to integrate Circula's app with other services. This is not a processing as a Controller of Circula, but a transfer from one Processor (Circula) to another Processor (Integrated Service) on the instruction of the responsible customer.

An overview of integrations can be found here: https://www.circula.com/en/product/integrations

‍

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements and Circula’s current services.

Last update: March 2026

‍