Privacy Policy

We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our websites, services, and applications (the "Services").

1. Information we collect

Personal information: Includes data such as your name, email address, phone number, company name, address, and payment details.
Usage data: Includes data related to your interactions with our Services, such as IP address, browser type, and pages visited.
Billing and business information: If you use our document template feature, we may collect your billing details, including company name, legal address, tax identification number, and payment details necessary for processing transactions.

2. Our role: controller or processor

For the personal data described in Section 1 above — your own account, billing, and usage information — Configo acts as the data controller and determines the purposes and means of processing.
When you use the Configo Widget on your own website, your website's visitors may submit personal data (such as name, phone number, email, and address) directly into the Widget, as described in the Widget Terms. In that case, Configo acts only as a data processor, storing that data and making it available to you, the User, who determines why it is collected and remains the data controller responsible for it. You are responsible for maintaining your own privacy notice for your website's visitors and for ensuring you have a valid legal basis to collect their data.
The Widget Terms serve as the operative data processing terms between you and Configo for this purpose. If your organization requires a separate Data Processing Agreement, please contact us at [email protected].

3. How we use your information and legal bases

We process your personal data only when we have a valid legal basis under the GDPR. Your information is used for the following purposes:

Providing and improving the Services: Necessary for the performance of our contract with you (Art. 6 (1)(b) GDPR).
Communicating with you: Necessary for the performance of our contract with you regarding updates or account management (Art. 6 (1)(b) GDPR).
Analyzing usage patterns: Based on our legitimate interest to improve our service performance and user experience (Art. 6 (1)(f) GDPR), or your consent where required.
Ensuring security and integrity: Based on our legitimate interest to detect and prevent fraud, unauthorized access, and malicious activity (Art. 6 (1)(f) GDPR).
Facilitating document generation and payment processing: Necessary for the performance of our contract with you (Art. 6 (1)(b) GDPR) and to comply with legal tax/accounting obligations (Art. 6 (1)(c) GDPR).

4. Cookies

We use cookies and similar technologies to enhance your experience and improve our Services. For detailed information about the types of cookies we use, how we obtain your prior consent, and how you can manage them, please see our Cookies Policy.

We do not sell or rent your personal data to third parties. However, we may share information with trusted third-party service providers for operational purposes, such as hosting, payment processing, security, or analytics. These providers act as data processors and are bound by strict contractual obligations (Data Processing Agreements).
We use Cloudflare, Inc. to provide security, DNS resolution, and content delivery network (CDN) services. Certain technical data (such as your IP address, request information, and device/browser details) may be processed by Cloudflare in order to ensure availability, performance, and protection against malicious activity. Cloudflare acts as our data processor and processes this data strictly on our behalf and in accordance with our instructions. For more information, please see Cloudflare’s Privacy Policy.
For processing payments and generating documents, we may share necessary billing details with trusted payment service providers.
Support tickets: When you submit a support ticket, its content (subject, message text, your name and email, and any attachments) is relayed to our support team via a private Telegram group, using Telegram's messaging infrastructure. Telegram acts as our data processor for this purpose. For more information, please see Telegram's Privacy Policy.
We may also disclose your information when required by law or to protect our rights or the safety of others.

6. Data security

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access, loss, or disclosure. However, no data transmission over the internet is completely secure, and we cannot guarantee the absolute security of your information.
Our security infrastructure is supported by Cloudflare’s protective services (including DDoS mitigation, firewall, and encrypted DNS), which help safeguard your data while using our Services.

7. International data transfers

Where Cloudflare services or other third-party providers involve transfers of personal data outside the European Economic Area (EEA), such transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission and/or the provider's participation in the EU–US Data Privacy Framework. Cloudflare does not sell personal data and only retains logs for a limited period necessary to provide security and service functionality.

8. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for as long as your account remains active.
Inactive accounts: This applies uniformly to all accounts, including project owners and active subscribers. If you do not log in to your account for 12 consecutive months, we will email you a notice at your account address. If you do not log in within 90 days of that notice, we permanently erase your personal information (name, email, phone number, address, and similar identifiers) and revoke access to the account. Projects and business records associated with the account are not deleted by this process, only the personal information identifying you as their owner — the project itself, and any other members' access to it, is unaffected.
Where records must be retained to comply with statutory legal, tax, or accounting obligations, we retain them for the period required by the applicable jurisdiction (typically 5 to 10 years), independently of the account inactivity process described above.

If you are located in the European Union or European Economic Area (EEA), you have the following rights under the GDPR regarding your personal data:

Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can update most of your personal information directly from your Account Settings, or request that we correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten"): You can erase your personal data at any time from your Account Settings, or request that we do so under certain conditions.
Right to restriction of processing: You can request that we limit how we process your data.
Right to data portability: You can download a machine-readable export of your personal data directly from your Account Settings, or request a transfer of your data to another organization.
Right to object: You can object to the processing of your data based on legitimate interests or for direct marketing.
Right to withdraw consent: If we process data based on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. You also have the right to lodge a complaint with a Data Protection Authority (DPA) in the EU if you believe our processing violates the GDPR.

10. Children's privacy

Our Services are not intended for children under 16, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we will notify you of significant changes by email or through our Services.

12. Contact us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at E-Mail: [email protected]