Privacy Policy
and Personal Data Processing

I. Data Controller

1. The controller of your personal data is:
   Charlie Lounge Group LTD
   Registered office: Office Q, 35 Astbury Road, London, SE15 2NL, United Kingdom
   Company number: 15318801
2. Controller's contact details:
   • email: [email protected]
   • web: https://charlielounge.io
3. The controller has not appointed a Data Protection Officer unless stated otherwise.

II. What Data We Process About You

The scope of processed data depends on how you use our platform. Typically, this involves the following categories of data:

1. Identification data
   • name and surname,
   • company name, ID number, VAT number,
   • billing and possibly delivery address.
2. Contact data
   • email address,
   • phone number,
   • links to your websites or social media profiles, if you provide them to us yourself.
3. Data related to user account and membership
   • login email,
   • information about membership type (Explorer, Creator, Visionary),
   • information about payments made and order history,
   • account settings in the platform, preferences.
4. Data for setting up GPT agent and services
   • answers from onboarding forms,
   • information about your business, target audience, and offers,
   • texts, materials, and other content you voluntarily provide to us for setting up the GPT agent, webchat, reputation management, or social media pack.
5. Technical and logging data
   • IP address,
   • device and browser type,
   • approximate location derived from IP address,
   • platform access logs (login time, account changes, etc.).
6. Communication data
   • content of emails, messages in support or community,
   • records of when and how we responded to your inquiries.

III. Purpose and Legal Basis for Processing

We process your personal data only to the extent necessary for specific purposes and always based on one of the legal grounds under GDPR:

1. Performance of contract and pre-contractual measures
   • processing membership orders,
   • maintaining a user account,
   • ensuring access to the platform and its functions,
   • setting up the GPT agent and providing agreed services (e.g., Visionary setup).
   Without this data, we could not provide the services to you.
2. Compliance with legal obligations
   • bookkeeping and tax records,
   • archiving accounting documents,
   • fulfilling obligations towards public authorities.
   In this case, we rely mainly on obligations arising from accounting and tax regulations.
3. Legitimate interest of the controller
   • improving and protecting the platform (security, prevention of account misuse),
   • basic analysis of usage of individual functions,
   • direct marketing to existing customers in the form of commercial communications (e.g., emails about platform news, tips, and service updates).
   In these cases, we consider whether our interest outweighs your rights and freedoms. If you do not wish to receive commercial communications, you can unsubscribe at any time.
4. Consent to personal data processing
   • sending marketing communication if you are not our customer,
   • using selected data for potential references or case studies (e.g., using your logo with consent),
   • using certain cookies for marketing and personalization.
   Consent is always voluntary and you can withdraw it at any time without affecting the provision of basic platform services.

IV. Cookies and Online Technologies

1. On our website and in the platform, we use cookies and similar technologies that help us ensure functionality, security, and basic usage statistics.
2. We generally distinguish these types of cookies:
   • technical and functional cookies (necessary for login, remembering your settings, etc.),
   • analytical cookies (help us understand how users use the platform so we can improve it),
   • marketing cookies (we use these only based on your consent if we want to show you relevant offers).
3. Upon your first visit to our website, you have the option to choose which categories of cookies you agree to. You can change this setting at any time in your browser or via the cookie bar, if available.
4. More detailed information about the use of cookies may be provided in a separate "Cookie Policy" document if the Provider decides to publish one.

V. Data Retention Period

1. We retain personal data only for the time necessary to fulfill the given purpose or for the period required by legal regulations.
2. Indicatively, the following retention periods apply:
   • data related to the contractual relationship for the duration of the contract and subsequently for up to 10 years after its termination (mainly due to accounting and tax regulations),
   • data for direct marketing to existing customers for the duration of the contractual relationship and a reasonable period after its termination,
   • data from support and communication for 3 years from resolving the inquiry, unless there is a reason to keep it longer (e.g., as part of defense against legal claims),
   • data processed based on consent until the consent is withdrawn or until the period for which consent was granted expires.
3. After the retention period expires, we either securely anonymize or delete your data.

VI. Recipients of Personal Data and Transfer to Third Countries

1. We may transfer your data only to entities that help us provide services and are in the position of personal data processors. We have a data processing agreement concluded with each such processor.
2. Typical recipients are:
   • hosting and cloud service providers,
   • payment gateway and billing system providers,
   • email and communication tool providers,
   • possibly external collaborators participating in service setup (e.g., consultants or developers).
3. Some of these recipients may be based outside the European Union, typically in the USA. In such cases, we ensure that the transfer takes place only while ensuring an adequate level of protection (e.g., based on an adequacy decision or standard contractual clauses).

VII. Your Rights Regarding Personal Data Processing

In accordance with GDPR, you have the following rights regarding personal data processing:

1. Right of access
   You have the right to obtain confirmation as to whether we process personal data about you, and if so, to obtain a copy of this data and information about its processing.
2. Right to rectification
   If you find that the data we hold about you is inaccurate or incomplete, you have the right to request its correction or completion.
3. Right to erasure ("right to be forgotten")
   In certain cases, you have the right to request that we delete your personal data, especially if it is no longer needed for the given purpose or if you withdraw consent. However, we always consider legal obligations to retain certain data.
4. Right to restriction of processing
   You can request that we temporarily restrict the processing of your data, for example, if you contest its accuracy or object to processing.
5. Right to data portability
   In cases where processing is carried out automatically and based on consent or contract, you can request the transfer of your data in a structured, machine-readable format to another controller.
6. Right to object
   If we process your data based on legitimate interest (e.g., direct marketing), you can object to such processing at any time. In the case of an objection to marketing, we will no longer process your data for this purpose.
7. Right to lodge a complaint with a supervisory authority
   If you believe that your rights are being violated, you have the right to lodge a complaint with a supervisory authority. In the Czech Republic, this authority is the Office for Personal Data Protection (www.uoou.cz).

VIII. How You Can Exercise Your Rights

1. You can exercise your requirements regarding personal data protection via:
   • email to [email protected],
   • or by mail to the controller's registered office address listed above.
2. In the request, please state your identification details and, if possible, which right your request concerns. If you are unsure, we will be happy to help you formulate the request.
3. We respond to your requests without undue delay, no later than 1 month from their receipt. In more complex cases, the period may be extended, of which we will always inform you.

IX. Personal Data Security

1. To protect your personal data, we adopt technical and organizational measures corresponding to the risks that may arise during its processing.
2. Access to personal data is restricted to authorized persons who are bound by confidentiality and are instructed on personal data protection rules.
3. Although we try to protect your data as much as possible, no method of data transmission over the internet or electronic storage can be 100% secure. Therefore, we always recommend using strong passwords, protecting access to your device, and not sharing your access credentials with anyone.

X. Changes to Privacy Policy

1. We may update this Privacy Policy from time to time, especially due to changes in the scope of services provided or legal regulations.
2. We will inform you about significant changes via email or a notification in the platform.
3. The current version of the policy is always available on our website. We recommend that you review it continuously.

XI. Contact Details

If you have any questions about this Privacy Policy, you can contact us at: