Privacy policy

1. Who we are

This policy explains how Gemifier d.o.o. (“Gemifier”, “we”, “us”), registered at {registered address}, handles personal data. You can reach us at business@gemifier.io, which is also our data protection contact.

2. The two roles we play

Gemifier is a business-to-business platform. We never have a direct relationship with the end users of our customers' products, and Gemifier does not communicate with end users by any channel. It matters which hat we are wearing:

• Processor, for the end-user data our customers send us. Our customers (operators, retailers and other consumer businesses) decide what events to send and why, and we process that data solely on their documented instructions, under our data processing agreement. If you are an end user, the company whose product you use is the controller of your data, and section 9 explains how to reach them.
• Controller, for the account data of our customers' own staff, and for visitors to this website. When someone creates an account, is invited to an organization, or contacts us through this site, we decide how that data is used.

3. What we hold as a processor

This is the part most reviewers care about, so it is stated precisely. An end-user record, the platform's term for one end user of a customer's product, whatever that industry calls them, contains:

• the customer's own identifier for that person, a string we store and match on but do not parse or interpret; if the customer chooses an identifying value such as an email address, we hold that value as-is (see the caveat below);
• an optional time zone identifier, used only to resolve calendar boundaries correctly;
• created and updated timestamps.

There is no field for a name, an email address, a phone number, a date of birth, an address, a payment instrument or an identity document. Alongside it we store the events the customer sends (when it occurred, and whatever typed properties the customer declared for it), the attributes the customer defines, and the points, progress and reward records derived from them. A property on an event may be a monetary amount, and a customer may record what a point is worth in a currency, but there is no currency conversion anywhere in the engine: a customer selling in several currencies normalises to one before sending the amount. Those are accounting figures a customer configures: no card data and no payment instrument is held anywhere in the platform.

We hold what a customer's systems send us and what its staff create in the dashboard: a points adjustment made by hand creates an end-user record if none existed, so the dashboard is itself a source of end-user records.

An important honest caveat. End-user attributes are defined by the customer and accept free text, and they are not the only free-text surface. A points adjustment made in the dashboard requires a typed reason, which is the only record of why it was made; a marketplace reversal records a reason the same way; an uploaded image keeps its original file name; and the identifier itself is chosen by the customer and may be an email address. Nothing in the platform prevents a customer from putting personal data into any of these. The accurate statement is that the schema has no personal data fields and requires none, not that personal data is technically impossible to send. Customers should treat all of them as part of their own data-minimisation review, and we say so in the data processing agreement and in the acceptable use policy.

Gemifier requires no access to the customer's databases, networks or infrastructure, and will not request it: we never receive credentials, a replica or a database export. The only inbound data is what a customer's backend posts to our APIs and what its staff enter in the dashboard.

4. What we hold as a controller

• Account data: name, work email address, hashed password, the organization and role assigned, and invitation records. Used to authenticate people and enforce permissions.
• Enquiry data: anything submitted through the contact form: typically name, work email, company, the topic you pick and your message. The form is not posted to our own servers: it goes to FormSubmit, a third-party relay, which forwards it to us by email and therefore receives everything you type, along with your IP address. If you would rather not use it, email sales@gemifier.io instead: the addresses on the contact page reach the same people.
• Chat data: whatever you type into the live chat window, your IP address, and the pages you viewed while it was open. The chat is provided by Tawk.to, and the widget is not requested at all unless you accept it on the cookie banner.
• Operational logs: request records containing the acting user, timing and any failure, retained for security and troubleshooting.

5. Lawful bases

• Contract: providing the service to our customers and their authorised users.
• Legitimate interests: securing the platform, preventing abuse, and responding to business enquiries, balanced against the rights of the people concerned.
• Consent: where you opt in to marketing, or accept analytics or live chat on this website, which you can withdraw at any time.
• Legal obligation: where we are required to retain or disclose information.

6. Retention

Data processed for a customer is retained for the life of that customer's environment. The platform applies no automatic retention period, purge or deletion schedule to end-user records or event history: setting one is the customer's decision. Deletion happens on termination, or on a customer's written instruction identifying an environment and an identifier, within {platform data deletion window} and on the terms of the data processing agreement.

Deletion on that instruction removes the records from the live system, and two limits on it are worth stating. Where a copy persists in an infrastructure backup held by a provider, it is not reached by that instruction and ages out on that provider's own cycle, {backup expiry period}; we make no promise that anything can be recovered from such a copy. And an uploaded image attached to a mission, streak or marketplace item has to be detached before it can be deleted, while copies already cached by intermediaries or browsers may persist after it is.

Account data is retained while the account is active and for {account data retention} afterwards. Enquiry data, including chat transcripts, is retained for {enquiry data retention}, and operational logs for {operational log retention}. FormSubmit holds its own copy of a contact form submission for 30 days and then deletes it, after which the only copy is the email in our inbox. Usage measurement, which records for each day which identifiers were active in an environment, is kept on a separate basis and for {billing record retention}, because it measures use of the service rather than progress in a mechanic.

Note that the platform is designed to deactivate rather than delete configuration objects, so that historical records keep a valid reference. That applies to configuration (missions, streaks, marketplace items), not to a request to erase a data subject's data, which is handled through the process in section 9.

7. Sub-processors

We use a small number of sub-processors for hosting and operational services. The current list, with the purpose and location of each, is the sub-processor list. Customers are notified of changes and may object as set out in the data processing agreement.

Three are worth naming here because they act on data from this website rather than from the platform. FormSubmit relays contact form submissions to us by email and Tawk.to provides the live chat window, both as described in section 4. Google Analytics counts visits, as described in section 14 and in the cookie policy. None of these has any access to the platform or to customer data held in it.

Our error-reporting provider is the exception, because it receives diagnostic data from the platform itself. Identifying data is switched off and query strings and credential headers are stripped, but an exception message can still carry a string a customer supplied. It holds reports under its own retention, {error report retention}.

8. International transfers

Gemifier is established outside the European Economic Area and the United Kingdom, at {registered address}, in a country with no European Commission adequacy decision. A customer sending us personal data is therefore making a restricted transfer, and we are the importer. Platform data is hosted in {hosting region} with {hosting provider}.

Transfers to us are made on the European Commission's Standard Contractual Clauses, module two, controller to processor, which the data processing agreement incorporates, with the United Kingdom addendum for transfers from the United Kingdom. Where personal data is transferred outside {hosting region}, we rely on {transfer mechanism, e.g. Standard Contractual Clauses} together with any supplementary measures required.

Our representative in the European Union under Article 27 is {EU representative}, and in the United Kingdom {UK representative}. The supervisory authority for our establishment is {supervisory authority}. You may also complain to the authority where you live or work.

9. Your rights

Depending on where you are, you may have rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to a supervisory authority.

• If you are an end user of a product that uses Gemifier, please contact that company. They hold your identity; we hold only their identifier for you, and we cannot identify you from it without their help. We support our customers in fulfilling these requests.
• If you are a customer user or a website visitor, contact business@gemifier.io and we will respond within the period required by applicable law.

10. Automated decisions, profiling and model training

The platform evaluates rules a customer configures and records the result. It does not make decisions about a person that produce legal effects or similarly significantly affect them: what follows from an evaluation is decided and carried out by the customer, in its own product. We do not profile end users for our own purposes, and nothing is inferred, enriched or bought from a data broker. We do not use customer data to train machine learning models: there is no artificial intelligence, machine learning or model training component anywhere in the platform.

11. Children

The platform receives no age, no date of birth and no field from which an age can be derived, so we cannot know whether an end user is a child. Where a customer's product is used by children, that customer is responsible for the lawful basis, for any parental consent its law requires, and for its own age-assurance obligations. A request about a child's data should go to that customer.

This website is intended for people acting for a business and is not directed at children. The minimum age for using it, and for holding a dashboard account, is {website minimum age}. That does not apply to a customer's end users, whom we do not contact.

12. Security

Each customer organization's data is held in an isolated database schema that is pinned on every connection. Machine access uses environment-scoped API keys stored only as a hash; human access uses signed access tokens with permissions read from the database on every check. No product feature exposes your data to us, and administrative access is controlled operationally. Traffic to our APIs and to the dashboard is served over an encrypted connection. That statement does not extend to a delivery destination a customer registers, because the platform accepts an unencrypted one; choosing an encrypted destination is the customer's responsibility.

A fuller description is on the security page. The controls we do not currently have are listed in the security annex to the data processing agreement, and several are answered plainly in the FAQ. We make no claim to any security certification.

13. Security incidents

Where we become aware of a personal data breach affecting data we process for a customer, we notify that customer without undue delay and in any event within {breach notification window} of becoming aware, on the terms of the data processing agreement and with the information available to us. The platform does not record who read a particular record, so what we can tell you is limited to what application logging shows. Where a breach affects data for which we are the controller, we notify {supervisory authority} and the people affected where the law requires it.

14. Cookies and this website

This site sets no advertising cookies. It keeps a theme preference and your cookie choice in your browser's local storage, and loads web fonts from a third party. Google Analytics and the Tawk.to chat window each set cookies, and neither is requested until you accept it on the banner. The contact form sends one further request, to FormSubmit, only at the moment you submit. Details, including how to opt out of the analytics, are in the cookie policy.

15. United States state privacy laws

We do not sell personal information, do not share it for cross-context behavioural advertising, and run no advertising, remarketing or session-recording technology on this website. Residents of states whose laws give them rights over personal information may exercise those rights through business@gemifier.io. For end-user data sent to us by a customer we act as a service provider or processor to that business, and a request should be made to it.

16. Changes

We will update this policy when our practices change, and will revise the “last updated” date above. Material changes affecting customers are notified in line with the data processing agreement.

17. Contact

Questions about this policy, and data protection contact: business@gemifier.io. Postal: {registered address}.