Privacy Policy (GDPR)

The controller of personal data collected through the Site and in the course of our services is:

Controller

CaptureValue.ai EOOD / Ltd. („КепчърВелю.Ай“ ЕООД)

Registration number (UIC / EIK)

208895275

Registered office

13 George Washington Street, 1000 Sofia, Bulgaria

Represented by

Ahmed Malek Abdelkamel, Managing Director

Contact for data protection matters

contact@commodum.ai

No Data Protection Officer (DPO) has been appointed, as the company is not subject to that obligation under Article 37 GDPR. All requests relating to personal data can be sent to contact@commodum.ai.

We only collect the data needed for the purposes described below.

• Contact form data: first name, last name, business email address, company, role and the content of your message, together with the information about your scope (entity, headcount, sector) that you choose to share with us.
• Correspondence data: the information you provide when you write to us by email or exchange with us during calls and meetings.
• Technical data: IP address, browser type and version, pages visited, and date and time of access, as recorded in the server logs of our host for security purposes.
• HR data provided for a diagnostic: role titles, headcount, average salaries and organisational information. This data is anonymised and aggregated by the client before it is sent to us. We ask our clients never to send us data that identifies individual employees.

We do not collect special categories of data (health, political opinions, trade union membership, etc.) and do not knowingly process data relating to persons under the age of 18.

Each processing operation relies on one of the legal bases provided for in Article 6 GDPR.

Personal data is accessible only to the authorised staff of CaptureValue.ai EOOD, who are bound by a confidentiality obligation. It may be transmitted to the following processors, each acting on our instructions under a data processing agreement compliant with Article 28 GDPR:

Data may also be disclosed to administrative or judicial authorities where required by law. We never sell or rent personal data.

The Site and the data it collects are hosted in the European Union by default. Some of the providers listed above process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Article 46 GDPR), supplemented by additional safeguards where necessary.

You may obtain a copy of the safeguards in place by writing to contact@commodum.ai.

We keep personal data only for as long as necessary for the purposes for which it was collected.

• Encryption of data in transit (TLS) and at rest (AES-256) on our infrastructure.
• Hosting on European infrastructure; on-premise option available for diagnostic engagements.
• Access strictly limited to authorised staff on a need-to-know, least-privilege basis.
• Regular review of security measures and penetration tests.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you and the competent supervisory authority in accordance with Articles 33 and 34 GDPR.

Under the GDPR you have the following rights over your personal data:

• Right of access: obtain confirmation that your data is processed and a copy of it.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: have your data deleted where there is no longer a legal ground to keep it.
• Right to restriction of processing in the cases provided for in Article 18 GDPR.
• Right to data portability: receive the data you provided in a structured, machine-readable format.
• Right to object, at any time, to processing based on legitimate interest, including for direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to contact@commodum.ai or to CaptureValue.ai EOOD, 13 George Washington Street, 1000 Sofia, Bulgaria. We will reply within one month; this period may be extended by two months for complex requests, in which case we will inform you. We may ask you to prove your identity where there is reasonable doubt.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP — 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria — www.cpdp.bg), or with the supervisory authority of the Member State in which you live or work, such as the CNIL in France (www.cnil.fr) or the AEPD in Spain (www.aepd.es).

The diagnostics produced by Commodum are decision-support tools intended for the client's management. They analyse roles and organisations, not individuals, and produce no legal or similarly significant effect on any person. We take no decision concerning an individual solely by automated means within the meaning of Article 22 GDPR.

The Site places no analytics or advertising cookies. The only item stored on your device is your choice on the consent banner. Third-party services loaded by the Site (web fonts, images, contact form) are described in our Cookie Policy, together with the ways you can control them.

This policy may be updated to reflect changes to the Site, our services or the applicable regulations. The date of the last update appears at the top of this page. In the event of a substantial change, the users concerned will be informed by email or by a notice on the Site.

For any question about this policy or about the processing of your data:

• By email: contact@commodum.ai
• By post: CaptureValue.ai EOOD, 13 George Washington Street, 1000 Sofia, Bulgaria