Gultim, LLC ("Gultim", "we", "us") is the data controller for personal data processed through this website and in the course of our engineering services. Our registered office and full company details are published on the Imprint page and repeated in the footer of every page.

Questions about this policy, or any request relating to your personal data, should be sent to our privacy contact address listed at the end of this document. We answer substantive requests within one calendar month.

We do not ask for special-category data (health, beliefs, biometrics) and ask that you do not include it in free-text fields. We do not knowingly collect data from anyone under 16.

• Enquiries and project briefs that do not become engagements: 24 months from last contact.
• Client contract and delivery records: term of the contract plus 10 years, as required for Czech accounting and tax law.
• Candidate records: 24 months from last contact, or until the candidate asks us to remove them.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again.
• Website logs and analytics: 14 months maximum.

We share personal data only with processors who help us run the business — hosting and database infrastructure, email delivery, scheduling, document storage, accounting — and with professional advisers or authorities where the law requires it. Every processor is bound by a written data processing agreement, is instructed to process only on our documented instructions, and is reviewed before onboarding.

We never sell personal data, and we never pass candidate details to a client without that candidate's explicit agreement.

We work with clients and engineers across North America, the United Kingdom, Europe, the Middle East and Central Asia, so personal data may be transferred outside the European Economic Area. Where it is, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with a transfer risk assessment and technical safeguards such as encryption in transit and at rest.

• Encryption in transit (TLS) and at rest for all stored submissions.
• Role-based access, least privilege, and multi-factor authentication on administrative accounts.
• Row-level access policies on every database table holding personal data.
• Logged administrative access, with review of who reads enquiry and candidate records.
• Breach assessment procedure with notification to the supervisory authority within 72 hours where required.

Under the GDPR you have the following rights, free of charge:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion where we have no overriding lawful basis to keep it.
• Restriction — pausing processing while a dispute is resolved.
• Portability — a machine-readable export of data you provided to us.
• Objection — to processing based on our legitimate interests, including profiling.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Complain — to your national supervisory authority (in Czechia, the Úřad pro ochranu osobních údajů).

To exercise any of them, write to our privacy contact address. We may ask for proof of identity where a request concerns sensitive records.

Gultim is establishing a Canadian entity headquartered in British Columbia. Once that entity begins processing personal data, this section will set out our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA): the identified purposes for collection, the form of consent relied upon, the accountable privacy officer, access and correction procedures, and cross-border storage disclosures.

Until that entity is live, all processing described in this policy is carried out by Gultim, LLC in Czechia under the GDPR. Where the two regimes differ, we apply the stricter standard.

Privacy questions, data subject requests and complaints all go to the privacy address published below. If you are unsatisfied with our response, you may complain to your local supervisory authority.