GDPR Compliance
Version 1.3 · Effective date: July 9, 2026 · Last updated: July 9, 2026
Our Commitments
Data processing principles at LiKE
Data Minimisation
We collect only the data necessary for the platform to function. No excessive data collection.
Purpose Limitation
Data is used strictly for the purposes defined in the Privacy Policy and the DPA (for business customers). No resale, no secondary use.
Storage Limitation
Data is retained no longer than necessary. Deletion upon contract termination is handled in accordance with the DPA terms.
Integrity and Confidentiality
Encryption, access control, audit logging. We strive for a high level of protection for your data.
Roles and Responsibilities
Who is responsible for what
Lynkora — Data Processor
We process personal data on behalf of your organisation or you as an individual user, in accordance with the instructions and terms set out in the Data Processing Agreement.
Our responsibilities include:
- ✓ Ensuring data security
- ✓ Compliance with our applicable processor obligations under the GDPR (Art. 28)
- ✓ Supporting data subject rights
- ✓ Administrator action logging and internal access controls
Your Organisation — Data Controller
You determine the purposes, means and methods of processing personal data within LiKE. If you use LiKE as a private individual (personal workspace), these roles apply to you as the customer; for your account data, Lynkora acts as the controller (see the Privacy Policy).
Your responsibilities include:
- ✓ Defining processing purposes
- ✓ Notifying data subjects
- ✓ Managing consent
- ✓ Lawfulness of processing
Data Processing Agreement (DPA) — a standard DPA (including Standard Contractual Clauses where applicable) will be available before paid business onboarding and enterprise use. DPA enquiries: [email protected].
Sub-processors
We engage vetted sub-processors (cloud infrastructure, AI providers, email delivery, web analytics — with your consent). The current list of sub-processors is available in the Privacy Policy and is updated whenever changes occur, with at least 30 days' notice before a new sub-processor is added. Notification terms regarding changes to sub-processors are defined in the DPA.
Data Subject Rights
Support for GDPR data subject rights
Right of Access (Article 15)
Data subjects may request and obtain all information we hold about them.
Right to Rectification (Article 16)
Data subjects may correct inaccurate or incomplete personal data.
Right to Erasure (Article 17)
"Right to be forgotten" — deletion of all personal data subject to legal conditions.
Right to Restriction (Article 18)
Suspension of data processing pending dispute resolution without data deletion.
Right to Data Portability (Article 20)
Obtain data in a structured format and transfer it to another service.
Right to Object (Article 21)
Object to data processing, including marketing and profiling.
Technical Security Measures
GDPR Article 32 — Encryption, isolation, controls
Encryption
At rest: encrypted backups; hosting on secured OVHcloud EU infrastructure; measures described in the TOMs.
In transit: TLS 1.2+ for all transmissions (TLS 1.3 for modern clients); the internal application↔database link uses TLS 1.3.
Tenant Isolation
Logical isolation of tenant data at the application level: a mandatory workspace (tenant) filter in every data query, enforced by automated tests in CI.
Each tenant's data is logically isolated at the application layer: mandatory tenant-scoped filtering of all queries, with cross-tenant isolation tests in CI.
Access Control
RBAC (Role-Based Access Control) for granular permissions.
Email-and-password sign-in or Google (OAuth); SSO (OIDC) on eligible plans. One-time email codes for address verification and password reset.
Audit Logging
Key actions involving personal data are recorded with a timestamp and user identifier.
Access to logs is restricted; audit logs cannot be edited through application interfaces.
Data Export
Built-in export in Markdown, HTML, PDF, DOCX and JSON to facilitate the right to data portability.
Account and personal data copies are provided upon request.
Data Deletion
Complete deletion of tenant data upon contract termination or upon request.
Includes automatic deletion of backups after the retention period.
AI Search and GDPR
How we use data for AI features
Data Processing Principles for AI
Processing only within the tenant scope: AI search operates exclusively with your organisation's data, or your own data where you use the Service as an individual. There is no access to other clients' data.
NOT used for model training: Lynkora does not permit third-party AI providers to use customer data to train their models, except where separately disclosed to or agreed with the customer; providers' business data processing agreements apply (e.g., the OpenAI Business DPA). See the AI Supplementary Terms for details.
Restricting AI features: Administrators can restrict AI features by role (granular AI permissions); classic full-text search remains available.
Query logging: AI queries are logged with metadata (user, timestamp, query type) for audit purposes; personal data in logs is anonymized after 90 days.
Data Protection Impact Assessment (DPIA): We can assist you in conducting a DPIA to assess risks associated with AI use. Available on the Enterprise plan.
International Data Transfers
GDPR Chapter V — Cross-border data flows
Primary Data Centres in the EU
Core computing resources are located in the EU. Data remains within the EEA by default. Transfers outside the EEA occur only where appropriate legal mechanisms are in place.
Standard Contractual Clauses (SCCs)
Lynkora DOO Beograd is registered in Serbia (an EU candidate country without a GDPR adequacy decision). Transfers rely on the EU SCCs (Commission Implementing Decision (EU) 2021/914): Module 2 (Controller → Processor) for EU customer → Lynkora transfers; Module 3 (Processor → Processor) for onward transfers to US sub-processors (OpenAI, Resend). Customer data is physically stored in the EU (OVHcloud). As a Serbian legal entity, Lynkora also complies with the Serbian Law on Personal Data Protection (ZZPL).
EU-US Data Privacy Framework
For US-based sub-processors we primarily rely on EU SCCs Module 3. The EU-US Data Privacy Framework (in force since July 2023, replacing the invalidated Privacy Shield) applies as a supplementary mechanism where a sub-processor is certified under the DPF (e.g., Resend).
Breach Notification
GDPR Articles 33, 34 — Incident response procedure
Incident Detection
Automated infrastructure monitoring and abuse protection (rate limiting, detection of anomalous request patterns).
Notifying You (without undue delay)
Upon confirming an incident affecting your data, we notify you without undue delay, specifying the nature of the breach, the data affected, potential consequences and the actions taken — so you can meet your own 72-hour obligation to the supervisory authority.
Your Notification to Data Subjects (when required)
As the Data Controller, you decide whether data subjects need to be notified. We provide support and materials to assist you.
Investigation and Report
Detailed investigation, forensic analysis, root cause identification, and prevention recommendations. A report is provided within a reasonable timeframe after the investigation is concluded.
Supervisory Authority Notification (if required)
If the incident requires notification to the supervisory authority (DPA), we assist in preparing the documentation and analysing the obligations involved.
Ready to Partner?
A standard Data Processing Agreement (including SCCs where applicable) will be available before paid business onboarding. DPA enquiries: [email protected].
Data Protection Contact
Contacts for GDPR enquiries
Privacy Team
Email: [email protected]
Response time: on business days, typically within a few days
Registered Address
Lynkora DOO Beograd
Kneza Miloša 15, 11000 Beograd Serbia
Request procedure: You may submit a request for access, erasure, objection or any other GDPR right directly to [email protected]. We acknowledge receipt of your request and process it within the timeframes stipulated by GDPR Article 12.