GDPR Compliance
Version 1.4 · Effective date: October 1, 2026 · Last updated: October 1, 2026
These commitments apply under the EU General Data Protection Regulation and, for customers in the United Kingdom, under the UK GDPR and the Data Protection Act 2018.
Our Commitments
Data processing principles at LiKE
Data Minimisation
We collect only the data necessary for the platform to function. No excessive data collection.
Purpose Limitation
Data is used strictly for the purposes defined in the Privacy Policy and the DPA (for business customers). No resale, no secondary use.
Storage Limitation
Data is retained no longer than necessary. Deletion upon contract termination is handled in accordance with the DPA terms.
Records kept as evidence that statutory rights were honoured — refund and withdrawal decisions, and the data used to determine your legal status — are retained for the periods set out in the Privacy Policy.
Integrity and Confidentiality
Encryption, access control, audit logging. We strive for a high level of protection for your data.
Roles and Responsibilities
Who is responsible for what
Lynkora — Data Processor
We process personal data on behalf of your organisation or you as an individual user, in accordance with the instructions and terms set out in the Data Processing Agreement.
Our responsibilities include:
- ✓ Ensuring data security
- ✓ Compliance with our applicable processor obligations under the GDPR (Art. 28)
- ✓ Supporting data subject rights
- ✓ Administrator action logging and internal access controls
Your Organisation — Data Controller
You determine the purposes, means and methods of processing personal data within LiKE. If you use LiKE as a private individual (personal workspace), these roles apply to you as the customer; for your account data, Lynkora acts as the controller (see the Privacy Policy).
Your responsibilities include:
- ✓ Defining processing purposes
- ✓ Notifying data subjects
- ✓ Managing consent
- ✓ Lawfulness of processing
Data Processing Agreement (DPA) — the DPA, including the Standard Contractual Clauses where applicable, forms part of the User Agreement and applies to your Organisation from the moment the User Agreement is accepted; no separate signature is required. The current version is published together with the other legal documents. DPA enquiries: [email protected].
Sub-processors
We engage vetted sub-processors (cloud infrastructure, AI providers, email delivery, web analytics — with your consent). The current list of sub-processors is available in the Privacy Policy and is updated whenever changes occur, with at least 30 days' notice before a new sub-processor is added. Notification terms regarding changes to sub-processors are defined in the DPA.
Business Transfer
If Lynkora transfers all or part of its business (merger, acquisition, reorganisation or sale), the Data Processing Agreement transfers with the contract and the successor assumes Lynkora's obligations as processor. We notify you at least 30 days in advance; if you do not accept the successor, you may terminate the contract and obtain deletion or return of your data as provided in the DPA.
Data Subject Rights
Support for GDPR data subject rights
Right of Access (Article 15)
Data subjects may request and obtain all information we hold about them.
Right to Rectification (Article 16)
Data subjects may correct inaccurate or incomplete personal data.
Right to Erasure (Article 17)
"Right to be forgotten" — deletion of all personal data subject to legal conditions.
Right to Restriction (Article 18)
Suspension of data processing pending dispute resolution without data deletion.
Right to Data Portability (Article 20)
Obtain data in a structured format and transfer it to another service.
Right to Object (Article 21)
Object to data processing, including marketing and profiling.
Rights Related to Automated Decision-Making (Article 22)
Where a decision is taken by automated means, data subjects may obtain human intervention, express their point of view and contest the outcome. See "Determining Your Legal Status" below.
Restrictions After Refunds
The number of counted refunds and the resulting restriction on new purchases are calculated automatically from an objective criterion: how many refunds of payments for a subscription, for an upgrade or for additional seats were made for that organisation on the customer's request. The calculation does not assess the person and does not use profiling. The restriction concerns new purchases only: access to the Service, the period already paid for, data export and rights under the law, including the right of withdrawal, are unaffected. Any such restriction is reviewed by a person on a request to support and may be lifted before the end of the period; the operator's decision is recorded together with its reason. For those reasons the calculation is not a decision based solely on automated processing within the meaning of Article 22 GDPR.
Determining Your Legal Status
How we decide which legal regime applies to your purchase
What We Determine
When you purchase a subscription, we determine whether you are contracting as a consumer or in the course of a trade, business, craft or profession. That determination decides which terms apply to you and how a refund or withdrawal request is handled.
What We Use
Your own declaration of purchase purpose, made at checkout; the business details you provide (legal name, VAT identification number and the result of validating that number against the EU VIES register); the country of the payment method as reported by the Merchant of Record; and the sign-up signals described in the Privacy Policy. Your declaration prevails — the remaining signals are advisory only.
Why This Is Not a Decision Under Article 22
The automated part of this process chooses only between handling a request automatically and referring it to a person. It cannot refuse a request, cannot remove a right and cannot block a purchase. Where the signals conflict or the result is unclear, the consumer regime applies until a person has reviewed the case. The processing therefore produces no legal effect and does not similarly significantly affect you within the meaning of Article 22(1) GDPR.
Safeguards We Provide in Any Event
You may request a human review of the regime applied to you, state your position and contest the outcome by writing to [email protected]. We record every determination together with the version of the rule applied and the time of the decision, and we will tell you on request which signals were used.
Retention
Contracting-party data and routing decisions are retained for the duration of the contract plus three years; refund and withdrawal decision records are retained for three years from the decision. Both serve as evidence that the correct legal regime was applied and that statutory rights were honoured (Article 17(3)(e) GDPR). The full retention table is in the Privacy Policy.
Technical Security Measures
GDPR Article 32 — Encryption, isolation, controls
Encryption
At rest: encrypted backups; hosting on secured OVHcloud EU infrastructure; measures described in the TOMs.
In transit: TLS 1.2+ for all transmissions (TLS 1.3 for modern clients); the internal application↔database link uses TLS 1.3.
Tenant Isolation
Logical isolation of tenant data at the application level: a mandatory workspace (tenant) filter in every data query, enforced by automated tests in CI.
Each tenant's data is logically isolated at the application layer: mandatory tenant-scoped filtering of all queries, with cross-tenant isolation tests in CI.
Access Control
RBAC (Role-Based Access Control) for granular permissions.
Email-and-password sign-in or Google (OAuth); SSO (OIDC) on eligible plans. One-time email codes for address verification and password reset.
Audit Logging
Key actions involving personal data are recorded with a timestamp and user identifier.
Access to logs is restricted; audit logs cannot be edited through application interfaces.
Data Export
Built-in export in Markdown, HTML, PDF, DOCX and JSON to facilitate the right to data portability.
Account and personal data copies are provided upon request.
Data Deletion
Complete deletion of tenant data upon contract termination or upon request.
Includes automatic deletion of backups after the retention period.
AI Search and GDPR
How we use data for AI features
Data Processing Principles for AI
Processing only within the tenant scope: AI search operates exclusively with your organisation's data, or your own data where you use the Service as an individual. There is no access to other clients' data.
NOT used for model training: Lynkora does not permit third-party AI providers to use customer data to train their models, except where separately disclosed to or agreed with the customer; providers' business data processing agreements apply (e.g., the OpenAI Business DPA). See the AI Supplementary Terms for details.
Restricting AI features: Administrators can restrict AI features by role (granular AI permissions); classic full-text search remains available.
Query logging: AI queries are logged with metadata (user, timestamp, query type) for audit purposes; personal data in logs is anonymized after 90 days.
Data Protection Impact Assessment (DPIA): We can assist you in conducting a DPIA to assess risks associated with AI use. Available on the Enterprise plan.
International Data Transfers
GDPR Chapter V — Cross-border data flows
Primary Data Centres in the EU
Core computing resources are located in the EU. Data remains within the EEA by default. Transfers outside the EEA occur only where appropriate legal mechanisms are in place.
Standard Contractual Clauses (SCCs)
Lynkora DOO Beograd is registered in Serbia (an EU candidate country without a GDPR adequacy decision). Transfers rely on the EU SCCs (Commission Implementing Decision (EU) 2021/914): Module 2 (Controller → Processor) for EU customer → Lynkora transfers; Module 3 (Processor → Processor) for onward transfers to US sub-processors (OpenAI, Resend). Customer data is physically stored in the EU (OVHcloud). As a Serbian legal entity, Lynkora also complies with the Serbian Law on Personal Data Protection (ZZPL).
EU-US Data Privacy Framework
For US-based sub-processors we primarily rely on EU SCCs Module 3. The EU-US Data Privacy Framework (in force since July 2023, replacing the invalidated Privacy Shield) applies as a supplementary mechanism where a sub-processor is certified under the DPF (e.g., Resend, Cloudflare).
Breach Notification
GDPR Articles 33, 34 — Incident response procedure
Incident Detection
Automated infrastructure monitoring and abuse protection (rate limiting, detection of anomalous request patterns).
Notifying You (without undue delay)
Upon confirming an incident affecting your data, we notify you without undue delay, specifying the nature of the breach, the data affected, potential consequences and the actions taken — so you can meet your own 72-hour obligation to the supervisory authority.
Your Notification to Data Subjects (when required)
As the Data Controller, you decide whether data subjects need to be notified. We provide support and materials to assist you.
Investigation and Report
Detailed investigation, forensic analysis, root cause identification, and prevention recommendations. A report is provided within a reasonable timeframe after the investigation is concluded.
Supervisory Authority Notification (if required)
If the incident requires notification to the supervisory authority (DPA), we assist in preparing the documentation and analysing the obligations involved.
Ready to Partner?
The Data Processing Agreement (including SCCs where applicable) is part of the User Agreement and applies from its acceptance; no separate signature is required. DPA enquiries: [email protected].
Data Protection Contact
Contacts for GDPR enquiries
Privacy Team
Email: [email protected]
Response time: on business days, typically within a few days
Registered Address
Lynkora DOO Beograd
Kneza Miloša 15, 11000 Beograd Serbia (company reg. no. MB 22195689, tax id PIB 115706177)
Representatives in the EU and the UK
Our representatives under Article 27 GDPR and Article 27 UK GDPR, where designated, are listed on the Representatives page (/legal/en/representatives).
Request procedure: You may submit a request for access, erasure, objection or any other GDPR right directly to [email protected]. We acknowledge receipt of your request and process it within the timeframes stipulated by GDPR Article 12.