This notice explains how Lemon SYNERGY s.r.o. processes the personal data of website visitors, prospective customers, customers, service participants and business contacts.
1. Controller and contact details
The controller is Lemon SYNERGY s.r.o., Company ID No. (IČO) 297 55 531, VAT ID No. (DIČ) CZ29755531, with its registered office at Spojovací 306/12, Vysočany, 190 00 Prague 9, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 451872.
For enquiries and the exercise of rights, please contact jana.kusnirova@lemonsynergy.com, telephone +420 608 349 116, data box ID k7y68m2.
No separate contact details for a data protection officer have been published for the scope of processing described; please contact the controller directly.
2. What data we process, why and for how long
| Situation | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Enquiry submitted via the form, by email or by telephone | name, work email address, organisation, selected type of issue, message content and subsequent correspondence | responding, assessing the enquiry and discussing the service | steps taken at the request of a natural person prior to entering into a contract; for a company's contact person, the legitimate interest in handling the enquiry and developing the business relationship | if no contract is concluded, no longer than 12 months from the last substantive communication; longer only in the event of a dispute or another legal obligation |
| Contract and provision of services | identification and contact details of the customer, participants and contact persons, order, performance and payments | entering into and performing the contract, organising training, consulting or coaching, invoicing and protecting legal claims | performance of a contract; legal obligation; for the customer's contact persons, the legitimate interest in performing the contract | for the duration of the contract and generally for 3 years after its termination due to legal claims; accounting and tax documents for the statutory retention periods, generally 5 or 10 years depending on the type of document |
| SAFe course, licence and certification | first name, surname, work email address and information about course attendance | purchasing a licence for the participant, verifying attendance, providing access to courseware and providing information about the course or certification | performance of a contract and the legitimate interest in properly documenting licensed attendance | for the duration of the relevant contract and thereafter in accordance with its terms; related contractual documents for as long as necessary to protect rights and comply with legal obligations |
| Website operation and security | IP address, date and time, request, user agent and operational or security logs | secure operation, diagnostics and prevention of misuse | the legitimate interest in maintaining a secure and functional website | for the period set by the hosting provider that is necessary for operation and security; in the event of a security incident, until it has been resolved and related claims have been protected |
| Direct marketing to existing customers | work email address and, where applicable, name, organisation and opt-out record | offering our own similar services | the existing-customer exemption under Section 7(3) of Act No. 480/2004 Coll. and legitimate interest | until an objection or opt-out; a minimal opt-out record is retained thereafter to prevent the contact from being reactivated |
When checked on 23 September 2026, the website did not use a newsletter form, analytics, advertising pixels or profiling. If we introduce any of these at a later date, we will update this notice before launch and, where required by law, obtain prior consent.
If we obtain data indirectly, typically from your employer, a colleague, an organiser or a publicly available professional source, it will usually comprise your name, role, organisation, work contact details and the context of the enquiry or performance. We will provide the source and specific circumstances upon request; we will fulfil the information obligation within the scope of Article 14 GDPR.
3. Recipients and services used
To the extent necessary, data may be processed by:
- Netlify, as the provider of hosting, CDN and the website's operational infrastructure;
- Google Workspace, as an email and office productivity service;
- H&M SERVICES INTERNATIONAL LTD (CliqSales), as the processor of website enquiries passed to the CliqSales AI CRM. The public DPA effective from 12 August 2026 forms part of the Terms and Conditions and applies to data concerning customers, contacts and other persons processed on the client's behalf. The CRM uses the infrastructure of HighLevel Inc. (GoHighLevel) in the United States; CliqSales publishes its current list of further sub-processors on its sub-processors page;
- Scaled Agile, Inc., when delivering a SAFe course, as an independent controller of participant data comprising first name, surname, work email address and attendance information. The purposes are the purchase/assignment of a courseware licence, verification of attendance and the provision of information about the course or certification. Under the Courseware License Agreement, the participant roster is uploaded within 10 days after the course;
- providers of accounting and tax services and professional advisers, where necessary for a contract, legal obligation or the protection of rights;
- public authorities, where disclosure is required by law.
The current application does not contain a separate forms database: once CRM routing is activated, it will pass a validated enquiry directly to CliqSales. The form requires a name, work email address, organisation, type of issue and description of the situation; the user is asked not to enter confidential, personal or security-sensitive information.
4. Transfers outside the European Economic Area
Netlify and Google are global providers, and the provision of their services may involve processing or remote access outside the EEA. Any such transfer must be covered by an applicable European Commission adequacy decision, including the EU–US framework for certified recipients, Standard Contractual Clauses or another safeguard under Chapter V GDPR. Information about the current safeguard and a copy of the relevant clauses may be requested using the controller's contact details.
Scaled Agile, Inc. is based in the United States. The Data Sharing Addendum effective from 14 September 2026 establishes a controller-to-controller relationship for the partner programme and, for limited transfers from the EEA where no other applicable mechanism is available, incorporates the European Commission's Standard Contractual Clauses (controller-to-controller module); the clauses are governed by Irish law and the Irish courts have jurisdiction. No special categories of data, data concerning children under 16, payment data or other data expressly excluded by the addendum are to be transferred through this data flow.
According to the public DPA, data in the CliqSales AI CRM is stored on the infrastructure of HighLevel Inc. in the United States. CliqSales identifies the EU–US Data Privacy Framework and Standard Contractual Clauses as safeguards; other US-based sub-processors are covered by the DPF and/or SCCs depending on the particular function. The current public list includes, in particular, HighLevel, Cloudflare, Twilio, Mailgun, SendGrid, OpenAI, Anthropic, Google, Stripe, Zoom and Fireflies.ai. Before production routing is activated, the controller will archive the current version of the Terms and Conditions/DPA and verify that the Lemon SYNERGY account actually uses the CliqSales AI CRM product and the corresponding sub-processor settings.
After the CliqSales contract ends, the DPA provides that, at the controller's option, CliqSales will return the data in CSV/JSON format or delete it and confirm deletion within 30 days; data in automated backups will be overwritten within no more than 90 days. Records required by law may be retained for the necessary period.
5. Requirement to provide data
We need the data marked as mandatory on the form in order to handle your enquiry. The form cannot be submitted without it. You provide any other data voluntarily. Do not enter special categories of personal data, access passwords or other sensitive information in the free-text field.
6. Automated decision-making
We do not carry out decision-making based solely on automated processing or profiling that would produce legal effects concerning you or similarly significantly affect you. The website form only checks the completeness and format of the input; it does not decide whether to accept a customer or offer a service.
7. Your rights
Subject to the conditions of the GDPR, you have the right to:
- obtain access to your data and a copy of it;
- have inaccurate data rectified and incomplete data completed;
- request erasure or restriction of processing;
- receive data in a machine-readable format and transmit it to another controller where the conditions for data portability are met;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal;
- object to processing based on a legitimate interest; you may object to direct marketing at any time;
- lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
You may exercise your rights using the contact details in Section 1. We may reasonably verify your identity before responding.
8. Cookies and changes
The current status of technologies on your device is described on the /cookies page. We will update this notice if the processing, suppliers or legal requirements change.
Effective upon publication of this version. Last reviewed: 23 September 2026.