Privacy notice

1. Who is responsible

The controller for this processing is JCerme Software Solutions LLC, [REGISTERED ADDRESS], United States. You can reach us at contact@jcerme.com for any privacy question or to exercise your rights.

As we are established outside the EU and offer services to people in the EU, our representative under Art. 27 GDPR is [EU REPRESENTATIVE, Art. 27 GDPR, TO BE APPOINTED]. For visitors from Switzerland, our contact point under the revDSG is [SWISS REPRESENTATIVE, Art. 14 revDSG, IF REQUIRED].

2. What we collect and why

We only collect what the application actually needs. Nothing on this page is mandatory: you can read the whole page without submitting anything and without allowing any optional cookies.

Application data

Your name, business name, email address, phone number, role, company size, current process and approximate annual value. Used to assess whether we can help and to prepare your call. Legal basis: your consent, Art. 6(1)(a) GDPR, and performance of the requested service, Art. 6(1)(b).

Consent record

The exact wording you agreed to, the time you agreed, the version of that wording, and a shortened form of your IP address (last block removed). Kept as proof that consent was given, as required by Art. 7(1) GDPR. Legal basis: our legal obligation and legitimate interest in demonstrating compliance, Art. 6(1)(c) and (f).

Booking data

The date and time you pick, plus the name and email passed to the scheduling tool. Legal basis: performance of the requested service, Art. 6(1)(b) GDPR.

Spam protection

Google reCAPTCHA assesses form submissions to block automated abuse. It processes your IP address and interaction signals. Legal basis: our legitimate interest in securing the form, Art. 6(1)(f) GDPR.

Analytics and advertising

Only with your permission. Google Analytics 4 measures page use; the Meta Pixel and Meta Conversions API measure our advertising. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Refusing has no effect on your application.

Server logs

Our hosting provider records requests, including IP address and user agent, to keep the service available and secure. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

3. Contact, reminders and follow-ups

When you tick the required consent box, you are agreeing that we may contact you about that application by email, phone, SMS or WhatsApp, and that our CRM may send you automated reminders and follow-up messages about your strategy call. This is limited to the call you asked for.

The optional second box is separate. It covers general marketing such as tips, case studies and offers. Leaving it unticked does not affect your application in any way, and we do not put you into promotional sequences without it.

You can withdraw either consent at any time, with no reason needed, by replying STOP or unsubscribe to any message, or by emailing contact@jcerme.com. Withdrawal is as easy as giving consent and takes effect for the future; it does not make earlier processing unlawful.

4. Who we share data with

We do not sell your data. We use the following processors, each under a data processing agreement. Transfers to the United States rely on the EU Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

GoHighLevel (US)

CRM. Stores your application, the consent record, and runs the reminder and follow-up automations.

Calendly (US)

Scheduling. Receives the name and email needed to book and confirm your call.

Meta Platforms Ireland

Advertising measurement, only with your advertising consent. Receives hashed email and phone plus event data.

Google Ireland

Analytics and reCAPTCHA. Analytics only with your consent; reCAPTCHA runs on the form for security.

Resend (US)

Sends the internal notification email to our team.

Vercel (US)

Hosting and server logs.

5. Meta advertising in detail

If you allow advertising cookies, we send Meta a conversion event when you submit the form and when you book a call. Your email address and phone number are hashed in your browser using SHA-256 before transmission, so Meta does not receive them in readable form. We also forward the _fbp and _fbc cookie values so the event can be matched to the ad you clicked.

Browser and server events share a single event ID purely to avoid double counting. If you do not allow advertising cookies, the Pixel is never loaded, no _fbp or _fbc values are read, and no server-side event is sent.

For this measurement Meta and JCerme act as joint controllers under Art. 26 GDPR. Meta's own handling is described in its data policy.

6. How long we keep it

Applications that do not become customers

24 months from your last contact with us, then deleted.

Consent records

3 years after the consent ends, to defend against complaints.

Customer records

As long as the relationship lasts, then per statutory retention rules.

Analytics and advertising data

14 months at most, or until you withdraw consent.

Server logs

Up to 30 days, other than where needed to investigate an incident.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), correct it (Art. 16), have it deleted (Art. 17), restrict processing (Art. 18), receive it in a portable format (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time (Art. 7(3)). Equivalent rights apply under the Swiss revDSG.

To exercise any of these, email contact@jcerme.com. We respond within one month. You do not have to pay and you do not have to give a reason to withdraw consent or object to marketing.

You can also complain to a supervisory authority. In Germany this is the authority for the state where you live; in Switzerland it is the Federal Data Protection and Information Commissioner (FDPIC). You may also complain to the authority of your EU country of residence.

8. Automated decisions

The form sorts applications by role, company size and annual value so we can route you to the right specialist and prioritise follow-up. A person always makes the final decision on whether we work together, so this is not automated decision-making with legal effect under Art. 22 GDPR.

9. Children

This is a business-to-business service and is not directed at anyone under 16. We do not knowingly collect data from children.