Legal

Privacyverklaring

Last Updated: 8th of July 2026

Please click here for the US Privacy Notice

1. Introduction

1.1 Welcome to the Circit privacy notice. We hope it provides you with the information you are looking for, but if you need anything else, please reach out to us.

1.2. This privacy notice provides key information about the types of personal data processed by Circit, how we obtain it, and what we do with it.

‍

2. Who we are

2.1 Circit Limited and its group companies are represented by Circit Limited, a company registered in Ireland with company registration number 564144 and registered office at The Business Centre, Mayor Street, IFSC, Dublin 1, Ireland (“we”, “our”, “us”). Circit Limited is the company responsible for collection, use, and disclosure of your personal data under this Privacy Notice.

2.2 We can be contacted at privacy@circit.io.

‍

3. Data Protection Officer

3.1 Circit has assessed the criteria under Article 37 GDPR and determined that appointment of a Data Protection Officer is not mandatory for our processing activities. Privacy queries should be directed to privacy@circit.io, which is managed by Compliance.

‍

4. Whose data we process

This privacy notice provides key information about how Circit processes your personal data. This privacy notice applies to you if you are:

visitors to our website;
prospective customers and past customers, and their personnel;
customers, or personnel of our customers;
end-users of the Circit platform (including trials or pilots);
vendors or employees of vendors that provide services to us including prospective or past vendors;
individuals who apply to Circit to fill a vacant role;
individuals whose personal data has been collected by us e.g. for marketing purposes; and
current, past and prospective investors in our company.

‍

5. When Circit collects personal data

5.1 To the extent permitted under applicable law, we may collect personal data about you and any other individual either directly or indirectly, if that data is provided to us by another party in the following circumstances:

‍You interact with us directly: This can be through using our platform, websites, contact forms, surveys, or when you contact us by phone, email, chatbots, fax or post. We may also collect information automatically, using cookies or similar technologies, as described in our Cookie Notice.
‍You or your organisation provide(s) services to us: In this context, we may collect basic personal data about you (mainly professional contact details).
‍Third parties provide us with personal data about you: This can happen where: Someone who uses the Circit platform, or has interacted with us in another way, has given your personal data to us; You are an employee of a customer of ours, and your employer provides us with your contact details or other personal data in connection with your use of the Circit platform; You have a social media account, and social media service provides us with access to certain personal data for marketing purposes e.g. LinkedIn;
‍You attend a Circit event: Where you attend seminars, learning, training or other events organised by Circit virtually or in person, or where you attend our premises for an event.

‍

6. Why Circit processes personal data

6.1 Where Circit collects any personal data, it will be processed and stored securely, for no longer than is necessary. We will comply with our obligations and safeguard your rights under the relevant data protection legislation.

6.2 We collect the following categories of personal data:

6.2.1. Contact Information:

name, business address, email address (business or personal), phone number (business or personal).

6.2.2. Billing and payment information:

the individual or business making or receiving the payment, authorised user details, business bank account information.

6.2.3. www.circit.io online usage, metadata and web information:

information on the services you viewed and searched for, response times, errors, duration of access; visit and page interaction (such as scrolling, clicks and hovering the mouse over content), username, IP address, browsing time and history, passwords and logging data, device type, time zone, browser plug-in types and versions, social media profile photo or profile information, web log information, device identification number, device type, location information, connection information, operating system and platform.

6.2.4. Communication preferences:

marketing preferences, areas of interest, preferred contact method and details, correspondence relating to marketing, consent records, business information, such as name and number of employees.

6.2.5. Organisation details:

place of work, job title, and organisation contact information.

6.2.6. Job applicant information:

employment history, references, membership in professional organisations, licenses and certifications, education history, records, degrees, transcripts, and other related information.

6.2.7. Physical access data:

details of your visit to our office, CCTV recordings and event registration data.

6.2.8. Correspondence:

where you contact us for any reason (for example, requests for support, where you have a question, or where you exercise your data protection rights), we will collect personal data contained via correspondence.

6.2.9. Data processed using the Circit platform:

this is described in detail in the Data Processing Agreement for the relevant type of customer.

6.3 Circit does not collect special category data, as defined under the GDPR

6.3.1 Where special category data is received incidentally (for example, within free-text correspondence or a support ticket), we do not use it for any purpose and delete it in line with our data minimisation obligations

‍

7. Why Circit processes personal data

The table below sets out the purposes for which we process personal data, which personal data is used to deliver these services and the legal basis we rely on under GDPR.

Purposes/activity	Personal data used	Legal basis for processing
To respond to your communication to us via our website ‘Contact Us’ form.	Contact information; organization details	Legitimate interests (Art. 6(1)(f))
To approve requests to access the Circit Trust Centre	Contact information; metadata and web information; job/role title; organisation details	The processing is necessary to support our legitimate interests in managing our business and maintaining website security and protecting our intellectual property - Legitimate interests (Art. 6(1)(f)).
Contacting you when you have subscribed to our email notifications and/or newsletters	Contact information; Communication preferences; organisation details	The processing is necessary to support our legitimate interests in marketing our business.
Conducting surveys for customer research, benchmarking, improvement and marketing purposes.	Contact information; metadata and web information; communication preferences; organisation details;	The processing is necessary to support our legitimate interests in carrying out market research to improve our business - Legitimate interests (Art. 6(1)(f)).
To contact/respond to customers or prospects regarding business services and opportunities which they are interested in.	Contact information; billing and payment information; platform usage metadata and web information; communication preferences; organisation details; correspondence	The processing is necessary to support our legitimate interests in managing our business and marketing our business - Legitimate interests (Art. 6(1)(f)). We may alternatively rely on your explicit consent (which may be withdrawn by you at any time by letting us know).
To process job applications from candidates for Circit job vacancies.	Contact information; metadata and web information; communication preferences; job applicant information	The processing is necessary to support our legitimate interests in managing our business and recruiting staff. Legitimate interests (Art. 6(1)(f)); Legal obligation where applicable (Art. 6(1)(c))
To assist the proper operation and functionality of our site.	Contact information; online usage, metadata and web information; communication preferences; organisation details; correspondence; data processed using the Circit platform	The processing is necessary to support our legitimate interests in managing our business and maintaining website security. Legitimate interests (Art. 6(1)(f)); Consent where required for non-essential cookies
Billing and payment	Billing and payment information	The processing is necessary for our legitimate interest in liaising with customers about payments for our products or paying our suppliers. Performance of a contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c))
To analyse, improve and tailor our website content in line with user preferences and behaviour.	Metadata and web information;	The processing is necessary to support our legitimate interests in managing our business and improving our product. Legitimate interests (Art. 6(1)(f)); Consent where analytics cookies require it
To provide the Circit services to our customers	Online usage, metadata and web information; communication preferences; organisation details; data processed using the Circit platform	The processing is necessary for our legitimate interest in providing our products to our customers. Performance of a contract (Art. 6(1)(b)) Legal obligation where applicable (Art. 6(1)(c))
Security and fraud prevention	Online usage, metadata and web information; data processed using the Circit platform; platform usage data, contact information;	The processing is necessary to manage our contractual relationship with you, to comply with a legal obligation, and/or based on our legitimate interest, such as identifying and preventing fraudulent transactions and cyberattacks. Performance of a contract (Art. 6(1)(b)) Legal obligation where applicable (Art. 6(1)(c))
Legal and compliance	Personal information as relevant for the specific legal action, regulatory investigation, and/or legal processes in question	The processing is necessary to manage our contractual relationship with you, to comply with a legal obligation, and/or based on our legitimate interest, such as our interest in enforcing our terms and conditions and bringing and defending legal claims. Performance of a contract (Art. 6(1)(b)) Legal obligation where applicable (Art. 6(1)(c))
Emergency and incident response	Personal information as relevant for the specific emergency or incident	The processing is necessary to protect individuals’ vital interests, to comply with a legal obligation, and/or based on our legitimate interest, such as ensuring the safety of our premises. Performance of a contract (Art. 6(1)(b)) Legal obligation where applicable (Art. 6(1)(c)) Legitimate interests (Art. 6(1)(f));

8. If you choose not to provide your personal data

8.1 Should you choose not to provide your personal data to Circit, we may not be able to provide our services to you.

‍

9. If you provide Circit with someone else’s personal data

9.1. Should you for any reason, disclose to us the personal information of another person, you must ensure that you have a lawful basis for both the disclosure and the processing of that personal information in accordance with this notice.

‍

10. Data retention

10.1 Personal information that we process for any purpose or purposes, shall not be kept for longer than is necessary for that purpose or those purposes. The criteria used to determine our retention periods for documents containing personal data (including electronic documents) include:

10.1.1 The length of time we have an ongoing relationship with you and provide services to you, for example, for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your personal data to address issues that may arise;

10.1.2 Whether retention is required by law;

10.1.3 Retention of documents relevant to any ongoing or prospective legal proceedings ‍

10.2 The table below sets out the maximum period for which we retain each category of data.

Category of data	Maximum retention period
Website enquiry and marketing contact data	Up to 2 years from the date of last engagement or interaction, after which data is deleted or anonymised unless the individual re-engages or renews consent.
Customer and end-user account data (Circit platform)	Up to 6 years after the end of the contractual relationship (unless an alternative period is agreed with a customer).
Billing and payment records	6 years from the end of the financial year to which the record relates.
Job applicant data (unsuccessful candidates)	Up to 12 months from the recruitment decision, unless the candidate consents to longer retention for future opportunities.
CCTV and physical access records	30 days as a baseline, unless footage relates to a specific identified incident under investigation, in which case only that footage is retained until the investigation and any appeal are concluded.
Correspondence relating to support or the exercise of data protection rights	Up to 6 years from the date of the correspondence, or until the relevant matter is resolved if that is later.

11. How Circit keeps personal data secure

11.1 We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.

11.2 Customer trust is a core value of Circit’s. Circit’s platform is certified to ISO 27001:2023 - Information Security Management Systems. We also hold a SOC 2 Type 2 report which documents additional security controls. Circit is audited twice a year by ISO and SOC auditors.

‍

12. Automated decision-making and profiling

Circit does not carry out processing that constitutes solely automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

‍

13. Data sharing

13.1 Circit does not disclose personal data to third parties other than its contracted processors or sub-processors. We may disclose personal data to third parties for the purposes described below, depending on each specific jurisdiction and applicable law:

Recipients	Purpose
Circit affiliates	For all the purposes listed above, Circit and its affiliates are responsible for the management of any jointly used personal data. Circit affiliates are: Circit UK Ltd: United Kingdom Circit Inc: United States of America
Third-party service providers and contractors	Our processors which may process your data on our behalf, for all the purposes listed above, are: Microsoft 365: Email provider Intercom: Support Platform Hubspot: Sales and marketing Xero: Accounting software Spendesk: Invoicing tracking software
Advertising networks that collect information via browser cookies, pixels and other tracking technologies.	Conducting surveys for customer research, benchmarking, improvement and marketing purposes To analyse, improve and tailor our website content in line with user preferences and behaviour
Law enforcement, public, regulatory, and government authorities, courts, tribunals, or third parties where necessary to comply with applicable law and regulations	Emergency and incident response Security and fraud prevention Legal and compliance Responding to a request or providing information to public and government authorities (including authorities outside your country or region of residence) Responding to law enforcement requests and orders or providing information to law enforcement For dispute resolution purposes To enforce our terms and conditions To protect our rights, privacy, safety, property, and/or that of our affiliates, you or others
Professional advisors, such as accountants, actuaries, auditors, experts, consultants, lawyers, banks, and financial institutions	Security and fraud prevention Legal and compliance To analyse, improve and tailor our website content in line with user preferences and behaviour
Third parties, such as acquiring entity and its advisors, in connection with a sale or business transaction	We may disclose or transfer your personal data in the event of any reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You will be notified of any such business transaction and of possible changes to the processing of your personal data in accordance with applicable law.

14. Cookies

14.1 Our cookie notice can be viewed at www.circit.io/legal/cookies-policy

‍

15. Controllers and processors

15.1 This privacy notice describes our processing of your personal data in our capacity as a “data controller”.

15.2 Where we process personal data on behalf of our customers, we are a data processor. Where we are a data processor of your personal data, we use it in accordance with the data controller’s instructions to us. Those instructions include the terms of service applicable to the Circit product you or your employer is using, and our Data Processing Agreement, which is included in those terms.

15.3 If we are a data processor of your personal data, then you should also read the relevant data controller’s privacy notice.

‍

16. Your data protection rights

16.1 Subject to applicable law, you may have the following data protection rights:

16.1.1 The right to be informed about the processing of your personal data;

16.1.2 The right to obtain access to your personal data;

16.1.3 The right to have your personal data rectified or erased, or to place restrictions on processing your personal data;

16.1.4 the right to object to the processing of your personal data e.g., for direct marketing purposes or where the processing is based on our legitimate interests;

16.1.5 The right to have your personal data returned to you in a structured, commonly used and machine-readable format, or sent directly to another company;

16.1.6 Where the processing of your personal data is based on your consent, the right to withdraw that consent subject to legal or contractual restrictions;

16.1.7 The right to object to any decisions based solely on the automated processing of your personal data, including profiling;

16.1.8 Exercising any of the rights set out in this section will not result in you being treated unfairly or experiencing any detriment. However, in limited circumstances, certain personal data may be necessary for us to provide a particular product, service, or feature to you — where this is the case, exercising a right (for example, objecting to processing, or requesting erasure of that data) may mean we are unable to continue providing that specific product, service, or feature. This is a natural consequence of the data being necessary, and not a penalty for exercising your rights.

16.1.9 If we refuse to act on a request you have made to exercise a data protection right, we will explain our reasons for doing so. If you disagree with our decision, you may ask us to review it by contacting privacy@circit.io with details of your original request and the reasons for your appeal. We will aim to respond to your appeal within [30] days.

This internal review process is offered in addition to, and does not replace or delay, your right to lodge a complaint directly with the data protection supervisory authority responsible for your location at any time — see 16.1.10

16.1.10 The right to lodge a complaint with the data protection supervisory authority responsible for data protection matters in your location. For the UK, this is the Information Commissioner’s Office (ICO). For Ireland, this is the Data Protection Commissioner (DPC).

16.2 Where you object to processing based on our legitimate interests, we will stop that processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims, in accordance with Article 21(1) GDPR.

16.3 Please note that in some circumstances the exercise of the above rights may be limited by legal restrictions and exemptions. If relevant, we will explain this when responding to a request to exercise data protection rights.

16.4 If you think we hold any personal data about you which is incorrect or if there are any changes to your personal data, please let us know so that we can keep our records accurate and up to date.

16.5 If you wish to exercise your data protection rights as an individual, please email privacy@circit.io

16.5.1 Under GDPR Art. 12(3), on receipt of contact Circit will endeavour to respond without undue delay and within one month. This response is extendable by two further months for complex requests

16.6 If you do not want us to use your personal data for purposes set out in our privacy notice, we may not be able to provide you with access to all or parts of our website or products.

‍

17. International data transfers

17.1 The Circit platform is hosted entirely within the EU by default. Customers outside of the EU can choose to have their data stored in their own region. In order to provide global support, Circit has full-time employees based outside of the EU. Depending on the time of day, we may offer or assign support from Circit personnel based outside of the EU. Circit will take appropriate measures to ensure that your personal data is granted the same level of protection as if it were processed in the EU/EEA or UK. Such measures include both technical and operational safeguards, use of standard contractual clauses for transfer of personal data outside of the EU/EEA and UK, and Data Transfer Impact Assessments where appropriate.

‍

18. Use of services by minors

18.1 Our services are business-facing and are not directed at, marketed to, or designed for use by children. We do not knowingly collect personal data from individuals below the applicable age of digital consent in their country of residence — this is 16 in Ireland and most other EU member states, and 13 in the UK, unless a lower age applies locally.

18.2 If we become aware that we have inadvertently collected personal data from a child below the applicable age without appropriate consent, we will take steps to delete that information promptly.

19. Updates

19.1 We may update this privacy notice from time to time. We notify Circit customers and will publish revised versions on our website at https://www.circit.io/legal/privacy-notice with a new “Last Updated” date.