Privacy Policy

Last Updated: September 22, 2026

This Privacy Policy explains how RFspin s.r.o. (“we,” “us,” or “our”) collects and uses personal data when you visit www.rfspin.com (the “Website”), contact us, download product files, use the RF SPIN Antenna Portal, subscribe to our newsletter, or do business with us. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable laws of the Czech Republic.

The Website and our services are intended for businesses, research institutions, and other professional users. Most of the personal data we process is the business contact information of people who work for our customers, prospective customers, distributors, and suppliers.

Your Right to Object: You have the right to object at any time to processing based on our legitimate interests, including profiling, and to direct marketing. See Section 11.

1. Who We Are

The controller of your personal data is RFspin s.r.o., with its registered office at Na Beránce 57/2, 160 00 Prague 6, Czech Republic, Company ID 27084990, VAT ID CZ27084990, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 95118.

If you have any questions about this Privacy Policy or about how we process your personal data, contact us at info@rfspin.com. We have not appointed a data protection officer, as we are not required to do so.

2. Personal Data We Collect

Depending on how you interact with us, we may process the following categories of personal data:

• Contact Details: Your name, company or institution, email address, phone number, and country (for the United States, also your state).
• Inquiry Details: The products, files, or services you are interested in, the content of your messages, and our correspondence with you.
• Business Relationship Data: Information needed to prepare quotations, deliver products and antenna data, process data tier upgrades, handle warranty claims and support requests, and issue invoices.
• Technical Data: Your IP address, including the IP address from which you submit a form, browser and device type, operating system, referring website, pages visited, files downloaded, and the date and time of your visit.
• Location Data: The country, region, and city derived from your IP address. We do not use the precise location of your device.
• Information from Public Sources: Publicly available information about your company and your professional role, such as your job title and your area of professional expertise, as described in Section 4.
• Derived Data: Information that we derive from other data, such as the region to which your inquiry belongs, whether the country you enter in a form matches the country of your IP address, the internal priority of your inquiry in our CRM system, and the results of the research described in Section 4.
• Marketing Preferences: Your newsletter subscription and your consent choices, including your cookie settings.

We obtain most personal data directly from you. We also obtain personal data from the following sources:

• your employer or the organization you represent, for example when it names you as a contact person;
• our distributors, when they pass us your inquiry or information about you as a user of our products, for example in connection with antenna data, warranty claims, or support requests;
• publicly available sources, such as company websites, business registers, professional networking sites, publications, and news articles, as described in Section 4;
• your IP address, from which we derive your approximate location using information from Cloudflare or a geolocation database, as described in Section 5.

We do not intentionally collect special categories of personal data, such as data concerning health. Please do not include such data in your messages.

3. How We Use Your Personal Data

We process personal data only for specific purposes and only when we have a legal basis under Article 6(1) GDPR:

• Inquiries and Quote Requests: We use your contact and inquiry details to answer your questions, prepare quotations, and follow up on your request. If one of our distributors serves your country or region, we pass your inquiry to that distributor, as described in Section 7. Legal basis: steps taken at your request before entering into a contract, where you act on your own behalf (Article 6(1)(b) GDPR), and otherwise our legitimate interest in responding to business inquiries and selling our products through our distribution network (Article 6(1)(f) GDPR).
• Product Files: When you request datasheets, CST models, STEP files, or other technical documentation, we send the files to the email address you provide, keep a record of your request, and may contact you with questions about your request. Legal basis: our legitimate interest in providing technical documentation to professional users, knowing who receives our design files, and answering questions about them (Article 6(1)(f) GDPR). We send you marketing emails only as described under Newsletter below.
• Antenna Portal: When you unlock antenna data with the antenna model and the token from the QR code, we do not ask for your name or contact details. We process only the technical data described in Section 2 to provide the antenna data and to protect the Antenna Portal against misuse. Legal basis: our legitimate interest in providing antenna data to users of our products and securing the Antenna Portal (Article 6(1)(f) GDPR).
• Customers, Distributors, and Suppliers: We process the data of our business partners and their contact persons to conclude and perform contracts, deliver products and antenna data, process data tier upgrade requests, handle warranty claims, returns, and support requests, comply with export control requirements, and keep accounting and tax records. Legal basis: performance of a contract where you are our contractual partner as an individual (Article 6(1)(b) GDPR), compliance with our legal obligations, in particular under accounting, tax, customs, and export control laws (Article 6(1)(c) GDPR), and our legitimate interest in communicating with the contact persons of our business partners (Article 6(1)(f) GDPR).
• Customer Relationship Management: We store inquiries, business contacts, and the results of the research described in Section 4 in our customer relationship management (CRM) system, Zoho CRM, with data stored in the EU. The system automatically assigns each contact an internal priority based on their interactions with us, such as which forms they submitted and how recently. This is profiling within the meaning of the GDPR. We use the priority only to decide which inquiries to follow up first, and it has no legal or similarly significant effects on you. Legal basis: our legitimate interest in organizing our sales activities (Article 6(1)(f) GDPR).
• Newsletter: If you subscribe, we send you news about our products, services, and events by email. We ask you to confirm your subscription by clicking a link in a confirmation email. We also record whether you open our emails and which links you click, so that we can improve our content. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time using the unsubscribe link in each email.
• Website Operation and Security: We process technical data to deliver the Website, protect it and its forms against spam, bots, and attacks, and investigate security incidents. We use Cloudflare, including its Turnstile bot check, and the Wordfence security plugin, which logs the IP addresses of requests to the Website. In file requests, we ask for a work email address instead of an address from a free email service, and we treat requests from disposable email addresses as spam and do not process them further. Legal basis: our legitimate interest in the secure operation of the Website (Article 6(1)(f) GDPR).
• Download Statistics: We record downloads of catalogs, datasheets, and other files, together with the IP address, the referring website, the browser and device type, and the approximate location described in Section 2, to understand which content our visitors find useful. Legal basis: our legitimate interest in improving the Website (Article 6(1)(f) GDPR).
• Regional Content, Export Control, and Sanctions: We use your approximate location as described in Section 5.
• Analytics and Advertising: With your consent, we use Google Analytics to measure how visitors use the Website and Google Ads to measure the results of our advertising and to show our ads to people who have visited the Website. Legal basis: your consent (Article 6(1)(a) GDPR). See the Cookie Policy below.
• Legal Claims: We may use personal data to establish, exercise, or defend legal claims. Legal basis: our legitimate interest in protecting our rights (Article 6(1)(f) GDPR).

Where we rely on our legitimate interests, you have the right to object to the processing, as described in Section 11.

4. AI-Assisted Research of Inquiries

When you submit a file request or a quote request, we automatically send the details you entered in the form (your name, company, email address, phone number, and country, and for the United States, your state) to an automated research service. The service is operated on our behalf by our web development partner on servers in the EU and uses Perplexity AI, Inc., a provider of artificial intelligence and web search services in the United States.

The service searches publicly available sources, such as company websites, business registers, professional networking sites, publications, and news articles. It returns the following information, which we store with your request and in our CRM system:

• a short description of your company, such as its field of business and its website;
• a short description of your professional role, such as your job title, your position in the company, and your professional expertise, to the extent that this information is publicly available;
• keywords describing the business interests of your company and your professional interests;
• the suggested spelling of your name and your company’s name, which we may use to correct these details in our CRM system.

The research is limited to your career and professional focus. We expressly instruct the service not to search for information about your private life, family, health, or finances, or any other special categories of personal data, such as political opinions or religious beliefs.

Results produced by artificial intelligence may be inaccurate. We use them only as guidance for our staff, and you can ask us to correct them at any time.

When your quote request contains a free-text message, we also use artificial intelligence to identify the RF SPIN product models mentioned in it.

We use the results to understand who is contacting us and what you need, to prepare a relevant answer, to decide which member of our team or which distributor should handle your request, and to check that the request is genuine. Legal basis: our legitimate interest in handling business inquiries efficiently and appropriately (Article 6(1)(f) GDPR). You can ask us for information about the balancing test we carried out for this processing.

You can object to this research at any time, as described in Section 11. If you object, we will delete the research results about you.

5. Location, Export Control, and Sanctions Compliance

We determine your approximate location (the country and, in some cases, the region or city) from your IP address, using information from Cloudflare or a geolocation database that runs on our own server. We use it to:

• show content that is relevant to your region;
• route your inquiry to the RF SPIN team or distributor responsible for your region and, in the United States, for your state;
• compare the country you enter in a form with the country of your IP address, so that our staff can identify inaccurate requests and attempts to circumvent export restrictions;
• restrict access to certain technical content and downloads from countries subject to EU sanctions or export restrictions.

We also screen form submissions for connections to countries subject to sanctions, including by their email domain. Submissions that appear to be connected to such countries may be blocked automatically or may not be answered. If you believe that your location has been determined incorrectly, contact us at info@rfspin.com, and a member of our staff will review your case.

Legal basis: compliance with our legal obligations under EU sanctions regulations and EU and Czech export control laws, such as Regulation (EU) 2021/821 on dual-use items (Article 6(1)(c) GDPR), and our legitimate interests in showing relevant content, handling inquiries through the right distributor, and preventing the unauthorized export of our technology, including under the export control laws of other countries that apply to our products (Article 6(1)(f) GDPR).

6. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

We use automated processing, including profiling, to support our staff: our CRM system assigns contacts an internal priority (Section 3), the AI-assisted research summarizes your company and your professional role (Section 4), and our spam filter and sanctions screening can block form submissions automatically (Section 3 and Section 5). If you believe that an automated step has affected you incorrectly, contact us at info@rfspin.com, and a member of our staff will review it.

7. Who We Share Your Personal Data With

We share personal data only to the extent necessary for the purposes described above:

• Distributors: If one of our authorized distributors serves your country or region, we usually pass your inquiry and contact details to that distributor so that it can respond to you, prepare a quotation, or provide local support. For inquiries from the United States, we select the distributor according to your state. Distributors process your data as independent controllers under their own privacy policies. Some of our distributors are located outside the European Economic Area (EEA), as described in Section 8. You can find our distributors and the countries they serve on the Sales and Distribution page.
• Service Providers: Companies that process personal data on our behalf and under our instructions, in particular providers of website hosting in the Czech Republic, content delivery, website security, and bot protection (Cloudflare, Inc. and Defiant, Inc., the provider of Wordfence), email delivery, CRM and newsletter services (Zoho, with data stored in the EU), website development, maintenance, and the AI-assisted research described in Section 4 (our web development partner in the EU, using Perplexity AI, Inc.), web analytics (Google Ireland Limited, for Google Analytics), and IT and backup services. Cloudflare also uses limited technical data from its bot protection service as an independent controller to improve that service.
• Google: If you consent to advertising cookies, Google Ireland Limited receives information about your visit through the Google Ads tags on the Website, such as your IP address, information about your device, the pages you visit, and whether you sent us an inquiry after clicking one of our ads. We and Google are jointly responsible for collecting this information on the Website and transmitting it to Google. Google then processes it as an independent controller, for example to measure conversions and to show you our ads, under the Google Privacy Policy.
• Carriers: Shipping and logistics companies that deliver our products.
• Banks: Banks that process payments between us and our business partners.
• Professional Advisers: Accountants, auditors, and lawyers who are bound by confidentiality.
• Public Authorities: Customs, tax, export control, and other authorities, when we are required to do so by law.

On request, we will tell you the names of the specific recipients of your personal data. We do not sell personal data.

8. Transfers Outside the European Economic Area

Some recipients of personal data are located outside the EEA. We transfer personal data to them only on one of the following bases:

• an adequacy decision of the European Commission (Article 45 GDPR), which applies, for example, to recipients in the United Kingdom, Israel, Japan, and South Korea, and to recipients in the United States that are certified under the EU-U.S. Data Privacy Framework; or
• standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), together with additional safeguards where necessary.

Google, Cloudflare, Defiant (the provider of Wordfence), and Perplexity AI are located in the United States. Transfers to them are based on the EU-U.S. Data Privacy Framework or on standard contractual clauses. Our distributors in the United States, India, Taiwan, Singapore, and Australia receive personal data under standard contractual clauses. Some of our other service providers may access personal data from outside the EEA, for example to provide technical support; in that case, the transfer is based on standard contractual clauses.

You can obtain a copy of the standard contractual clauses we use by contacting us at info@rfspin.com. We may remove commercially confidential information from the copy.

9. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes for which we collected it:

• Inquiries, Quote Requests, and File Requests: Up to 3 years after our last communication with you, unless they lead to a contract. The same period applies to the related records in our CRM system and to the results of the research described in Section 4.
• Blocked and Spam Submissions: Up to 6 months.
• Contracts, Invoices, and Accounting Records: For the periods required by Czech accounting and tax laws, generally 10 years from the end of the relevant accounting or tax period.
• Export Control Records: For at least 5 years from the end of the calendar year of the export, as required by EU export control law.
• Customer and Warranty Records: For the duration of our business relationship and the warranty period, and then for 4 years to cover the limitation period for legal claims.
• Newsletter: Until you unsubscribe or withdraw your consent. We keep a record of your consent and its withdrawal for 3 years to be able to demonstrate them.
• Download and Security Logs: Up to 12 months.
• Analytics Data: 14 months in Google Analytics.
• Cookies: As stated in the Cookie Policy below.

If data is needed to establish, exercise, or defend legal claims, we may keep it until the matter is resolved.

10. Your Rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, for example when it is no longer needed or when you withdraw your consent;
• restrict the processing of your data in certain cases;
• receive the data you have provided to us in a structured, commonly used, and machine-readable format and have it transmitted to another controller;
• object to the processing of your personal data, as described in Section 11;
• withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at info@rfspin.com. We will respond within one month of receiving your request. In complex cases, we may extend this period by two further months, and we will let you know. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. Where we rely on our legitimate interests, you can also ask us for information about the balancing test we carried out.

The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, posta@uoou.gov.cz, uoou.gov.cz. You can also lodge a complaint with the supervisory authority in the EU or EEA country where you live or work or where the alleged infringement took place.

11. Your Right to Object

Where we process your personal data on the basis of our legitimate interests (Article 6(1)(f) GDPR), including the AI-assisted research described in Section 4 and the prioritization of contacts in our CRM system, you have the right to object at any time, on grounds relating to your particular situation. If you object, we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless we need the data to establish, exercise, or defend legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing. If you object, we will no longer process your data for these purposes. You do not need to give any reason.

To object, email info@rfspin.com or use the unsubscribe link in our emails.

12. Providing Personal Data

Providing personal data is voluntary. However, we need the details marked as required in our forms to respond to your request or send you the requested files, and we need certain data to conclude and perform a contract with you and to meet our legal obligations.

13. Security

We use technical and organizational measures appropriate to the risk to protect personal data against unauthorized access, loss, and misuse. These include encrypted connections, access controls, web application firewalls, spam and bot protection, and backups. We give access to personal data only to employees and service providers who need it for their tasks, and we require our service providers to protect it.

14. Children

The Website and our services are intended for professional users and are not directed at children under 16. We do not knowingly collect personal data from children.

15. Third-Party Websites, Social Media, and Embedded Videos

The Website contains links to other websites and to our profiles on social networks such as LinkedIn and YouTube. When you follow such a link, the operator of the destination website processes your data under its own privacy policy. Some pages of the Website contain videos hosted on YouTube. See the Cookie Policy below.

16. Changes to This Privacy Policy

We may update this Privacy Policy when our processing activities or legal requirements change. The current version is always available on this page, with the date of the last update at the top. If we make material changes, we will highlight them on this page and, where appropriate, inform you by email.