Privacy Policy

This Privacy Policy explains how DAGHAZAHAV [GOLDFISH SYSTEMS LTD] ("DAGHAZAHAV", "we", "us" or "our") collects, uses, stores, discloses and otherwise processes personal data when you visit our website, communicate with us, use our software platforms, or interact with services developed, implemented or operated by us.

DAGHAZAHAV develops, implements and operates customized software solutions, including AI-based software platforms designed to automate service processes, communication and the management of multi-channel interactions.

Our services may involve the processing of personal data on behalf of our business customers. In such circumstances, our customer may act as the Data Controller, while DAGHAZAHAV may act as a Data Processor. The allocation of responsibilities depends on the specific service, contractual arrangements and processing activities involved.

This Privacy Policy is intended to provide transparent information regarding our processing of personal data and to comply, where applicable, with the requirements of the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

The data controller responsible for the processing described in this Privacy Policy is:

• Legal name: GOLDFISH SYSTEMS LTD
• Trading name: DAGHAZAHAV / GOLDFISH
• Company registration number: 516187325
• Registered address: PINKAS 7, BNEI BRAK, ISRAEL
• Country: Israel
• Website: https://daghazahav.com
• Email: contact@goldfish.systems
• Telephone: 054-2012000

Where DAGHAZAHAV processes personal data strictly on behalf of a customer, that customer may be the Data Controller and DAGHAZAHAV may act as a Data Processor. In such cases, individuals may need to direct certain privacy requests to the relevant customer.

Where required by applicable law, DAGHAZAHAV will designate a Data Protection Officer ("DPO") or other responsible privacy contact.

DPO / Privacy Contact: Oren

Email: contact@goldfish.systems

This Privacy Policy applies to personal data processed in connection with:

• our website and online services;
• inquiries and communications with DAGHAZAHAV;
• sales and customer relationship activities;
• software platforms and applications developed or operated by us;
• AI-based services and automation functionality;
• customer support and service interactions;
• multi-channel communication services;
• integrations with third-party platforms and communication services;
• software implementation and maintenance services; and
• other business activities carried out by DAGHAZAHAV.

Where a specific service is subject to a separate privacy notice, data processing agreement, customer agreement or other contractual documentation, such documentation may provide additional information regarding the relevant processing activities.

Depending on the nature of the service and your interaction with us, we may process the following categories of personal data:

4.1 Identification and Contact Information

• full name;
• telephone number;
• email address;
• business address;
• job title and organization;
• username or account information;
• other contact information provided by you.

4.2 Communication Data

Depending on the services used, we may process:

• emails;
• telephone communications;
• WhatsApp or other messaging communications;
• chat messages;
• customer service requests;
• correspondence and support tickets;
• communication metadata;
• timestamps and interaction history.

Where legally permitted and appropriately disclosed, communications may also include recordings or transcripts.

4.3 Account and Technical Information

We may process:

• login information;
• authentication information;
• IP address;
• browser and device information;
• operating system;
• device identifiers;
• session information;
• access logs;
• security logs;
• application activity;
• system and diagnostic information.

4.4 Information Processed Through Customer Platforms

Our software platforms may process information uploaded, entered or otherwise made available by our customers and their users.

Depending on the specific solution, such information may include:

• customer and employee information;
• business records;
• service requests;
• operational information;
• documents and files;
• task and workflow information;
• customer interaction history;
• communications;
• CRM information;
• information relating to employees, suppliers or other individuals.

The specific categories of data depend on the configuration and purpose of each customer solution.

4.5 AI-Related Data

Where AI functionality is implemented, the platform may process information such as:

• user inputs and prompts;
• text submitted to the platform;
• customer communications;
• conversation history;
• documents or other content submitted for processing;
• AI-generated outputs;
• interaction metadata;
• feedback concerning AI-generated outputs.

AI functionality may be used to classify, summarize, analyze, route, generate or assist with responses to communications and business processes.

Our services are not generally designed to require the processing of special categories of personal data under Article 9 GDPR unless such processing is specifically agreed, required for the relevant service, or otherwise permitted by applicable law.

Depending on the customer's use and configuration of a platform, personal data processed through the platform may potentially include information falling within special categories of personal data.

Where DAGHAZAHAV acts as a Data Processor, the relevant customer is responsible for determining whether such processing is necessary and lawful and for providing appropriate instructions and safeguards.

DAGHAZAHAV will not intentionally request special-category personal data unless it is necessary for the relevant service and supported by an appropriate legal basis and safeguards.

We may obtain personal data from:

• you directly;
• your employer or organization;
• our customers;
• users of our platforms;
• business partners;
• service providers;
• communication platforms;
• publicly available sources, where permitted by law;
• integrations and connected systems;
• automated technologies and system logs.

Where personal data is obtained from a source other than the individual concerned, we will provide the information required under applicable data protection law, subject to applicable exceptions.

We may process personal data for the following purposes:

7.1 Providing and Operating Our Services

Including:

• providing software services;
• developing and implementing software solutions;
• operating and maintaining platforms;
• managing customer accounts;
• providing customer support;
• troubleshooting;
• monitoring system performance;
• maintaining availability and reliability.

7.2 AI and Automation

Where applicable, personal data may be processed to:

• automate customer service processes;
• analyze and classify communications;
• route inquiries;
• generate suggested or automated responses;
• summarize interactions;
• identify relevant information;
• automate workflows;
• support customer service personnel;
• improve operational efficiency;
• manage multi-channel interactions.

AI processing will be performed only for defined and legitimate purposes and subject to applicable contractual and legal requirements.

7.3 Security and Fraud Prevention

We may process personal data to:

• protect our systems;
• detect and prevent unauthorized access;
• investigate security incidents;
• detect abuse, fraud or malicious activity;
• maintain audit and security logs;
• protect our users, customers and services.

7.4 Business and Customer Management

Including:

• managing commercial relationships;
• responding to inquiries;
• preparing proposals;
• invoicing;
• contract management;
• customer relationship management;
• providing technical and professional support.

7.5 Legal and Regulatory Compliance

We may process personal data where necessary to:

• comply with applicable laws;
• respond to lawful requests;
• establish, exercise or defend legal claims;
• comply with regulatory obligations;
• maintain required business records.

Where the GDPR applies, we process personal data on one or more of the following legal bases under Article 6 GDPR:

8.1 Performance of a Contract

Processing may be necessary to provide services, administer an account, perform contractual obligations or take steps at the individual's request before entering into a contract.

8.2 Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided that such interests are not overridden by the rights and freedoms of the individual. Examples may include:

• information security;
• fraud prevention;
• service improvement;
• business administration;
• customer relationship management;
• network and system security;
• protecting our legal rights.

8.3 Legal Obligation

Processing may be necessary to comply with a legal or regulatory obligation applicable to us.

8.4 Consent

Where required by law, we may rely on consent.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

DAGHAZAHAV may provide AI-based functionality as part of its software solutions.

AI functionality may assist in:

• analyzing communications;
• categorizing requests;
• generating responses;
• summarizing information;
• identifying patterns;
• recommending actions;
• automating predefined workflows;
• prioritizing or routing interactions.

AI-generated content may be produced automatically and may contain errors, inaccuracies or incomplete information. Customers should implement appropriate human review where required by the nature of the decision or applicable law.

Unless expressly agreed and lawfully implemented for a specific service, DAGHAZAHAV does not intend for its AI systems to make decisions that produce legal effects or similarly significant effects concerning individuals solely through automated processing.

Where Article 22 GDPR applies, appropriate safeguards and information will be provided in accordance with applicable law.

Where profiling is performed, information regarding the purpose, relevant logic, significance and envisaged consequences will be provided where required by applicable law.

Personal data submitted by customers or processed through customer environments will not be used to train general-purpose AI models or improve third-party foundation models for unrelated customers unless such use is specifically authorized by the customer, supported by an appropriate legal basis and permitted by the applicable contractual arrangements.

Where AI models or third-party AI services are used to process customer data, such processing will be governed by the applicable contractual arrangements and data protection requirements.

DAGHAZAHAV may use appropriately aggregated, anonymized or otherwise non-personal information for analytical, statistical, security and service-improvement purposes where permitted by applicable law.

Where DAGHAZAHAV processes personal data on behalf of a business customer, DAGHAZAHAV generally acts as a Data Processor and the customer acts as the Data Controller.

In such circumstances, DAGHAZAHAV will:

• process personal data only on documented instructions from the customer;
• implement appropriate technical and organizational security measures;
• ensure confidentiality of persons authorized to process personal data;
• assist the customer, where required, with data subject requests;
• assist with security incidents and data breaches;
• assist with relevant GDPR compliance obligations;
• maintain appropriate records and documentation;
• use sub-processors only in accordance with applicable contractual arrangements;
• delete or return personal data following termination of the applicable services, subject to legal retention requirements.

Where required, the parties may enter into a Data Processing Agreement ("DPA") incorporating the requirements of Article 28 GDPR.

We may disclose personal data to:

• employees and authorized personnel;
• affiliated entities, where applicable;
• software and cloud service providers;
• hosting providers;
• infrastructure providers;
• communication providers;
• AI technology providers;
• analytics and monitoring providers;
• customer support providers;
• professional advisers;
• legal, regulatory or governmental authorities where legally required;
• other processors and sub-processors necessary to provide the services.

We require service providers that process personal data on our behalf to implement appropriate contractual, technical and organizational safeguards.

We do not sell personal data to third parties.

Our services may integrate with or rely on third-party technologies and platforms.

Depending on the solution, these may include services such as:

• Firebase;
• Google services;
• Google Sheets;
• WhatsApp APIs or communication services;
• cloud infrastructure providers;
• hosting providers;
• AI and machine-learning service providers;
• monitoring and security providers.

The specific providers used for a particular customer or service may vary.

Where a third-party provider processes personal data on our behalf, we will seek to ensure that an appropriate data processing arrangement and applicable GDPR safeguards are in place.

DAGHAZAHAV may use service providers located outside Israel, the European Economic Area ("EEA") or the United Kingdom.

Where personal data is transferred outside the EEA, we will implement an appropriate transfer mechanism as required by applicable data protection law, which may include:

• an adequacy decision;
• Standard Contractual Clauses ("SCCs");
• appropriate supplementary measures;
• another lawful transfer mechanism recognized under applicable law.

Information regarding relevant international transfers and applicable safeguards may be obtained by contacting us at: contact@goldfish.systems

We implement appropriate technical and organizational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• accidental or unlawful destruction;
• accidental loss;
• alteration;
• unauthorized processing;
• other unlawful or unauthorized use.

Security measures may include, depending on the relevant service:

• access controls;
• authentication mechanisms;
• encryption in transit;
• encryption at rest where appropriate;
• logging and monitoring;
• backup mechanisms;
• network security controls;
• vulnerability management;
• secure development practices;
• employee confidentiality obligations;
• incident response procedures;
• segregation of customer environments where applicable.

No method of transmission or storage can be guaranteed to be completely secure.

Where DAGHAZAHAV becomes aware of a personal data breach affecting personal data processed on behalf of a customer, we will notify the relevant customer without undue delay in accordance with applicable contractual and legal requirements.

Where DAGHAZAHAV acts as a Data Controller, we will handle personal data breaches in accordance with applicable legal requirements, including notification to a supervisory authority and/or affected individuals where required.

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, provide the relevant services, comply with legal obligations, resolve disputes, enforce agreements and protect our legitimate interests.

Retention periods may vary depending on:

• the type of personal data;
• the purpose of processing;
• contractual requirements;
• legal or regulatory requirements;
• security requirements;
• whether the data is processed on behalf of a customer.

Where DAGHAZAHAV acts as a Data Processor, personal data will generally be retained according to the customer's documented instructions and the applicable agreement.

Where a specific retention period cannot reasonably be determined in advance, we use criteria such as the purpose of processing, legal requirements and operational necessity to determine the retention period.

Our website and services may use cookies and similar technologies for purposes such as:

• operating the website;
• maintaining security;
• remembering preferences;
• analyzing website usage;
• improving functionality;
• measuring performance.

Where required by applicable law, non-essential cookies will only be used after obtaining the required consent.

Additional information regarding cookies may be provided through our cookie banner or a separate Cookie Policy.

Where the GDPR applies, you may have the following rights:

Right of Access

You may request confirmation as to whether we process your personal data and request access to such data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

In certain circumstances, you may request deletion of your personal data.

Right to Restriction

You may request restriction of processing in certain circumstances.

Right to Data Portability

Where applicable, you may request to receive certain personal data in a structured, commonly used and machine-readable format or request that it be transferred to another controller.

Right to Object

You may object to certain processing, including processing based on legitimate interests.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.

To exercise your rights, please contact:

Privacy Contact: Oren

• Email: contact@goldfish.systems
• Telephone: 054-2012000

We may request information reasonably necessary to verify your identity before processing a request.

We will respond to valid requests within the timeframe required by applicable law.

Where DAGHAZAHAV acts solely as a Data Processor on behalf of a customer, we may refer the request to the relevant Data Controller or assist the customer in responding to the request, as required under the applicable agreement and law.

If you believe that we have processed your personal data unlawfully, you may contact us using the details above.

Where the GDPR applies, you also have the right to lodge a complaint with a competent data protection supervisory authority.

You may contact the supervisory authority in the EU/EEA country where you live, work, or where you believe the alleged infringement occurred.

Our services are generally intended for businesses and organizations and are not directed specifically at children.

We do not knowingly collect children's personal data through our website for purposes unrelated to the services.

Where customer platforms may process information relating to children, the relevant customer is responsible for ensuring that such processing has an appropriate legal basis and complies with applicable child-data protection requirements.

Where permitted by applicable law, we may use contact information to communicate with existing customers and business contacts regarding our services, updates, products or relevant business information.

Where consent is required, we will obtain the appropriate consent.

You may opt out of marketing communications at any time by following the unsubscribe mechanism provided in the relevant communication or contacting us directly.

Our website or services may contain links to third-party websites, platforms or services.

We are not responsible for the privacy practices, content or security of third-party websites.

We recommend reviewing the privacy policy of each third-party service before providing personal data.

We may update this Privacy Policy from time to time to reflect changes in:

• our services;
• technology;
• legal or regulatory requirements;
• our data processing practices;
• security measures.

The updated version will be published on our website and the "Last Updated" date will be amended accordingly.

If you have questions regarding this Privacy Policy, our processing of personal data, or your rights, please contact us:

• Legal name: GOLDFISH SYSTEMS LTD
• Trading name: DAGHAZAHAV / GOLDFISH
• Company registration number: 516187325
• Registered address: PINKAS 7, BNEI BRAK, ISRAEL
• Country: Israel
• Website: https://daghazahav.com
• Email: contact@goldfish.systems
• Telephone: 054-2012000