Privacy Policy
Sunshine in Interaction FlexCo
Jörgerstraße 51/2, 1170 Vienna, Austria
Commercial register (Firmenbuch) no.: FN 628732g
Contact: contact@sunshinetech.cc
Last updated: 10 July 2026
1. Introduction
This Privacy Policy explains how Sunshine in Interaction FlexCo ("Sunshine", "we", "us") processes personal data in connection with the Sunshine application (the "App"), which is made available through Cisco Webex App Hub, and with our website and business relationships.
We take the protection of personal data seriously and process it in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).
2. Our Two Roles: Controller and Processor
We process personal data in two distinct capacities, and it is important to understand the difference:
(a) As a processor — meeting interaction data. When an organization deploys the App for use among its members, that organization is the data controller and decides why and how meeting data is processed. Sunshine acts only as a processor on the organization's documented instructions, governed by a Data Processing Agreement (DPA). The controller — not Sunshine — is responsible for the legal basis for this processing and for obtaining any participant or employee consent, notices, or works-council/co-determination approvals required by law. Data subjects should direct requests concerning this data to the deploying organization; we will assist that organization as required.
(b) As a controller — our own processing. For certain processing we determine the purposes and means ourselves and therefore act as the controller. This includes customer account and contract administration, billing, support communications, and operation of our website. This processing is described in Sections 4 onward.
3. Personal Data Processed Through the App (Sunshine as Processor)
The App analyzes patterns of interaction in online meetings. Specifically, it processes:
- Interaction metadata: which participant speaks, for how long, how often, and in what sequence relative to other participants.
- Participant identifiers: participant names and email addresses, used to attribute interaction patterns to individuals.
The App does not record or process the spoken content of meetings or any video signal at any time. Insights, dashboards, recommendations and reports are derived solely from the data listed above.
The purposes, legal basis and retention for this data are determined by the deploying organization as controller and set out in the applicable DPA.
4. Personal Data We Process as Controller
| Category | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account & contract data | name, business email, company, role, login credentials | provide and administer the App to business customers | Art. 6(1)(b) — contract |
| Support data | contents of support requests and correspondence | respond to and resolve inquiries | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest in supporting users |
| Website data | IP address and technical connection data | deliver and secure the website | Art. 6(1)(f) — legitimate interest |
| Marketing data (if applicable) | business email for newsletters/updates | send product information you requested | Art. 6(1)(a) — consent |
Where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object as described in Section 9.
5. Recipients and Processors
We share personal data only where necessary and use carefully selected service providers that act as our processors under Art. 28 GDPR. These include:
- DigitalOcean, LLC, as hosting/infrastructure provider, hosting the App and its data on servers located in Amsterdam, the Netherlands (EU/EEA).
- Email: support and general correspondence are handled through our own email inbox (contact@sunshinetech.cc); we do not use a third-party helpdesk platform.
- Cisco Systems, Inc., as operator of Webex and the App Hub, insofar as the App integrates with the Webex platform.
We do not sell personal data. We disclose data to public authorities only where legally required.
6. International Data Transfers
Personal data processed through the App is hosted within the EU/EEA (Amsterdam, the Netherlands). Where any other service provider processes data outside the EEA, we ensure an adequate level of protection through an appropriate safeguard under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs), and supplementary measures where required. You may request a copy of the relevant safeguards using the contact details above.
7. Retention
We retain personal data only as long as necessary for the purposes described:
- Meeting interaction data (processor role): retained for the duration determined by the deploying organization in the DPA, and by default for no longer than 3 years, after which it is deleted or returned.
- Account & contract data: retained for the duration of the customer relationship and deleted within 3 years after it ends.
- Support and website data: retained for no longer than 3 years, and deleted earlier where no longer needed for the relevant purpose.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, in accordance with Art. 32 GDPR. Because the App processes only interaction metadata and identifiers — and never meeting content or video — the data footprint is deliberately minimized by design.
9. Your Rights
Subject to the conditions of the GDPR, you have the right to:
- access your personal data (Art. 15);
- rectify inaccurate data (Art. 16);
- erase data ("right to be forgotten", Art. 17);
- restrict processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests, including direct marketing (Art. 21); and
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
To exercise these rights regarding data we control, contact us at contact@sunshinetech.cc. If your data is processed through the App on behalf of your organization (Section 2(a)), please contact that organization; we will support them in responding.
You also have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
10. Automated Decision-Making
The App produces metrics, recommendations and — where enabled — predictive indicators. These are advisory analytical aids intended to support human judgment. We do not use them to make decisions producing legal or similarly significant effects on individuals through solely automated means within the meaning of Art. 22 GDPR; a human is always responsible for any resulting decision.
11. Data Protection Officer
Based on the nature and scale of our processing, we have assessed that we are not legally required to appoint a Data Protection Officer under Art. 37 GDPR. For all data protection matters, please contact us at contact@sunshinetech.cc.
12. Cookies and Website
Our website at sunshinetech.cc does not use cookies or similar tracking technologies, and does not employ analytics or marketing trackers. When you visit the website, our hosting provider may process technical connection data (such as your IP address) to the extent necessary to deliver and secure the website, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
13. Changes to This Policy
We may update this Privacy Policy to reflect changes to the App, our processing, or legal requirements. The current version published on our website and App Hub listing applies. Material changes will be communicated where required by law.
14. Contact
Sunshine in Interaction FlexCo
Jörgerstraße 51/2, 1170 Vienna, Austria
contact@sunshinetech.cc