1. Controller
The controller of your personal data is Platytera, s.r.o., ID No. 19199686, VAT ID CZ19199686, with its registered office at Klimentská 1216/46, Nové Město, 110 00 Praha 1, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 382949 (“Platytera”, “we”).
You can contact us about any privacy matter at [email protected] or by post at the address above. We have not appointed a data protection officer, as we are not required to do so.
2. What data we process
- Account data — e-mail address, name, password (stored only as a cryptographic hash) and language settings, when you create an account in our applications.
- Business data you enter — your company details (name, ID No., VAT ID, address, bank account) and the content of invoices and other documents you create in the application.
- Communication data — the content of e-mails and messages you send us and your contact details.
- Contract and billing data — for customers of our services (software development, server rental, consulting) and buyers of industrial materials (synthetic rubber, oils, metalworking fluids): contact persons, billing details and contract history.
- Technical data — IP address, device type, operating system and application version, time of access, error and crash reports. These are needed to operate the service securely.
- Purchase data — if you buy a subscription through Google Play or the App Store, we receive only the information about the purchase and its validity. Payment card details are processed exclusively by Google or Apple; we never have access to them.
Our applications do not access your contacts, photos, location, microphone or camera unless a specific feature explicitly needs it and you grant permission in the operating system. You can withdraw such a permission at any time in the device settings.
3. Purposes and legal bases
- Providing the application and services and managing your account — performance of a contract (Art. 6(1)(b) GDPR).
- Invoicing, accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).
- Security, prevention of abuse, error diagnostics and service improvement — our legitimate interest (Art. 6(1)(f) GDPR).
- Answering your enquiries — our legitimate interest, or steps prior to entering into a contract.
- Informing about news of our products — only with your consent, or towards existing customers on the basis of legitimate interest, with an option to unsubscribe in every message.
- Defending legal claims — our legitimate interest.
We do not sell personal data, do not use it for advertising profiling and do not make decisions producing legal effects solely by automated means.
4. Data of your customers in the application
When you enter data about your own customers or business partners into the application (for example on an invoice), you are the controller of that data and Platytera processes it as your processor under Art. 28 GDPR, solely to provide the service and according to your instructions given by using the application. The processing terms form part of the Terms of Use. We do not use this data for any purpose of our own.
5. Recipients and processors
We store application data primarily on our own servers located in a data centre in the Czech Republic. Data may be accessed, to the necessary extent, by:
- providers of e-mail delivery and other technical services we use to operate the applications, bound by a data processing agreement;
- Google Ireland Ltd. and Apple Distribution International Ltd. in connection with the distribution of the applications, purchases and push notifications;
- our accountants, tax and legal advisers, who are bound by confidentiality;
- public authorities, where required by law.
We aim to process data within the European Union / EEA. If a transfer outside the EEA occurs, it is made only on the basis of a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses.
6. How long we keep data
- Account and application data — for as long as you have an account; after deletion of the account within 30 days, backups within a further 90 days.
- Accounting and tax documents — for the period required by law (typically 10 years).
- Communication — up to 3 years after the matter is closed.
- Technical logs — up to 90 days, unless needed to investigate a security incident.
7. Deleting your account and data
You can delete your account directly in the application (Settings → Account → Delete account). Deleting the account removes your profile and all data you have entered into the application, except for data we must keep by law.
If you no longer have access to the application, send a request for deletion from the e-mail address registered with your account to [email protected] with the subject “Account deletion”. We will verify the request and delete the account within 30 days at the latest. You can also ask us to delete only some data without deleting the whole account.
Before deleting, we recommend exporting your invoices, as deletion cannot be undone. Uninstalling the application does not delete the account and does not cancel a subscription — subscriptions are cancelled in the Google Play or App Store settings.
8. Your rights
- access to your personal data and a copy of it;
- rectification of inaccurate data;
- erasure (“right to be forgotten”);
- restriction of processing;
- data portability in a machine-readable format;
- objection to processing based on legitimate interest, including direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing.
Exercise your rights at [email protected]. We will respond without undue delay, within one month at the latest. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz).
9. Security
We protect data by technical and organisational measures appropriate to the risk: encryption in transit (TLS), hashing of passwords, access control on a need-to-know basis, regular backups, updates and monitoring of our infrastructure. In the event of a personal data breach we will proceed in accordance with Art. 33 and 34 GDPR.
10. Children
Our applications and services are intended for entrepreneurs and companies and are not directed at children under 16. We do not knowingly collect data of children; if we learn of it, we will delete the data.
12. Changes to this policy
We may update this policy when our services or legal requirements change. We will publish the current version on this page with the date of the last update; we will notify registered users of material changes in the application or by e-mail in advance.