Privacy Notice

This notice explains how the operator of the Attendees attendance system processes the personal data of visitors to the attendees.eu website, prospective customers and customers. It fulfils the duty to inform under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Act No. 110/2019 Coll., on Personal Data Processing.

Who processes the data#

The controller of personal data is Ing. Matěj Kmínek, a natural person carrying on business under the Trade Licensing Act, with registered office at Nová Lhota 34, 286 01 Kluky, Company ID 02877961, VAT ID CZ8708210016 (the "operator").

For any data protection matter, contact the operator by e-mail at [email protected], by phone at +420 721 351 040 or in writing at the registered office address. The operator has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR.

The operator's two roles#

The operator acts in two roles:

• As a controller, it processes data about which it decides itself: data from the website (the contact form, installation requests, technical server logs) and customer data needed to conclude the contract, invoice and provide support. This notice applies to that processing.
• As a processor, it stores the data that the customer enters into its attendance system: data about the customer's employees, their attendance, chips, journeys and bulk e-mails. The controller of that data is the customer (the employer), who decides on its purpose and scope. The relationship between the customer and the operator is governed by the Data Processing Agreement. The customer's employees exercise their rights primarily with their employer; the operator assists the employer in this.

What data we process and why#

Contact form#

From a message sent through the form on the Contact page, we process the name, e-mail address, optionally the company name, and the text of the message. We use the data only to handle the enquiry and for the follow-up communication. The legal basis is the operator's legitimate interest in answering the enquiry (Article 6(1)(f) GDPR) and, where the enquiry concerns the conclusion of a contract, taking steps at the request of the enquirer prior to entering into a contract (Article 6(1)(b) GDPR). To protect the form against abuse, we temporarily record the number of messages sent from a single IP address; we keep the IP address only in an irreversibly hashed form and for no longer than one hour.

Installation request#

The installation form asks for the company name, the administrator's e-mail address, the system address (subdomain) and the chosen licence; with the request we store the IP address from which it was sent and the time it was sent. The data is used to set up the system, to send the confirmation link and to protect against the mass creation of systems (limiting the number of requests per e-mail address and per IP address). The legal basis is the performance of a contract and steps taken prior to entering into it (Article 6(1)(b) GDPR) and the legitimate interest in the security of the service (Article 6(1)(f) GDPR).

Once the installation starts, we keep a record of the acceptance of the Terms of Service and the Data Processing Agreement (the system address, the administrator's e-mail address, the licence, the versions of both documents, the time and the IP address) for the duration of the contract and 3 years after it ends, as proof that the agreement was concluded; the legal basis is the legitimate interest in proving the concluded agreement (Article 6(1)(f) GDPR) and compliance with a legal obligation.

The form is protected by the Cloudflare Turnstile service, which verifies that it is being filled in by a human. Turnstile processes technical data about the browser and the IP address; it is used only on the installation page.

Orders, invoicing and support#

For a paid licence, we process the customer's billing details (company name or name, registered office, Company ID, VAT ID, contact e-mail address and phone number), details of the chosen licence, issued invoices and payments, and correspondence with support. The legal basis is the performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations in accounting and tax (Article 6(1)(c) GDPR). We also use the customer's contact details to send operational notices (changes to the terms, changes of sub-processors, planned downtime) on the basis of legitimate interest.

Technical server logs#

On every visit, the web server records the IP address, the time, the requested address, the server's response and the browser identification. In addition, the application writes error reports (logs of the Tracy tool), which may contain the address of the request. The logs serve to ensure the operation and security of the service and to detect attacks; the legal basis is the operator's legitimate interest (Article 6(1)(f) GDPR).

How long we keep the data#

Category	Retention period
Messages from the contact form	in the operator's mailbox for as long as the enquiry and the follow-up communication are being handled, no longer than 3 years after the end of the contract
Installation request	deleted as soon as the administrator's password is displayed after the installation is completed; an unfinished request is deleted after the link expires (2 hours), when the next request is processed
Record of acceptance of the terms and the data processing agreement	for the duration of the contract and 3 years after it ends
Hashed IP address for limiting the contact form	1 hour
Billing details and invoices	10 years from the end of the tax period (the VAT Act and the Accounting Act)
Correspondence with the customer	for the duration of the contract and 3 years after its termination, in view of possible claims
Web server access logs	90 days
Application error logs (Tracy)	30 days

Data in customers' attendance systems is governed by the Data Processing Agreement and the document Retention and Deletion.

Who can see the data#

The operator runs the business alone, without employees; only the operator has access to the data. We disclose data only to the following recipients:

• the hosting provider of the server on which the website and the attendance systems run: SecurityNet.cz s.r.o. (brand Hukot), U Velorexu 1301, 564 01 Žamberk, Czech Republic, company ID 27501418; the server is located in the Czech Republic,
• Cloudflare, Inc., which provides DNS, content delivery (CDN) and protection of the form through the Turnstile service,
• accounting, tax and legal advisers bound by confidentiality, and public authorities where required by law.

E-mails from the website and the systems are sent by the operator's own mail server (mail.kminet.eu); no other provider has access to them. The full list is in the document Sub-processors.

Transfers outside the European Union#

We store data in the Czech Republic. Cloudflare, Inc. is based in the United States and may have access to network data (in particular the IP address) when delivering pages. The transfer is based on the European Commission's adequacy decision under the EU-US Data Privacy Framework, under which Cloudflare is certified, and, as a fallback, on standard contractual clauses approved by the European Commission.

Your rights#

Under the GDPR, you have the right:

• of access to the data we process about you and to a copy of it (Article 15),
• to rectification of inaccurate data (Article 16),
• to erasure where the data is no longer needed or we process it unlawfully (Article 17),
• to restriction of processing, for example while the accuracy of the data is being verified (Article 18),
• to portability of the data you have provided to us and which we process by automated means on the basis of a contract (Article 20),
• to object to processing based on legitimate interest (Article 21); in that case we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests.

Send your request to [email protected]. We will reply without undue delay and within one month at the latest. So that we do not disclose data to the wrong person, we may ask you to verify your identity.

If you believe that our processing infringes the law, you may lodge a complaint with the supervisory authority: the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz. We would appreciate it if you contacted us first.

Automated decision-making#

There is no decision-making based solely on automated processing and no profiling within the meaning of Article 22 GDPR. The automatic limit on the number of requests from a single IP address is a security measure that produces no legal or similarly significant effects on anyone.

Cookies#

The attendees.eu website does not use analytics, advertising or any other tracking cookies and does not load any third-party tools for measuring traffic. The Contact page uses a technical session cookie that protects the form against forged submission. On the installation page, the Cloudflare Turnstile service stores its technically necessary data to verify that the form is being filled in by a human. The customer's attendance system uses only a technical session cookie that keeps the user logged in. Technically necessary cookies do not require consent (Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications).

Changes to this notice#

We may update this notice, for example when the service or the sub-processors change. The current version is always published on this page with its effective date; we inform customers of material changes by e-mail.