Version 1.0, effective from 1 November 2026
Records of Processing Activities
This document contains the records of processing activities under Article 30 of the General Data Protection Regulation (GDPR) kept by the operator of the Attendees attendance system. The records are divided according to the operator's role: as controller (Article 30(1)) and as processor for customers (Article 30(2)).
The operator has fewer than 250 employees, but keeps the records because the processing is regular rather than merely occasional.
Identification
| Item | Value |
|---|---|
| Controller and processor | Ing. Matěj Kmínek, Nová Lhota 34, 286 01 Kluky |
| Company ID / VAT ID | 02877961 / CZ8708210016 |
| Contact | [email protected], +420 721 351 040 |
| Representative in the EU | not appointed (the operator is established in the EU) |
| Data protection officer | not appointed (no obligation arises) |
The operator as controller (Art. 30(1))
| Activity | Purpose | Data subjects | Categories of data | Legal basis | Recipients | Transfers to third countries | Erasure time limit |
|---|---|---|---|---|---|---|---|
| Contact form | handling the enquiry and follow-up communication | enquirers | name, e-mail, company, message text; hashed IP address for limiting the number of messages | Art. 6(1)(f), or (b) where applicable | hosting provider | no | messages: 3 years after the end of the contract; IP address hash: 1 hour |
| Request to install a system | setting up the system, confirmation link, protection against abuse | prospective users of the system (the person setting up the system) | company name, e-mail, subdomain, licence, IP address, time of the request | Art. 6(1)(b) and (f) | hosting provider; Cloudflare (Turnstile) | USA (Cloudflare, DPF) | once the administrator password has been displayed; incomplete requests once the link expires (2 hours) |
| Contractual relationship and invoicing | conclusion and performance of the contract, invoicing, debt recovery | customers and their contact persons | billing and contact details, licence, invoices, payments | Art. 6(1)(b) and (c) | accountant and tax adviser; public authorities where required by law | no | 10 years from the end of the tax period |
| Support and service notices | answering queries, notices of changes | administrators of customers' systems | name, e-mail, telephone, content of communication | Art. 6(1)(b) and (f) | – | no | term of the contract plus 3 years |
| Operation and security of the website | server operation, detection of attacks and errors | visitors to the website and the systems | IP address, time, request address, browser identification, error reports | Art. 6(1)(f) | hosting provider; Cloudflare | USA (Cloudflare, DPF) | access logs: 90 days; Tracy logs: 30 days |
The operator as processor (Art. 30(2))
| Item | Description |
|---|---|
| Controllers on whose behalf the processor acts | customers who have an Attendees attendance system; each is identified by the address of its system <name>.attendees.eu and by the details in the system settings; the operator keeps the list in its register of installed systems |
| Categories of processing | storage, display, editing and calculation of attendance, creation of reports and exports, sending e-mails from the system (regular reports, infomail), backup, restore, erasure |
| Data subjects | employees and other workers of the customer, users of the system, persons using the terminal |
| Categories of data | identification and contact details, details of employment and working hours, attendance including type of absence, bonuses, RFID chip identifiers, trips and vehicles, infomail content, records of activity in the system including IP addresses, password hashes |
| Sub-processors | SecurityNet.cz s.r.o. (brand Hukot), U Velorexu 1301, 564 01 Žamberk, Czech Republic, company ID 27501418; Cloudflare, Inc. (see Sub-processors) |
| Transfers to third countries | Cloudflare, Inc., USA, on the basis of the EU-US Data Privacy Framework, with standard contractual clauses as a fallback; the systems' data are stored in the Czech Republic |
| Technical and organisational measures | see Technical and Organisational Measures |
| Erasure | within 30 days of the end of the licence; backups within 30 days (see Retention and Deletion) |
Updating the records
The operator updates the records whenever the processing, the sub-processors or the time limits change, and reviews them at least once a year. It makes them available to the Office for Personal Data Protection (ÚOOÚ) on request.