This English text is a courtesy translation. The legally binding version of this data-processing information is the Czech original, available here. Capitain in CZ/SK is operated by Digital Hotspot CZ s.r.o.

Personal Data Processing Information

Digital Hotspot CZ s.r.o., IČO: 177 75 710, with registered office at Radlická 663/28, Smíchov, 150 00 Praha 5, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 376505 (hereinafter the "Operator"), acting as controller of personal data and operator of the platform "capitain.io" (hereinafter the "Platform"), hereby provides information on the processing of personal data that takes place in connection with the operation and use of the Platform, and on the rights that data subjects hold in connection with such processing.

The Operator acts as controller in relation to the personal data of Clients (or persons acting on their behalf with the Operator). In relation to the personal data of Clients' customers (customer data) that the Client uploads to and may process within the Platform, the Operator acts as a personal data processor for the Client. The Operator's obligations as processor are governed by the data processing agreement, which forms part of the Operator's Terms & Conditions for use of the Platform, available at https://www.capitain.cz/en/obchodni-podminky/ (hereinafter the "Terms & Conditions").

For any questions regarding privacy and the exercise of your rights, please use the e-mail address podpora@capitain.app.

1. For what purposes, on what legal bases, and what personal data do we process?
   1. Conclusion and performance of the Contract

      The Operator permits use of the Platform by its clients (hereinafter "Client") only on the basis of a contract concluded with the relevant Client under the terms and by the procedure set out in the Operator's Terms & Conditions (hereinafter the "Contract"). For the purpose of negotiating and concluding the Contract and its subsequent performance, the Operator processes the following personal data:

      • identification and contact details of the Client as a natural person (first name, surname, IČO, tax identification number, registered office, e-mail, telephone number),
      • access credentials to the Client's account and, where applicable, those of users,
      • billing details of the Client as a natural person,
      • data from communications with the Client and other data relating to performance of the Contract,
      • data concerning payments made for use of the Platform, to the extent of the payment method used (payment account number, payment identifier, date of payment).

      Without the above data it is not possible to conclude and/or perform the Contract; accordingly, without providing such data it is not possible to grant the Client access to the Platform and permit its use. The legal basis for processing this data is the conclusion and performance of the Contract at the Client's request.

   2. Compliance with legal obligations

      The Operator must process personal data in cases where it is required to do so by law. For this purpose the Operator processes personal data primarily to the extent required by the relevant legislation in connection with the Operator's obligation to maintain accounts and to fulfil related tax obligations, and where applicable for the fulfilment of obligations imposed by archiving legislation.

   3. Legitimate interests of the Operator

      In justified cases the Operator may also process personal data on the legal basis of the protection of legitimate interests. The Operator always carefully assesses and ensures that the interest in processing your data for this purpose does not disproportionately interfere with your privacy.

      Identification of persons acting on behalf of the Client: These are typically members of statutory bodies, employees, or other authorised persons who are not a party to the Contract but who conclude the Contract with the Operator on behalf of the Client and otherwise act on behalf of the Client. We need the personal data of these persons in order to be able to communicate and interact with them on behalf of the Client for the purpose of concluding the Contract and its subsequent performance. We typically process the following data of such persons: first name, surname, e-mail address, telephone number, delivery address, job title or other relationship to the Client, and data from communications with them.

      Defence and enforcement of the Operator's legal claims: The Operator also processes personal data for the purpose of protecting its legitimate interest in having the ability to defend itself in potential legal disputes, proceedings before courts, or inspections by state authorities or other public administration bodies. The Operator processes this data in order to be able, where necessary, to demonstrate that it acted in accordance with its contractual obligations and applicable legislation.

      Analysis and improvement of the Platform: The Operator also processes data concerning the activity of the Client and individual users within the Platform (activity logging) for the purpose of protecting its legitimate interest — the analysis of Platform usage and its further improvement. For these purposes the Operator collects and further processes data such as IP address, date and time of access to the Platform, use of its functions, login history, information about the user's internet browser, the device used, and language settings.

      Evidence of consent to the Terms & Conditions: When concluding a contract with a Client online (by electronic means), we retain data necessary to identify the Client as a contracting party, so that in the event of later doubts or disputes we have a timestamp available as evidence of the conclusion of the contract and of consent to our Terms & Conditions in the specific version in force at that time.

   4. Sending commercial communications

      In the case of Clients with whom we have concluded a Contract and in connection with which we have obtained their e-mail address, or in the case of other persons who have actively and voluntarily subscribed to our newsletters (for example on the Operator's website), we process this e-mail address for the purpose of sending information and news about our services and products (commercial communications).

      The legal basis for processing personal data for the purpose of sending commercial communications is, in the case of our Clients, the Operator's legitimate interest. The Client may at any time, free of charge, opt out of receiving further commercial communications by following the procedure set out in each commercial communication sent, or by contacting us at any time using the contact e-mail address set out above in this document.

      The legal basis for processing personal data for the purpose of sending commercial communications is, in the case of persons who have themselves actively subscribed to the newsletter (regardless of whether they are Clients), their consent, which was given by subscribing to receive commercial communications. If you do not wish to receive these messages from us, you may at any time unsubscribe from them free of charge by following the procedure set out in each commercial communication sent, or by contacting us at any time using the contact e-mail address set out above in this document.

   5. Targeting of commercial communications (profiling)

      For the purpose of sending commercially relevant communications tailored to a specific Client, we may carry out profiling of persons to whom we send commercial communications, based on data about their use of the Platform.

      In the case of Clients whose contact information we have obtained in connection with the conclusion of a Contract and who have not opted out of commercial communications, and to whom we send commercial communications on the basis of our legitimate interest (see above), we also carry out such processing (profiling) on the basis of our legitimate interest (sending commercial communications that are as relevant as possible and correspond to the recipient's preferences).

      In the case of persons to whom we send commercial communications on the basis of their express consent to receive commercial communications, we also carry out this processing (profiling) on the basis of their consent.

      If you do not wish us to process your personal data in this way for the purpose of targeting advertising, you may at any time object to such processing in the same manner as you may withdraw your consent to the sending of commercial communications, as set out above. If you do so, we will no longer process your personal data for the purposes of advertising and content targeting.

2. From whom do we receive personal data and to whom do we transfer it?

   We obtain personal data primarily from you and from your activity within the Platform (logging).  We may also obtain personal data from third parties, namely from publicly available sources such as ARES or the VAT register. You are obliged to provide us only with accurate data, and if your personal data changes, you must update it.

   We may transfer personal data, under the conditions laid down by legislation, to public administration bodies where we are required to do so by law, or where the relevant authority requests it within the scope of its powers.

   For data processing we use the following processors:

   • eurodata AG, Großblittersdorfer Straße 257-259, 66119 Saarbrücken, Germany, as the provider of the information extraction service;
   • advertia digital s.r.o., IČO 270 86 411, with registered office at Tusarova 1215/55, Holešovice, 170 00 Praha 7, as provider of marketing services;
   • This One s.r.o., IČO 037 34 404, with registered office at Jankovcova 1569/2c, Holešovice, 170 00 Praha 7, for the purpose of development and advancement of the Platform, and as the provider of technical support in the event of unavailability of Platform functions;
   • compacer CZ s.r.o., IČO 248 41 234, with registered office at Jugoslávských partyzánů 639/26, Bubeneč, 160 00 Praha 6, for the purpose of development and advancement of the Platform,
   • compacer GmbH, registration number HRB 752968, with registered office at 71116 Gärtringen, Max-Planck-Strasse 6-8, Federal Republic of Germany, for the purpose of development and advancement of the Platform.
   • SPENDEE a.s., IČO 05912890, with registered office at náměstí I. P. Pavlova 1789/5, Nové Město, 120 00 Praha 2, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 272892 — for bank integration and synchronisation of banking transactions. Spendee processes transactional data, account numbers, and account balances in accordance with its privacy policy. Online banking login credentials are not stored as standard and are used only upon manual entry, unless you choose to save them voluntarily.

   Unless stated otherwise above, personal data is not transferred outside the EU. When transferring data outside the EU, the Operator ensures appropriate data protection in accordance with EU legislation; transfers are in particular always based on standard contractual clauses concluded with the individual processors.

3. How do we process personal data?

   We process your personal data manually in accordance with the relevant purpose. Our employees or other persons working for us may be involved in the management of your data. However, such persons may process personal data only under the conditions and to the extent set out above, and are bound by a duty of confidentiality in relation to personal data and security measures whose disclosure would compromise the security of personal data.

   Personal data may be processed in electronic form by automated means, specifically within the system operating the Platform or by the systems of individual processors as listed above.

   We always process personal data in accordance with applicable legislation and ensure it receives appropriate care and protection. We take care to ensure that you do not suffer harm to your rights, in particular the right to the preservation of human dignity and to your private and personal life.

4. How long do we process personal data?
   1. Contract with the Client

      Personal data processed for the purposes of concluding and performing the Contract is processed for the duration of the conclusion and performance of the given Contract (i.e. for the period necessary to fulfil the obligations arising from it). Even after that period we may process personal data for the following purposes:

   2. Compliance with legal obligations

      Personal data processed on the basis of our statutory obligations is processed within the time limits laid down by those laws.

      Personal data required by legislation governing the Operator's tax and accounting obligations (typically billing details and information about the performance provided) must be processed for the purposes of accounting and fulfilment of tax obligations. The processing period is 5 years from the end of the accounting period; in the case of documents relevant to VAT payments it is 10 years from the end of the tax period in which the performance took place. Relevant personal data is archived in accordance with the requirements of archiving legislation for the periods specified therein.

   3. Legitimate interests

      Even after the termination of the Contract we process personal data to protect our legitimate interests (i.e. defence against potential claims by Clients or third parties, including before courts) for the duration of the applicable limitation periods, which in the Czech Republic may last up to 15 years from the occurrence of the relevant event. If the relevant claim is not brought, this period is typically 5 years from the termination of the Contract.

      Information about use of the Platform for the purposes of analysing its use and improving it is processed to protect our legitimate interests for the duration of the Contract. After the expiry of this period we may process such data further only in anonymised form.

   4. Sending commercial communications

      We send commercial communications, as described above, until you unsubscribe from them.  The option to unsubscribe is included in each communication sent and is free of charge. You may also unsubscribe from commercial communications using the contact e-mail address set out above.

      Personal data may be processed for longer than set out above in cases where a relevant reason for further processing arises, such as the commencement of administrative or judicial proceedings for which the personal data is relevant.

5. What are your rights?

   First and foremost, you have the right to request access to your personal data, including a copy of all your personal data. You may exercise this right using the e-mail address set out at the top of this document.

   Withdrawal of consent to processing: If we process your personal data on the basis of your consent, you may at any time freely and free of charge withdraw your consent to its processing by using the contact e-mail address set out above, or as otherwise indicated elsewhere in this document. In such case we will no longer process your personal data that was being processed on the basis of consent.

   In respect of personal data that is not processed on the basis of consent, it is not possible to withdraw consent to processing. However, we will always assess, upon your request, whether it is necessary to continue processing your personal data for any of the purposes set out above.

   Your further rights:

   We will always inform you of:

   • the purpose of processing personal data,
   • the personal data, or categories of personal data, that are the subject of processing, including all available information about their source,
   • the nature of automated decision-making, including profiling, and information relating to the procedure used, as well as the significance and the envisaged consequences of such processing for the data subject,
   • the recipient, or categories of recipients, to whom personal data have been or will be transferred, and in the case of transfers of personal data to a third country also the appropriate safeguards relating to the transfer to ensure the security of personal data,
   • the envisaged period for which personal data will be stored, or if that is not possible, the criteria used to determine that period,
   • all available information about the source of personal data, where it was not obtained from you.

   Your further rights include the right to:

   • request an explanation from us,
   • require us to remedy the situation, which may in particular involve blocking, rectification, completion, restriction of processing, or erasure of personal data (the right to be forgotten),
   • request a copy of the personal data being processed, or to request the personal data concerning you in a structured, commonly used, and machine-readable format, and to transfer such data to another controller without hindrance from us,
   • lodge a query or complaint with the Office for Personal Data Protection, www.uoou.gov.cz, Pplk. Sochora 27, 170 00 Praha 7,
   • object to the processing of personal data concerning you.
6. How we protect your personal data

   We protect your data. The principal security measures we use include: firewall, encryption, backup, multi-factor authentication, physical infrastructure security, and others.

This version of the Personal Data Processing Information takes effect on 1 January 2026.