Privacy Policy

1. Data controller and processor

1.1 Platform operator (processor)

TimeDeals Pavelka
Berglistrasse 28a, 8180 Bülach, Švýcarsko
UID: CHE-393.597.780
Einzelunternehmen (samostatně výdělečně činná osoba, Švýcarsko)
E-mail: privacy@sprav.cz

The platform operator acts as a processor within the meaning of Art. 28 GDPR / Art. 9 DSG in relation to member data of organizations. The platform processes data on behalf of and under the instruction of individual organizations.

1.2 Controller of member data

The controller of personal data of members is always the relevant organization (association, HOA, interest group) that uses the platform to manage its members, voting, and documents. The organization determines the purposes and means of processing.

1.3 Operator as controller

For data processed for the purpose of operation and security of the platform itself (account registration, login sessions, security logs, abuse protection), the operator acts as an independent controller.

2. Categories of processed data

We do not process special categories of data (sensitive data) within the meaning of Art. 9 GDPR, unless such data is entered into the system by users themselves or organization administrators (e.g., in document text). The relevant organization is responsible for user-entered content.

3. Purposes of processing and legal bases

The legitimate interest in audit logs and voting records lies in the need for organizations to prove proper decision-making processes and in the need for the operator to protect platform integrity. This interest overrides the right to erasure, as erasure would make retrospective control and legal defense of the organization impossible (Art. 17(3)(e) GDPR). For organizations based in Czechia: § 258 et seq. Civil Code for associations, § 1200 et seq. Civil Code for HOAs. For organizations based in Slovakia: z. č. 83/1990 Zb., z. č. 182/1993 Z.z..

4. Retention period

IP addresses in the audit log are anonymized after 1 year. User agent is removed after 1 year. Accounting records (payments, invoices) are retained 10 years: for organizations in Czechia according to § 31 zák. č. 563/1991 Sb., for organizations in Slovakia according to the Accounting Act z. č. 431/2002 Z.z..

5. Audit logs and voting records — special regime

Audit logs and voting records serve to prove proper decision-making processes in the organization. These records cannot be deleted upon request as long as there is a legitimate interest of the organization in their retention (Art. 17(3)(e) GDPR — erasure does not apply if processing is necessary for the establishment, exercise, or defense of legal claims).

Upon deletion of the user account, identification data (email address, password hash, name) are immediately and irreversibly anonymized within one atomic transaction. The email address is replaced with a system placeholder text, the password hash is overwritten with a random value, and the name is removed. After deletion, there is no retention period and no possibility of account restoration.

Voting records and relevant audit logs are pseudonymized upon account deletion — the user identifier is replaced with an anonymous placeholder text, but the factual record itself (vote, action, date) remains preserved.

Email delivery records (EmailLog) serve as proof that the organization sent a notification to its members (e.g., voting invitation, results). These records are retained even after user account deletion, with the link to the user broken (userId is set to null).

6. Recipients and sub-processors

We share data only to the necessary extent with the following recipient categories:

• Hosting and databases: Server infrastructure provider in the EU (PostgreSQL databases). Data is processed exclusively within EU/EEA territory.
• Email service: Postmark (ActiveCampaign, LLC, USA) — for sending transactional emails. Transfer to the USA is ensured on the basis of the EU-U.S. Data Privacy Framework. Only recipient addresses and email content in the scope necessary for delivery are processed.
• Payment service: Stripe, Inc. (USA) — for payment processing. Transfer to the USA is ensured on the basis of the EU-U.S. Data Privacy Framework. Processed are: email, amount, organization identifier.
• Error tracking service: Sentry (Functional Software, Inc., USA) — for diagnosing technical problems. Only technical error data is processed, without personal data.
• Organization administrators: Administrators of individual organizations have access to member data of their organization in the scope necessary for managing membership, voting, and documents.

We do not sell data, do not provide it to advertising networks, and do not share it with third parties beyond the above.

7. Transfer to third countries

The operator is based in Switzerland. The European Commission has recognized Switzerland as a country ensuring an adequate level of data protection (adequacy decision). Data transfer between the EU and Switzerland does not require additional safeguards.

For the email delivery service (Postmark/USA), the EU-U.S. Data Privacy Framework applies. In case of changes to this framework, appropriate measures will be taken (standard contractual clauses or another mechanism under Art. 46 GDPR).

8. Cookies and technical means

The platform uses exclusively necessary (technical) cookies for managing the login session. These cookies:

• Do not track users across websites
• Do not contain personal data (only cryptographic token hash)
• Have limited validity (max. 30 days)
• Are set as HttpOnly and Secure

We do not use analytical, marketing, or any other third-party cookies. Consent for cookies is therefore not required (exception under Art. 5(3) of Directive 2002/58/EC).

9. Your rights

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR / Art. 25 DSG): You can request information about what data we process about you and a copy of this data.
• Right to rectification (Art. 16 GDPR / Art. 32(1) DSG): You can request rectification of inaccurate data.
• Right to erasure (Art. 17 GDPR / Art. 32(2)(c) DSG): You can request deletion of your account. Identification data (email, password, name) are immediately and irreversibly anonymized — the account cannot be restored. Voting records and audit logs will be pseudonymized (see point 5). Complete erasure of these records is not possible due to Art. 17(3)(e) GDPR.
• Right to restriction of processing (Art. 18 GDPR): In cases provided by law (CZ) / in cases provided by law (SK).
• Right to data portability (Art. 20 GDPR): You have the right to export your data in a machine-readable format. Organization administrators can export organization data.
• Right to object (Art. 21 GDPR / Art. 32(2)(b) DSG): Against processing based on legitimate interest.
• Right to lodge a complaint with the supervisory authority (see point 10).

How to exercise your rights

Send requests to privacy@sprav.cz. For identity verification, we may request confirmation from the email address associated with your account. We will respond to the request without undue delay, at the latest within 30 days.

You can also submit an account deletion request directly in the profile settings on the platform (if this feature is available) or by email.

Withdrawal of consent

You can withdraw your consent at any time in the profile settings (Profile → Privacy → Withdraw consent). After withdrawal, your account will be suspended. To restore access, consent must be granted again.

10. Supervisory authorities

If you believe that the processing of your data is not in accordance with legislation, you can lodge a complaint with the competent supervisory authority:

• Czechia: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7 www.uoou.cz
• Slovakia: Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava
• Switzerland (CH): Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern www.edoeb.admin.ch
• Germany (DE): Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI), Graurheindorfer Str. 153, 53117 Bonn www.bfdi.bund.de
• Austria (AT): Datenschutzbehörde (DSB), Barichgasse 40–42, 1030 Wien www.dsb.gv.at

11. Technical and organizational measures

The platform implements appropriate technical and organizational measures to protect data:

• Passwords stored exclusively as hash (Argon2id)
• Login sessions protected by cryptographic token (SHA-256)
• Communication encrypted via TLS (HTTPS)
• CSRF protection for all mutating requests
• Brute-force protection (rate limiting, login throttle)
• Integrity seals (SHA-256 hash) on key records
• Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
• Regular integrity verification of records on the timeline (SHA-256 seals)

Details about security measures can be found on the page Security.

12. Changes to this policy

We may update this policy in response to changes in legislation, platform features, or operational procedures. The current version is always available on this page. We will inform about substantial changes via the platform or by email.

13. Contact

For any questions regarding data protection, contact the designated data protection contact (DPO contact):
privacy@sprav.cz (data protection / DPO contact)
info@sprav.cz (general inquiries)

TimeDeals Pavelka
Berglistrasse 28a, 8180 Bülach, Švýcarsko