1 · Who processes your data
The controller of personal data is SUBVY s.r.o., registered office Komunardů 32, 170 00 Prague 7, Czech Republic, company ID 12345678 (“SUBVY”, “we”). We operate the website subvy.cz and the SUBVY mobile app, through which subscribers subscribe to services of local businesses.
Send questions and requests about personal data to dpo@subvy.cz, anything else to podpora@subvy.cz.
2 · Who is responsible for what
SUBVY is the controller of data about accounts, the operation of the platform, brokering subscriptions and payments, complaints, withdrawals and consents.
The business you subscribe with is a separate controller of the data it receives about you to provide the service and for its own accounting (name, contact, billing details, subscription, visits, bookings, messages and complaints). The invoice is issued to you by the business.
Stripe processes payment data (card number, payment verification, fraud prevention) as a separate controller under its own policy. Neither SUBVY nor the business ever sees your card number.
3 · What data we process
Account: e-mail, password hash (we don't store the password itself), name, phone, profile photo, language and app settings, and for sign-in with Google or Apple the account identifier with that service.
Billing details: name or company name, address, company ID and VAT number. For businesses also business details (name, address, company ID, VAT number, VAT status, contacts, description, photos); identity verification and the payout bank account are entered by the business directly with Stripe.
Subscriptions and payments: what you subscribed to, with whom and when, amounts, invoice numbers, refunds and payment disputes, acceptance of the terms (version and time) and the request to start performance early.
Use of services: visits and check-ins (QR), bookings and their changes, reviews of businesses, messages with the business, complaints including attached photos, withdrawals from contracts, gift vouchers (when buying, also the recipient's e-mail, name and message if you fill them in).
Consents and preferences: consent to receive news, your cookie choice record, notification settings.
Technical data: IP address and request details in server logs, records of security-relevant actions (for example approving a business or refunding money) and the token for notifications in the mobile app.
4 · Why we process data and on what basis
Account and platform services (registration, Marketplace, concluding subscriptions, bookings, check-in, messages, order notifications): performance of the contract under the terms and conditions (Article 6(1)(b) GDPR).
Payments, invoices issued on behalf of businesses, commission statements to businesses: performance of the contract and legal obligations under accounting and tax law (Article 6(1)(c) GDPR).
Complaints and withdrawals: legal obligations under the Czech Civil Code and the Consumer Protection Act.
Fraud prevention, payment disputes with banks, platform security and the defence of legal claims: legitimate interest (Article 6(1)(f) GDPR). You can object to processing based on legitimate interest.
News and offers by e-mail: only with your consent, which you can withdraw at any time in Settings or via the link in every e-mail. To learn which offers interest you, we record clicks on the button in the e-mail. We do not track e-mail opens.
Remembering preferences in the browser (Preferences cookies): consent. Details are in the cookie policy.
Delivering a gift voucher to its recipient: the legitimate interest of the buyer and ours in delivering the gift. We use the recipient's e-mail only to deliver the voucher.
We publish reviews of businesses on the Marketplace next to the business with the first name and the initial of the last name from your billing details (for example “Jan N.”; without them, as “Verified subscriber”). You can edit or delete your review.
We don't make automated decisions with legal effects. Stripe assesses the risk of fraud during payment under its own policy.
5 · Who we share data with
With businesses you have a subscription or voucher with, we share the data needed to provide the service and issue the invoice.
With processors who help us run the service: Stripe (payments, invoices, payouts), Railway (server and database hosting), Vercel (website hosting), Resend (sending e-mails), Expo (delivering notifications to the mobile app). They process data only on our instructions.
With other services only to the extent necessary: Photon (komoot) to convert a business address into a map location, MapTiler or OpenFreeMap for map tiles (they see the IP address), the ARES registry to verify business details by company ID, Google and Apple if you sign in with them.
With banks and card schemes in a payment dispute (evidence for the defence) and with public authorities where the law requires it. We don't sell data or share it for advertising.
6 · Transfers outside the EU
Some processors (for example Stripe, Vercel, Railway, Resend and Expo) may also process data in the USA. Transfers are based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission.
7 · How long we keep data
Account data for as long as the account exists. After the account is closed we delete or anonymise it, except for data we must keep by law or to defend claims.
Invoices, payments and commission statements for 10 years from the end of the year in which they were created (Czech VAT Act and Accounting Act).
Complaints, withdrawals and payment disputes for 3 years after they are settled (limitation period), complaint photos usually for a shorter time.
Messages and the history of visits and bookings for the duration of the subscription and at most 12 months after the last subscription with that business ends.
The gift voucher recipient's e-mail, name and message until the voucher is redeemed or expires and at most 12 months afterwards.
Consent to receive news until withdrawn, the cookie choice record while the consent is valid and for 3 years afterwards, server logs only briefly for security and troubleshooting.
8 · Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interest and to receiving news, and the right to withdraw consent at any time.
You can exercise most rights directly in the app: edit your details in Settings, download a data export or close your account and change your cookie consent in the Privacy section, and switch off news in Settings. Otherwise write to dpo@subvy.cz. We reply without undue delay, within one month at the latest.
If you believe we handle your data in breach of the rules, you can lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).
9 · Do you have to provide data?
Without an e-mail and password (or sign-in with Google or Apple) an account can't be created, and without billing and payment details you can't conclude a subscription or buy a voucher. Phone, profile photo, consent to news and to preferences are voluntary.
10 · Security
Connections to the website and app are encrypted, we store passwords only as an argon2id hash and payment cards are handled exclusively by Stripe. Access to data in a business account is governed by the permissions of individual team members and we log important actions.
11 · Changes to this policy
We may update this policy, for example with a new feature or a change of processor. The current version is always on this page and we will inform you about significant changes by e-mail or in the app.