Privacy Policy
Effective from 1 December 2026
This is an English translation. In case of any discrepancy, the Czech version prevails.
This document describes how we process personal data in the Eventplace application, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, the “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data. Capitalised terms have the meaning given to them in the Terms of Service.
1. Controller and Contact
1.1. The controller of personal data is TRUEAPPS a.s., with its registered office at Olomoucká 1189/81, Černovice, 627 00 Brno, Company ID: 26237661 (the “Provider” or “we”).
1.2. You can contact us on any matter concerning personal data protection at info@eventplace.cz or by post at our registered office address. We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR.
2. When We Are a Controller and When a Processor
2.1. We are the controller of the personal data of Organisers and their staff who use an Account, of persons who contact us and of visitors to the eventplace.cz website. This Policy is addressed to these persons.
2.2. We are a processor of personal data that the Organiser uploads to the Application or collects through it – in particular data on event Participants (registrations, ticket orders, responses in registration forms, check-in, polls and ratings), exhibitors and speakers. The controller of these data is the Organiser of the relevant event, who determines the purpose and scope of the processing and to whom Participants should address their requests. Our obligations towards the Organiser are governed by the Data Processing Agreement. If we receive a request from a Participant, we will forward it to the relevant Organiser.
3. What Data We Process, Why, on What Legal Basis and for How Long
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Setting up and managing the Account, providing the Application and support | first name and surname, e-mail, telephone, password (stored exclusively in hashed form), account name, settings, communication with support | performance of a contract (Article 6(1)(b) GDPR) | for the duration of the Agreement; communication with support for 3 years after its end |
| Invoicing and compliance with tax and accounting obligations | business name / name, Company ID, VAT ID, billing address, payment details | legal obligation (Article 6(1)(c) GDPR) – the Accounting Act, the VAT Act | 10 years from the end of the year in which the taxable supply was made |
| Security and operation of the Application, prevention of misuse | IP address, sign-in data, activity records (logs), browser and device type | legitimate interest in secure operation (Article 6(1)(f) GDPR) | logs for no more than 12 months |
| Mobile application and notifications (push notifications) | device identifier, manufacturer, model, platform and operating system version, notification delivery token | performance of a contract (Article 6(1)(b) GDPR) | until the device is signed out or the app is uninstalled, no more than 12 months after last use |
| Establishment and defence of legal claims, debt collection | identification and contact data, contractual and payment data, communication | legitimate interest (Article 6(1)(f) GDPR) | for the limitation period (usually 3 years after the end of the Agreement) or until the dispute is concluded |
| Information on news and similar services for customers | e-mail, name | legitimate interest (Article 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.) | until you unsubscribe, no more than 2 years after the end of the Agreement |
| Other commercial communications, optional surveys | e-mail, responses | consent (Article 6(1)(a) GDPR) | until consent is withdrawn; survey responses are anonymised |
| Handling enquiries and content notices (DSA) | name, e-mail, content of the message | legitimate interest; for notices under the DSA, legal obligation | 3 years after the matter has been handled |
3.2. Providing the data necessary for concluding and performing the Agreement is a contractual requirement; without them we cannot provide the Application. Other data are provided voluntarily.
3.3. No automated individual decision-making or profiling within the meaning of Article 22 GDPR takes place. We do not sell your data.
4. Cookies and Similar Technologies
4.1. The Application uses only cookies that are strictly necessary for its operation – a session cookie (sign-in and form security), a persistent sign-in cookie if you choose “remember me”, and a cookie storing your appearance and language preferences. We store these cookies under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, without consent, because they are necessary to provide the service you have expressly requested.
4.2. We do not use analytics, marketing or other non-essential cookies without your prior consent. If we introduce them in the future, we will ask for your consent and make it just as easy to refuse or withdraw. Merely using the website does not constitute consent to cookies.
4.3. The Organiser may embed third-party content (e.g. an embedded video) on its event pages. Such content is governed by the terms of its provider, and the Organiser is responsible for compliance.
5. Recipients and Processors
5.1. Personal data may be processed by our employees and contractors bound by confidentiality and by processors who provide us in particular with hosting and infrastructure, backups, e-mail delivery and push notification delivery. The current list of processors is published on the Sub-processors page. We have concluded an agreement under Article 28 GDPR with all processors.
5.2. Other recipients may include accountants and tax advisers, lawyers, banks and, in cases provided for by law, public authorities (e.g. courts, the police, the tax administrator).
5.3. Data you enter when registering for an event are made available to the Organiser of that event.
6. Transfers to Third Countries
6.1. Some processors have their registered office or infrastructure outside the European Economic Area (in particular in the USA). We transfer data only with appropriate safeguards under Chapter V GDPR, i.e. to countries for which the European Commission has decided that they ensure an adequate level of protection (for recipients in the USA certified under the EU-U.S. Data Privacy Framework pursuant to Commission Implementing Decision (EU) 2023/1795), or on the basis of the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). We will provide you with a copy of the safeguards on request.
7. Your Rights
7.1. In connection with the processing, you have the following rights:
- the right of access to your personal data and to a copy of them (Article 15 GDPR);
- the right to rectification of inaccurate or incomplete data (Article 16 GDPR);
- the right to erasure where the data are no longer needed or the legal basis for the processing no longer applies (Article 17 GDPR);
- the right to restriction of processing (Article 18 GDPR);
- the right to data portability of data you have provided to us and that we process on the basis of a contract or consent, in a structured and machine-readable format (Article 20 GDPR);
- the right to object to processing based on legitimate interest (Article 21 GDPR); you may object to receiving commercial communications at any time, and we will then stop processing the data for that purpose;
- the right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal;
- the right to lodge a complaint with the supervisory authority – the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
7.2. You can exercise your rights by e-mail at info@eventplace.cz. We will handle your request without undue delay and within one month at the latest; in complex cases this period may be extended by a further two months, of which we will inform you. Handling requests is free of charge; for manifestly unfounded or excessive (in particular repetitive) requests, we may charge a reasonable fee or refuse the request. We may verify your identity before handling the request.
8. Security
8.1. We have adopted technical and organisational measures appropriate to the risk, in particular encrypted transmission (HTTPS), storage of passwords using a one-way hash function, access rights management, regular backups and system updates. If a personal data breach occurs that poses a risk, we will notify the Office for Personal Data Protection within 72 hours and, in the case of a high risk, also the affected persons.
9. Erasure After the End of the Agreement
9.1. After the Account is closed, we will delete the Account data without undue delay, and from backups within 45 days at the latest. We retain only data whose retention is required by law or by our legitimate interests, for the period stated in Article 3.
10. Changes
10.1. We may update this Policy. We will inform you of material changes in advance by e-mail or in the Application. This version is effective from 1 December 2026.
2026 © trueapps.cz
