Privacy policy

This policy explains what personal data we process, why we do so, how long we keep it and what rights you have. It applies to the website www.pixmo.cz, to the mobile apps that link to it, and to our customers and business partners. The Czech version of this policy is the authoritative one.

1. Who the controller is

The controller of your personal data is Pixmo s.r.o., with its registered office at Kosmákova 4300/38a, 615 00 Brno, Czech Republic, company ID 05769272, registered in the Commercial Register kept by the Regional Court in Brno, section C, file 121221 (“we”).

For anything concerning personal data, write to info@pixmo.cz or call +420 727 959 816. We have not appointed a data protection officer, as the law does not require us to.

We process data under Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and Czech Act No. 110/2019 Coll., on personal data processing.

2. The website

Contact form

When you write to us through the contact form, we process your name, e-mail address and the text of your message. We treat data you send us by e-mail or give us by phone in the same way.

Purpose: replying to your message and discussing possible cooperation.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Retention: while we deal with your enquiry and for no longer than 3 years after our last communication. If we enter into a contract, section 4 applies.

A message from the form is sent to our mailbox as an e-mail. The website does not store it in any database.

Protecting the form and running the website

When running the website we process your IP address and technical data about the request (time, page address, browser type):

Limiting the number of messages from the form: we hold the IP address only in the server’s memory, for 24 hours after the form was last sent; the server then forgets it within 10 minutes at the latest. It is not written anywhere.
Server access logs: these are used to detect attacks and resolve faults. We keep them for no longer than 30 days, after which they are deleted automatically.

The legal basis is our legitimate interest in running the website securely (Art. 6(1)(f) GDPR).

Cookies and similar technologies

The website only stores in your browser what it needs to work: your choice from the cookie banner (the browser’s local storage, valid for 12 months). We do not need your consent for this.

Other services are loaded only with your consent, which you give in the cookie banner:

Service	What it is for	What it stores and for how long
Google reCAPTCHA	Checks that the contact form is sent by a person, not a robot. In doing so Google processes your IP address and data about your device and behaviour on the page.	The `_grecaptcha` entry in the browser’s local storage, until you withdraw consent. Google may store its own `_GRECAPTCHA` cookie on its domain, valid for 6 months.
Google Analytics	Measures visits to the website: how many people came, from where, and which parts of the website they use. It is loaded through Google Tag Manager. It processes online identifiers and data about your device and visit; it does not store IP addresses. We do not use it for advertising.	The `_ga` and `_ga_<ID>` cookies, 2 years from your last visit. We keep visit data in Google Analytics for 14 months, and only aggregate statistics after that.

The provider of both services is Google Ireland Limited. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time through the Cookie settings link in the website footer. Once consent is withdrawn the service is no longer loaded and we remove the entries stored for our website (_grecaptcha, _ga, _ga_<ID>) from your browser. We cannot delete cookies that Google stored on its own domains; you can remove them in your browser settings.

From reCAPTCHA we receive only the result of the check (a score). We do not store it against you or your message. If the check fails, only the score and the reason for the rejection are written to the server’s operational log, without your IP address or any data from the form.

Without consent to reCAPTCHA you cannot send the form, but you can e-mail or call us instead.

3. Mobile apps

This section applies to the mobile apps that we publish on Google Play and the App Store and that link to this policy. Downloads and updates of the apps are handled by Google and Apple, who process data in doing so as independent controllers under their own policies.

What data we process

Registration and sign-in data: first name, surname, e-mail address and account credentials.
Company data: business or trade name, company ID, VAT ID, registered office or place of business, and other details about your business that you enter in the app.
Data you enter in the app while using it.
Technical data: device type, operating system and app version, app usage data and error reports.

Why and on what basis

Creating your account and providing the app’s features: performance of a contract (Art. 6(1)(b) GDPR). The app cannot be used without this data.
Messages needed for using the app, such as registration confirmation, password reset or notices of changes: performance of a contract (Art. 6(1)(b) GDPR).
Security, fixing errors and improving the app: our legitimate interest (Art. 6(1)(f) GDPR).
Sending commercial communications: only with your consent, see section 5.

For how long

We keep the data for as long as you have an account in the app. Within 30 days of the account being closed we delete or anonymise it; it disappears from backups within 12 months at the latest. The exception is data we must keep by law or need to protect our legal claims, for no longer than 3 years after the account is closed. We keep technical error and usage records for no longer than 24 months.

Closing your account and deleting your data

You can ask us at any time to close your account and delete the related data by e-mailing info@pixmo.cz from the address the account is registered to. Please state the name of the app. We will deal with your request without undue delay and within one month at the latest.

4. Customers and business partners

For customers, suppliers and their contact persons we process identification and contact details (first name, surname, position, e-mail, phone), company identification details, invoicing and payment details and the content of our communication.

Purpose and legal basis: entering into and performing a contract (Art. 6(1)(b) GDPR), complying with legal obligations, in particular accounting and tax obligations (Art. 6(1)(c) GDPR), and protecting our legal claims (Art. 6(1)(f) GDPR).
Retention: for the term of the contract and then for the period required by law; accounting and tax documents generally for 10 years.

We treat the data of participants in events we organise in the same way, to the extent needed for registration and for organising the event.

5. Commercial communications

We do not currently send commercial communications, that is, news and offers of our services and products. Messages needed for using an app or for performing a contract are not commercial communications.

If we introduce commercial communications, we will send them only to people who have given us their consent (Art. 6(1)(a) GDPR). In the apps we will ask for it at registration, where you can allow or refuse them; refusing has no effect on your use of the app.

You can withdraw your consent at any time through the link in each message or by e-mailing info@pixmo.cz. We use your e-mail address for this purpose until you withdraw consent, and for no longer than 3 years after you gave it.

6. When we process data for our customers

When we develop and operate custom systems and apps, we may have access to personal data that our customers store in them, such as data about their clients or employees. The customer is the controller of that data and we process it as a processor, on the customer’s instructions and under a data processing agreement. Please address requests concerning that data to the customer in question.

We do not sell personal data. We disclose it only to the extent necessary to processors with whom we have data processing agreements:

Service	Provider	Where the data is processed
E-mail and office services (Google Workspace)	Google Ireland Limited	EU; USA, see section 8
reCAPTCHA and Analytics on the website	Google Ireland Limited	EU; USA, see section 8
Website hosting	vpsFree.cz, z.s.	Czech Republic
Hosting and backend of the mobile apps	Amazon Web Services EMEA SARL	EU, generally Germany (Frankfurt)

For individual apps we also use providers of tools for analytics, error tracking and sending e-mails. We will tell you the current list for a particular app on request at info@pixmo.cz.

We also disclose data, to the extent necessary, to our accounting, tax and legal advisers and to public authorities where the law requires us to.

8. Transfers outside the European Union

We run the website and the mobile apps on servers in the European Union. Data may leave the European Economic Area in these cases:

Google: our contracting party is the Irish company Google Ireland Limited, which may transfer data to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision (Art. 45 GDPR). The certification can be checked at www.dataprivacyframework.gov.
Tools used in the apps: if a provider of analytics, error tracking or e-mail sending processes data in the United States, the transfer relies on its certification under the EU–US Data Privacy Framework (Art. 45 GDPR) and, if it is not certified, on standard contractual clauses approved by the European Commission (Art. 46 GDPR).

On request at info@pixmo.cz we will tell you which provider a transfer concerns and send you a copy of the relevant contractual clauses.

9. Security and automated decision-making

We protect data with appropriate technical and organisational measures, in particular encrypted transfer, access control and regular updates. Only people who need the data for their work have access to it.

We do not use your data for automated decision-making or profiling that would have legal or similarly significant effects on you.

10. Your rights

Under the GDPR you have the right:

of access to the data we process about you, and to a copy of it,
to rectification of inaccurate or incomplete data,
to erasure of data where there is no reason to keep processing it,
to restriction of processing,
to data portability for data you have given us that we process by automated means on the basis of a contract or consent,
to object to processing based on our legitimate interest,
to withdraw consent where processing is based on consent. Withdrawal does not affect processing carried out before it.

To exercise your rights, e-mail info@pixmo.cz. We will reply without undue delay and within one month at the latest. If we have doubts about your identity, we may ask you to verify it.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

11. Changes to this policy

We may update this policy, for example when our services or the law change. The current version is always on this page, together with the date it was last updated. We will tell app users about significant changes by e-mail or in the app.