Privacy Policy

Version v6-2026-10 · Effective from: 27 Oct 2026

This is an English translation for convenience. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails. Česká verze

Personal data appears with us in three different situations, and in each we have a different role. This document is therefore divided into three parts. If you are looking for one specific thing:

You are browsing this website — Part A.
You are a customer or are interested in the service — Part B.
You are an employee of a company that uses the system — Part C. Short answer: your data is managed by your employer, not by us.

Who we are

Vojtěch Suszka
Company ID (IČO): 29649536
Registered office: Čáslavská 1825/9, 737 01 Český Těšín
Legal form: a self-employed natural person carrying on business under the Trade Licensing Act and entered in the Trade Register
Contact for personal data matters: podpora@pridom.cz

The controller is a natural person carrying on business, not a company. The registered-office address stated is also the address of the controller’s residence — we state it because without it there would be nowhere to address the exercise of rights. Please therefore send correspondence to the contact e-mail; use the postal address only when written form is necessary.

We have not appointed a data protection officer — we do not meet the conditions under which the GDPR requires one. Questions are handled directly by the operator at the address above.

Part A — Visitors to this website

Here we are the controller.

A1. What the website stores in your browser

No cookies. The website uses no analytics, advertising or tracking scripts. It writes a single technical item to the browser storage (sessionStorage), thanks to which it remembers, within one tab, that you have already seen the intro animation; it disappears when the tab is closed and is not sent anywhere. The font is downloaded from our server, not from a third party. Details are in the cookie policy.

A2. Server logs

Data	Purpose	Legal basis	Retention period
IP address, time of request, page address, browser type	operation and security of the website, defence against abuse	Art. 6(1)(f) GDPR — our legitimate interest in the secure operation of the website and protection against abuse	14 days

These are ordinary web server logs, which arise at every visit to any website. We do not link them to any profile and do not use them for any other purpose.

A3. Contact form and e-mail

If you write to us via the contact form on the website, the data entered — e-mail, the text of the message and, if you fill them in, name and company — is sent to our server (address evikom.cz/api/kontakt). The server is operated by Hetzner Online GmbH in the data centre Hetzner nbg1-dc3, Nuremberg, Germany; the message is stored only there, in a file on that server. Alongside the message we keep the IP address from which it came, but only as an pseudonymised hash (salted), which serves only to limit abuse, not in readable form. We use no external service for processing forms. The website field, which is hidden from people, serves as a trap for automated robots; a message with that field filled in is not processed.

The messages are read by our team in our internal tool Monday, which runs on our server at Hetzner or on team members’ devices and is accessed over a secure (encrypted) connection. The team learns of a new message through a short mobile notification that contains only the message number — no personal data. In addition, we may receive an e-mail notification at podpora@pridom.cz; the mailbox is operated by the provider named in the list of sub-processors. The recipients of data from the form are therefore: our team, the server operator (Hetzner Online GmbH, Germany) and, where applicable, the e-mail mailbox provider. When preparing replies we may process the text of a message with an artificial intelligence tool (Anthropic, PBC, USA, standard contractual clauses). A person always approves the reply. Otherwise we do not pass the data from the form on to anyone else.

For the short checks on the website (questionnaires), the answers are not sent anywhere until you send them yourself via the “Want help with that?” form; we then store with your message also the answers from the questionnaire and its result, as well as the phone number, city and website if you fill them in on the form.

If you prefer to send us an e-mail at podpora@pridom.cz, we will process the data that you write to us in it.

Data	Purpose	Legal basis	Retention period
Name, company, e-mail, text of the message — from the form or from an e-mail you send us; for the checks on the website additionally phone, city, website, the questionnaire answers and its result, if you fill them in and send them	replying to the enquiry, preparing an offer	Art. 6(1)(b) GDPR — steps prior to entering into a contract at your request; Art. 6(1)(f) GDPR — our legitimate interest in replying and documenting the communication	messages from the form are kept for 12 months, then deleted; e-mail for 2 years from the last communication; if a contract is concluded, Part B applies

Providing the data is voluntary; however, without an e-mail address we cannot reply to you. You may object to processing based on legitimate interest (see the section Your rights).

A4. Questionnaire

The website may contain a link to a questionnaire that runs in Google Forms (Google Ireland Limited). It is a link, not an embedded window — until you click it, no request goes to Google. After clicking, you leave our website; the answers are stored at Google (which may also transfer them to the USA, see Transfers outside the European Union) and are governed by its terms. The questionnaire is not anonymous — among other things it asks for name, company, Company ID (IČO), e-mail and phone number, so that we can follow up with an offer.

Data	Purpose	Legal basis	Retention period
Name, company, Company ID (IČO), e-mail, phone and answers to the questionnaire questions	preparing a tailor-made offer	Art. 6(1)(f) GDPR — our legitimate interest in preparing an offer for the person who filled in the questionnaire; if negotiations on a contract follow, Art. 6(1)(b) GDPR. You may object to the processing at any time by e-mail	2 years from completion

The answers are stored at Google; we are the controller. If you want them deleted sooner, write to podpora@pridom.cz.

Part B — Customers and prospects

Here we are the controller.

Data	Purpose	Legal basis	Retention period
Name and surname of the contact person, work e-mail and phone, company	concluding and performing the contract, support, operational communication	Art. 6(1)(b) GDPR — performance of the contract; for prospects, negotiating a contract	for the duration of the contract and 3 years after (limitation period)
Billing data, issued documents, payments	keeping accounts and tax obligations	Art. 6(1)(c) GDPR — compliance with a legal obligation	according to accounting and tax regulations, usually 10 years
E-mail and other written communication	documenting what was agreed, handling requests	Art. 6(1)(f) GDPR — our legitimate interest in documenting what was agreed and defending our claims	3 years from the end of the contract
Login account for the service set up for a contact person	access to the service	Art. 6(1)(b) GDPR — performance of the contract	see Part C

We obtain the data from you or from the company you represent. Providing the data needed for the contract is a contractual requirement — without it we cannot conclude or perform the contract; we also keep billing data because the law requires it.

We do not send commercial communications without a prior enquiry and we do not run a newsletter. We do not pass prospects’ data on (except to the artificial intelligence tool used to prepare replies, see A3) and do not use it for any purpose other than replying and preparing an offer.

Part C — Data in the customer’s system

Here we are not the controller but the processor. The data that a company or its people enter into the system — names on entries, e-mails, login credentials, PINs, the record of who did what and when — belongs to that company. The controller is the company that uses the system. We handle the data only on its instructions and only in order to run the service.

C1. Are you an employee of a company that uses the system?

Please direct your rights to your employer. It decided to use the system, it determined what is recorded in it, and only it can tell you why and on what legal basis. We will provide it with assistance, but we may not delete or release your data ourselves — without the controller’s instruction that would be a breach of our obligations.

If you nevertheless write to us, we will pass the request on to your employer without undue delay and let you know that we have done so.

C2. What we process in the system

The complete and binding list is in the annex to the Data Processing Agreement. In brief, it covers the identification of persons with access (name, e-mail), authentication data in unreadable form (a hash of the password and PIN), the role and assignment to premises, records of logins and of the authorship of individual entries, and the activity log in the system.

If the customer has the Finance or Mail module switched on, this additionally includes:

Payroll and employment data of the people on the payroll — position, type of employment, gross wage, start and end dates, and for wages paid, gross and net wage, employer’s costs and the payment date. This also concerns people who never log in to the system at all.
Data from the customer’s bank statements — counterparty account number, counterparty name, variable symbol and message for the recipient.
Content of mail sent from the system — sender, recipients, subject and the entire body of the message.
The customer’s business partners — name, Company ID (IČO), VAT ID (DIČ) and contact on documents.

C3. Who gets access to the data

People at the customer — to the extent the customer has assigned to them. Separation between companies is enforced by the database, not only by the application; one company’s account cannot reach another’s data.
We — to the extent necessary for set-up, support and maintenance. Access is held by a narrow circle of persons bound by confidentiality.
Other processors — the server provider and other services listed in the list of sub-processors.

We do not use customers’ data for our own purposes — neither for statistics, nor for training any models, nor for creating comparative overviews across customers.

Transfers outside the European Union

The servers on which the service runs are in the European Union. We deliberately do not transfer data outside the European Economic Area. The exceptions are the e-mail and questionnaire provider (Google), which may transfer data in e-mail communication and in questionnaires also to the USA; the transfer is safeguarded by the European Commission’s adequacy decision under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and by standard contractual clauses (Commission Implementing Decision (EU) 2021/914), and, for an AI automation that a customer orders and when preparing replies to messages from prospects and customers, the provider of the artificial intelligence model (Anthropic, USA); the transfer is safeguarded by standard contractual clauses. The Evikom application itself does not use artificial intelligence to work with customers’ data; we prepare replies to messages with the help of artificial intelligence only ourselves, and a person always approves them. We will provide you with a copy of the safeguards used (standard contractual clauses) on request at podpora@pridom.cz. Any further exceptions and their legal safeguards are always stated in the list of sub-processors.

Security

Concrete measures, not general words. What is described below is the actual state of the system:

Passwords and PINs are not stored in readable form. Only a hash created by the scrypt function with a random salt for each record is stored; the password cannot be recovered from it. The initial password or PIN is set by our administrator when the account is created and handed to the company; we do not keep it in readable form. On request we reset a password or PIN.
The login token is not stored. Only its SHA-256 hash is in the database; it is compared in a way that resists timing attacks.
The login cookie is marked HttpOnly (no script in the browser can read it) and SameSite=Lax (it is not sent when arriving from another website). In operation over HTTPS the Secure flag is added, so it is not transmitted unencrypted.
Separation of companies is enforced by the database. Every query is restricted by a database-level rule (row level security), which is switched on even against the table owner. If a query lacks the identification of the company, no row is returned — never another company’s data. The application database role is not an administrator role and cannot bypass the rules. An automated test guards this behaviour.
Access to data over the internet is only via HTTPS. The database is not accessible from the internet.
Repeated failed logins temporarily lock the account and the lock time grows with further attempts.
The system keeps an activity log — who logged in, who changed what and when.
Backups — from the start of operating the service for the first customer, we undertake to back up the database daily, store the backups encrypted outside the production server and keep them for 30 days; they serve only to restore operation.

What we conversely do not promise, because it is not yet in place: two-factor authentication of login and encryption of data at the level of individual items in the database. Once they exist, we will add them here.

Your rights

For processing where we are the controller (Parts A and B), you have the right of access to your data, rectification, erasure, restriction of processing, portability, and the right to object to processing based on legitimate interest (Arts. 15 to 21 GDPR); the right to portability applies to data processed on the basis of a contract or consent. You may withdraw any consent you have given at any time. Just write to podpora@pridom.cz; we will reply within one month.

For processing where we are the processor (Part C), exercise your rights with the controller — that is, with the company that uses the system.

You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

What we do not do

We do not use third-party analytics or marketing tools, advertising networks or tracking pixels.
We do not sell data and do not pass it to anyone for marketing.
We do not carry out profiling or automated decision-making with legal effects.
We do not use customers’ data to train machine-learning models.

Changes to this Policy

We may amend the Policy when the service or legal regulations change. The current wording is always at this address with the version and effective date stated. We will announce a material change affecting customers by e-mail in advance.

Contact: podpora@pridom.cz