# Privacy policy (GDPR) | DameDoklad

> Draft privacy policy for DameDoklad. Awaiting legal review.

Source: https://damedoklad.cz/en/privacy/

1.  [Home](/en/)
2.  Privacy policy (GDPR)

Legal documents

-   [Terms](/en/terms/)
-   [Privacy](/en/privacy/)
-   [Cookies](/en/cookies/)
-   [Data processing agreement](/en/dpa/)

Draft, awaiting legal review

This text is a working draft that has not been reviewed by a lawyer and is not binding. The approved wording will replace it before sales open.

# Privacy policy (GDPR)

Last updated 30 October 2026

This draft describes how we work with personal data. A lawyer will fill in the details in square brackets together with the operator.

## Controller

The controller of account users’ personal data is \[company name, ID number, registered office\]. Contact: [podpora@damedoklad.cz](mailto:podpora@damedoklad.cz).

## What data we process

-   **Account data:** name, email, password hash, and two-factor settings if used.
-   **Company data:** name, IČO, DIČ, address, bank details.
-   **Operational data:** sign-in and request records, IP address.
-   **Data you enter in the app:** documents, contacts and, for payroll, employee data. For these we are a processor; see the [data processing agreement](/en/dpa/).

## Why, and on what basis

| Purpose | Legal basis |
| --- | --- |
| Providing the service | Performance of a contract |
| The operator’s invoicing and accounting | Legal obligation |
| Security and abuse prevention | Legitimate interest |

\[To add and verify legal bases and retention periods.\]

## Who we share data with

Subprocessors may process data to run the service. The list will be part of the [data processing agreement](/en/dpa/). \[To add: transfers outside the EU, if any.\]

## Your rights

You have the right to access, rectification, erasure, restriction of processing, portability and objection, and you can file a complaint with the Czech Office for Personal Data Protection. Legal duties to keep accounting records may prevent erasure.