Personal data protection (GDPR)
This document describes what personal data we process, for what purpose, for how long, and what rights you have as a data subject. All in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll.
1. What data we process and why
| Data | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| Email, name | Creating and managing the user account, delivering content, communication | Performance of a contract (Art. 6(1)(b) GDPR) | For the lifetime of the account + 3 years from the last sign-in |
| Password (hash) | Account security | Performance of a contract | Same as the account |
| IP address, browser, sign-in time | Security (rate limiting, audit), abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months |
| Purchase history, invoices | Meeting statutory tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) | 10 years under Act No. 235/2004 Coll. on VAT and Act No. 563/1991 Coll. on Accounting |
| Payment data (last 4 digits of the card, card type) | Proof of payment, customer service | Legal obligation | 10 years |
| Study progress (lessons viewed, courses completed) | Platform functionality, certificates | Performance of a contract | Same as the account |
| Marketing data (with your consent) | Sending the newsletter and offers | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
2. Who we pass data to
We do not pass your personal data to anyone except the following processorswho help us provide the service:
| Processor | Purpose | Country |
|---|---|---|
| Stripe Payments Europe, Ltd. | Card payment processing | Ireland (EU) |
| Contabo GmbH | Server and database hosting | Germany (EU) |
| Fortion.net (smtp.fortion.net) | Sending transactional emails | Czech Republic (EU) |
| Google LLC (optional, trainers only) | Google Fonts (loading fonts from fonts.googleapis.com) | USA — Standard contractual clauses |
| YouTube / Vimeo (at the trainer's choice) | Hosting lesson videos | USA — Standard contractual clauses |
We do not sell your data to third parties for advertising purposes.
3. Your rights
In connection with the processing of your personal data you have the following rights:
- The right of access — you can request a copy of the data we hold about you
- The right to rectification — if the data is incorrect or incomplete
- The right to erasure (“the right to be forgotten”) — except for data we must retain by law (invoices for 10 years)
- The right to restriction of processing
- The right to portability — you can obtain your data in a machine-readable format
- The right to object — to processing based on legitimate interest
- The right to withdraw consent — at any time, e.g. by unsubscribing from the newsletter
- The right to lodge a complaint with the Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7)
4. Cookies and similar technologies
The Platform uses only necessary cookies for correct functioning (sign-in, basket). These do not require your consent.
eduplace_session— stores your sign-in (HttpOnly, Secure, SameSite=Lax, lifetime 30 days)
We do not use third-party analytics or advertising cookies. If we were to allow them in the future, we would ask for your consent.
5. Security
We protect your data with the following measures:
- HTTPS encryption of all communication (TLS 1.2+)
- Passwords are stored as a hash (bcrypt)
- Regular server and application updates
- Database backups in encrypted storage in the EU
- Only the operator has access to the data
6. Children
The Platform is not intended for children under 16. If we find that we have obtained data from a person under 16 without the consent of their legal guardian, we will delete the data.
7. Changes to this document
We reserve the right to change this document. We will inform you of substantial changes by email or by a notice on the Platform.
This document is valid from 23 May 2026.
Martin Šabata, personal data controller.