Terms of Personal Data Processing

Last updated: May 2026

1. Introductory provisions

Tapaya s.r.o., ID No.: 234 76 541, with its registered office at Uralská 689/7, Bubeneč, 160 00 Prague 6, registered in the Commercial Register maintained by the Municipal Court in Prague, file no. C 427691 (the "Company" or "Administrator") provides this information on the manner and scope of personal data processing, including rights related to personal data processing.

The Company collects, stores, and uses personal data in connection with its business activities. Personal data processing is considered strictly confidential and is handled in accordance with applicable legislation, in particular the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Legal basis and purposes of personal data processing

The legal basis for processing is the negotiation and performance of a contract, fulfillment of legal obligations, and the legitimate interests of the Company. Personal data is processed for the following purposes:

  • Performance of a contractual relationship — negotiations on the conclusion, amendment, or performance of a contract, including the provision of services to a customer or contractual relationship with a supplier or other third party (a "Partner").

  • Fulfillment of legal obligations — accounting and tax legislation obligations, and providing data to law enforcement authorities or other public authorities as required by law.

  • Legitimate interest of the Administrator — protection of rights and legally protected interests, developing business relations with the Partner, or sending commercial communications.

  • Consent of the data subject — where consent is granted, the scope of data processed depends on the purpose and extent of that consent.

3. Processed personal data

  • Name and surname — contractual obligations, legal obligations, legitimate interest

  • Date of birth — contractual obligations, legal obligations, legitimate interest

  • Address — contractual obligations, legal obligations, legitimate interest, commercial communications

  • Email — contractual obligations, legal obligations, legitimate interest, commercial communications

  • Phone number — contractual obligations, legal obligations, legitimate interest, commercial communications

  • Account number — contractual obligations, legal obligations

  • ID no., Tax reg. no. — contractual obligations, legal obligations, legitimate interest

4. Recipients of personal data

Personal data is only accessible to authorized employees of the Company or individual processors, and only to the extent necessary to fulfill the purposes of processing, or on the basis of consent. Personal data may be transmitted to:

  • Law enforcement authorities or other public authorities when required by applicable legal regulations.

  • External accounting firms.

  • Processors who provide server, web, cloud, or IT services to the Company and/or Partners.

5. Personal data processing and storage period

Personal data is processed for the period necessary to ensure all rights and obligations arising from the relevant contractual relationship, and further as required by applicable legal regulations:

  • Contractual relationship — for the duration of the contract and for 10 years after its termination.

  • Legal obligations — for the period specified by the relevant legal regulation.

  • Legitimate interest — for a maximum of 3 years from the date of data retention, unless specific legal regulations or a justified case require a longer period.

  • Consent — for the duration of the consent.

6. Personal data of third parties

Personal data of employees and other natural persons involved in cooperation with a Partner, or other data received from the Partner in connection with a contract, will be processed solely for the purpose of performing the contract with the Partner. The Partner acknowledges this and undertakes to properly inform its employees and other involved persons about this processing.

7. Rights of the data subject

You have the following rights in connection with the processing of your personal data, which may be exercised at any time:

  • Right to access personal data.

  • Right to rectification of inaccurate or incomplete data.

  • Right to erasure if data is no longer necessary for the purposes for which it was collected, or if it was processed unlawfully.

  • Right to restriction of processing.

  • Right to data portability.

  • Right to object, after which processing will be terminated unless there are serious legitimate grounds that outweigh your interests or rights and freedoms.

  • Right to lodge a complaint with the Office for Personal Data Protection: www.uoou.cz

To exercise your rights, submit a request in writing to the Company's registered office or by email to info@tapaya.com. The Company reserves the right to verify the identity of the data subject in an appropriate manner.

8. Final provisions

The Company is entitled to unilaterally amend or supplement these Terms at any time. You will be notified of any changes in a timely and appropriate manner.

These Terms of Personal Data Processing are valid and effective as of July 15, 2025.