Data Processing Agreement

The business customer is the controller and determines the purposes and means of processing personal data in its content. The processor is Wassermann Media s.r.o., Vojtěšská 211/6, 110 00 Prague 1, Czech Republic, Company ID 09938842, VAT ID CZ09938842. This agreement under Article 28 GDPR is concluded when a business customer accepts the Terms of Service and forms part of them. A signed copy is available on request at info@souborovna.cz. We act as controller for account, payment and our own security records under the Privacy Policy.

We process content uploaded by the customer to store it and deliver it to authorised recipients. Operations include receiving, storing, creating previews and playable versions, sharing by link or permitted API and deleting. Processing lasts while the service is provided for the content, until its chosen expiry, deletion or service termination, followed by cleanup and backup retention.

The customer determines the scope of uploaded files, such as identification and contact details, photographs, video and audio recordings or work materials. Data subjects may include the customer's clients, staff, suppliers and people depicted in content. Souborovna also processes file names, types and sizes, link identifiers, validity, content hashes, hashed passwords and aggregate delivery statistics. The customer is responsible for the legal basis, information to data subjects and proportionate scope, including any special categories of data.

We process content only on documented customer instructions: this agreement, service settings, uploading, sharing, validity and deletion. We do not use content for our own advertising. Access is limited to authorised people bound by confidentiality. If law requires other processing, we inform the customer beforehand unless prohibited. We inform the customer if we consider an instruction to infringe data-protection law.

We operate content, databases and backups on our own servers in the Czech Republic and send email from our own mail server. Cloudflare provides DNS and website protection and may process request data and transmitted content for that purpose. The customer grants general written authorisation to use this subprocessor within that scope. Stripe processes web payments, Apple processes App Store purchases and Google processes Google Play purchases; none of them stores customer files. Their roles for transaction data follow the respective payment-service terms. Our hosting and SMTP are operations of Wassermann Media, not separate legal entities.

We impose equivalent content-protection obligations on subprocessors and remain responsible to the customer for their performance. We inform the customer in advance of intended additions or replacements, allowing reasoned objections at info@souborovna.cz. Transfers outside the EEA require documented instructions and compliance with GDPR Chapter V, for example valid standard contractual clauses or another applicable mechanism. Listing a provider does not mean every data item is transferred outside the EEA.

HTTPS protects web transport. Account and protected-transfer passwords are stored as bcrypt hashes. The server checks ownership and permissions; administrative actions require authorisation. Sign-in sessions can be revoked, and transfers and sensitive operations have abuse controls. The application and workers run under a dedicated operating account with restricted privileges. Moderation actions are recorded. Database and file backups include integrity checks and a separate copy for recovery; they are not a customer transfer-restoration feature. We do not promise end-to-end encryption or security certification. Customers protect their account and share links or passwords only with authorised recipients.

Taking into account the nature of processing and information available to us, we assist the customer with data-subject requests, security duties, impact assessments and prior consultations. Requests about customer content are passed to the customer; we do not decide on their behalf without instructions unless legally required. We notify the customer without undue delay of a personal data breach we become aware of and provide available information needed for notification and remediation. Contact: info@souborovna.cz.

The customer can download originals before termination and choose to request return or deletion of personal data. After the service ends, we delete remaining copies unless law requires retention. Expiry or deletion disables access and automatic cleanup removes files and derived versions, retrying failures. A shared original remains only for another customer's separate valid copy. Legally required records processed in our controller role follow the Privacy Policy.

They may remain in operational backups for a limited time until overwritten.

We provide information needed to demonstrate Article 28 GDPR obligations, allow audits and inspections by the customer or its appointed auditor and contribute to them. We agree timing and scope with regard to service security, confidentiality and other customers' rights without excluding the right to verification. Include your account, scope and reasons in requests to info@souborovna.cz.