Privacy Policy

1. Who processes your data

This policy describes how we process the personal data of users of the EuMo service for auto repair shops (workshop.eumo.cz) and of visitors to this website. The service is operated by:

For anything concerning personal data, contact us by email at talalayev@outlook.com or by post to our registered office.

2. When we are the controller and when the processor

As the controller, we process the data we need to provide the service to its users: the user accounts of workshop staff and owners, the billing details of subscribers, communication with us and records about the security of the service. This policy covers that processing.

As a processor, we process the data a workshop enters into the app about its customers, their vehicles, work orders and invoices, about its employees (e.g. attendance) and about job applicants. The workshop is the controller of that data; we process it only on its instructions, as set out in the Data Processing Terms. If you are a workshop's customer and want to exercise your rights, please contact your workshop.

3. What data we process and why

• User account — email, name, phone number, password (stored only as a bcrypt hash), passkeys, roles and membership of workshops and organisations. Purpose: registration, sign-in and providing the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Subscription billing — company name, company ID (IČO), VAT ID (DIČ), billing address, contact email, payment history. Payment cards are processed by Stripe; the card number never reaches us. Legal basis: performance of a contract and compliance with legal obligations in accounting and tax (Art. 6(1)(b) and (c) GDPR).
• Security and operations — IP address, records of sign-ins and failed attempts, a log of security-relevant actions (audit log), technical data about application errors and the Cloudflare Turnstile check at registration and sign-in. Legal basis: our legitimate interest in running the service securely and protecting it against abuse (Art. 6(1)(f) GDPR).
• Communication — the content of messages you send us and the service emails you receive from us (email verification, password reset, subscription notices). Legal basis: performance of a contract and our legitimate interest in handling your enquiry.
• Website visitors — when a page loads, the hosting provider records the usual technical data (IP address, time, page address, browser type) in operational logs, which are kept only briefly. Legal basis: our legitimate interest in operating and securing the website. We do not track visitors or analyse their behaviour.

We do not use the data for marketing profiling and do not sell it.

Where the data comes from. You provide most of it yourself. The email address of an invited user is given to us by whoever invited them to the workshop or organisation. We fill in a company's name, address and VAT ID from public registers (ARES, VIES) based on the company ID or VAT ID entered.

Do you have to provide the data? Account data is necessary to enter into and perform the contract — without it we cannot provide the service. Billing data is also required by tax law. All other data (e.g. a phone number) is optional.

Automated decision-making. We do not make decisions about you based solely on automated processing, nor do we profile you within the meaning of Art. 22 GDPR.

4. How long we keep the data

• Account data for as long as the account exists; once the account is closed we delete it, unless we need it to comply with a legal obligation or to protect legal claims.
• Accounting and tax records for the period set by accounting and tax law (usually 5 to 10 years).
• Sign-ins (sessions) for at most 30 days; unused and expired verification or invitation links are deleted 30 days after they expire.
• In-app notifications for 12 months after being read (24 months if unread), records of email and text message delivery for 13 months.
• Security records (audit log) for as long as the service is provided to the organisation they relate to.

5. Who receives the data

We make data available only to processors who help us run the service, to the extent their task requires and under a data processing agreement:

We check company and vehicle details in public registers (ARES, VIES, the Czech Register of Road Vehicles via dataovozidlech.cz); these registers receive only the company ID, VAT ID or VIN being looked up. Map tiles are loaded from OpenStreetMap. We disclose data to public authorities only where the law requires us to.

6. Transfers outside the European Union

Some processors are based in the USA or have access to the data from there. Such transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or, for recipients that have not joined it, on standard contractual clauses approved by the European Commission. We will provide a copy of them on request.

7. Cookies and browser storage

We do not use analytics, advertising or any other tracking cookies. We store in your browser only what is strictly necessary for the service you have asked for. Under Section 89(3) of the Czech Electronic Communications Act this does not require consent, so we do not ask for it:

• Website visitors who are not signed in get no cookies at all.
• the refresh_token cookie — set only after you sign in, keeps you signed in (valid for 30 days) and is read only by the api.eumo.cz server,
• the browser's local storage: the time of your last activity (security sign-out after inactivity), your chosen language, the last signed-in account, expanded menu sections and the fact that you have seen the cookie notice,
• a service worker and its cache (fast loading and installing the app) and, after sign-in, offline storage with a temporary copy of data and changes not yet sent,
• the registration and sign-in pages load Cloudflare Turnstile, which uses browser data and the IP address to check that the form is not being submitted by a bot.

You can delete the stored data at any time in your browser settings; afterwards you will have to sign in again. Should we ever want to use cookies that are not strictly necessary, we will ask for your consent first.

8. Your rights

You have the right:

• of access to your data and to a copy of it,
• to have inaccurate data rectified,
• to erasure, where we no longer need the data or process it unlawfully,
• to restriction of processing,
• to portability of the data you have provided to us,
• to object to processing based on legitimate interest,
• to withdraw consent, where processing is based on consent.

Send your request by email at talalayev@outlook.com or by post to our registered office. We will handle it within one month. You may also lodge a complaint with the Czech data protection authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

9. Security

Communication with the app is encrypted (HTTPS). Passwords are stored only as bcrypt hashes, access to data is governed by roles and permissions within the workshop, security-relevant actions are written to a tamper-proof log, and both files and the database are stored in data centres in the EU.

10. Changes to this policy

We may update this policy, for example when we add a feature or change a processor. The current version is always on this page with its last-updated date; we inform users of material changes by email.