1. Parties and conclusion
You, the user of Podklado, are the controller. The processor is Matouš Janeček, company ID (IČO) 29938881, T. G. Masaryka 415, 562 01 Ústí nad Orlicí. The agreement forms part of the terms of service, is concluded on sign-up and lasts for as long as you have an account.
2. What we process
- Purpose: to store the materials your clients deliver to you, make them available to you and your team, and send clients the reminders you set up.
- Data subjects: your clients and people whose data appears in the materials.
- Data: the client’s name and email, and the texts, files and photos they upload. Do not upload special categories of data (health, biometrics and the like) to the service unless the project strictly requires it.
3. Our obligations
- We process the data only on your instructions. Your instructions are the way you set up and use the service. If we believe an instruction would breach the law, we will let you know.
- Anyone with access to the data is bound by confidentiality. Access is limited to those who strictly need it to run the service.
- Security: encrypted connections, private storage with links valid for a few minutes, an unguessable client link that can be revoked, separation of data between workspaces, and nightly backups.
- On the page through which clients deliver materials, we do not measure traffic or run any advertising or tracking scripts.
- We will help you handle requests from data subjects. The service itself can download and delete materials.
- We will notify you of any security breach affecting your data without undue delay, and no later than 48 hours after discovering it.
- We will provide you with the information needed to demonstrate that we meet our obligations. An on-site audit is possible by agreement and at your expense.
4. Sub-processors
You agree that we use the following sub-processors:
- Oracle (Oracle Cloud Infrastructure), data centre in Frankfurt, Germany: server and database.
- Cloudflare, Inc.: storage for files and database backups (Cloudflare R2) with EU jurisdiction; the data stays in the European Union. The contract is covered by the EU standard contractual clauses.
- Resend, Inc.: sending invitations and reminders to clients from the EU region, with the EU standard contractual clauses.
We will announce any change by email at least 30 days in advance. If you disagree with it, you can end the agreement before then by deleting your account. Sub-processors are bound by the same obligations as we are.
5. Where and for how long
- We store the data in the European Union: the database in Germany, files and backups in storage with EU jurisdiction.
- If you delete a project or your account, we delete the data and files straight away. They disappear from backups within 30 days at the latest. Completed projects can also be deleted automatically after the period you set in Settings, Workspace.