Version 1.0 · Effective from December 2026
1. Controller and contact
1.1 Controller. DCXPS SE, a European company with its registered seat at Karla Engliše 3208/5, Smíchov, 150 00 Praha 5, Czech Republic, ID No. (IČO) 24546810, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. H 2803 ("DCXPS", "we" or "us"), is the controller of the personal data described in this notice. This notice gives you the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") when you represent a customer or a prospective customer of DCXPS, use the Chapek.io Platform (the "Platform"), pay for our services (the "Services"), visit the facility in the Czech Republic from which we provide the Services (the "DCXPS Facility"), use our website or send us a notice under Regulation (EU) 2022/2065 (the "Digital Services Act").
1.2 Contact. You can contact us about your personal data at privacy@chapek.io or by post at our registered seat. We have not appointed a data protection officer.
1.3 Data of our customers. This notice does not cover the personal data that our customers store or process on the servers we provide to them ("Customer Data"). We process Customer Data as a processor on behalf of the customer under the Data Processing Agreement; the customer is the controller of those data, and its own privacy notice applies to them.
2. Personal data we process
We process the personal data listed below. The personal data of the representatives of our customers and of the persons whom our customers authorize to use the Services ("Users") that we process to manage our contracts with them form the "Account Data".
| Persons concerned | Personal data | Source |
|---|---|---|
| Representatives, signatories and contact persons of customers and prospective customers | Name, role, employer, business contact details, communications with us, contract and order history | You or the organization you represent |
| Users of the Platform | Name, business e-mail address, credentials (stored as hashes), role and permissions, identifiers of multi-factor authentication devices, login and activity logs, IP addresses, support tickets | You or the customer; generated by your use of the Platform |
| Billing contacts and cardholders | Name, billing address, the name on the card, the last four digits, the expiry date and the token of the payment card, payment and prepayment records, pro-forma documents, tax documents and receipts. You enter the full card data on the page of the Payment Processor (section 6); full card numbers never reach our systems. | You; the Payment Processor |
| Directors, owners of ten percent (10%) or more and Users of customers subject to sanctions screening | Name, date of birth, nationality, the type, number and validity of the identity document presented, screening result | You or the customer; sanctions lists and public registers (public sources) |
| Visitors, contractors and auditors at the DCXPS Facility | Identity document data for access, access records, video recordings of common areas | You; our access-control systems |
| Website visitors | Technical data (IP address, device and browser data, pages visited) and cookie data as described in the cookie notice (section 12) | Your device |
| Persons who send us notices of illegal content or review requests under the Digital Services Act | Name, e-mail address, content of the notice or request, our decision | You |
3. Purposes and legal bases
We process personal data only for the purposes below and on the legal basis in Article 6(1) of the GDPR stated against each purpose. Where we rely on our legitimate interests (Article 6(1)(f) of the GDPR), the table names the interest.
| Purpose | Legal basis | Legitimate interest pursued |
|---|---|---|
| Concluding and performing contracts with customers: opening accounts, taking orders, provisioning, support, reporting and notices | Article 6(1)(b), where you contract with us as an entrepreneur in your own name; otherwise Article 6(1)(f) | Concluding and performing our contracts with the organization you represent and communicating with its representatives and Users |
| Answering enquiries and preparing offers for prospective customers | Article 6(1)(b), where you make the request for yourself; otherwise Article 6(1)(f) | Responding to enquiries and preparing offers for the organization you represent |
| Taking card payments and bank transfers, managing prepaid balances, issuing pro-forma documents and receipts | Article 6(1)(b) or (f), as in the first row | As in the first row |
| Issuing and keeping tax documents and accounting records | Article 6(1)(c): our obligations under Act No. 235/2004 Coll., on Value Added Tax, as amended, and under Czech accounting law | Not applicable |
| Preventing and investigating payment fraud and chargebacks | Article 6(1)(f) | Protecting us and our customers against payment fraud |
| Security of the Platform, the Services and the DCXPS Facility: access control, logging, monitoring, video surveillance of common areas and incident handling | Article 6(1)(f); Article 6(1)(c) where Act No. 264/2025 Coll., on Cybersecurity, applies to us | Protecting our systems, the DCXPS Facility, the data of our customers and the persons on site |
| Sanctions and export-control screening; checking that customers satisfy the eligibility conditions of our contracts | Article 6(1)(c): Union restrictive measures and Regulation (EU) 2021/821; Article 6(1)(f) for other screening | Complying with the sanctions and export-control rules that apply to the Services and the servers, and enforcing the eligibility conditions of our contracts |
| Handling notices of illegal content, giving statements of reasons and notifying suspicions of criminal offenses involving a threat to the life or safety of a person | Article 6(1)(c): Articles 16, 17 and 18 of the Digital Services Act | Not applicable |
| Handling review requests against our content-moderation decisions | Article 6(1)(f) | Reviewing our decisions and correcting them where a request is justified |
| Responding to orders and requests of courts and public authorities | Article 6(1)(c), where the order binds us under Union or Czech law | Not applicable |
| Sending marketing e-mails about our own similar services to existing customers (section 11) | Article 6(1)(f) | Direct marketing of our own similar services to our existing customers |
| Establishing, exercising or defending legal claims | Article 6(1)(f) | Protecting our legal position |
| Operating our website and the Platform interface, including cookies | As stated in the cookie notice (section 12) | As stated in the cookie notice |
4. Your right to object
4.1 You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR. We then stop the processing unless we demonstrate compelling legitimate grounds for it which override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defense of legal claims. You may also object at any time to the use of your personal data for direct marketing, and we then stop using them for that purpose (Article 21 of the GDPR). Send your objection to privacy@chapek.io or use the link in any marketing e-mail.
5. Whether you must provide personal data
5.1 Account Data are required to conclude and perform a contract with us: without them we cannot open an account, accept an order or provide the Services. The data needed for tax documents and for sanctions screening are required by law. Providing any other personal data is voluntary.
6. Recipients
6.1 We disclose personal data only to:
(a) our personnel who need them for the purposes in section 3;
(b) service providers that process personal data on our behalf as processors, all established in the Union and processing personal data only in the Union (facility services, e-mail and ticketing, accounting, identity and access management, sanctions screening, electronic signature, invoicing and billing, customer relationship management, and website hosting and forms), listed at chapek.io/legal;
(c) our payment service provider, Adyen N.V., a credit institution authorized in the Netherlands, established in the Union (the "Payment Processor"), which processes card payment data as an independent controller under its own privacy notice, and our bank, which processes the data of bank transfers as an independent controller;
(d) the card schemes and the card issuer through which a card payment is settled, which receive card payment data from the Payment Processor as independent controllers;
(e) our statutory auditor and our tax and legal advisers, who are bound by confidentiality; and
(f) courts and public authorities, including the tax authorities, where Union or Czech law requires it; we handle every such request under our Government Access Protocol (Annex 08, Part C, to the Master Services Agreement).
6.2 We do not sell personal data. DCXPS Inc., a separate legal entity in the United States, receives none of the personal data described in this notice and has no access to our systems.
7. Location of processing
7.1 We and our processors store and process the personal data described in this notice only in the Union. We do not transfer personal data to a country outside the Union or to an international organization. If Union or Czech law requires such a transfer, we make it only under Chapter V of the GDPR and inform you, unless the law prohibits it. The Payment Processor, the card schemes and the card issuer process card payment data under their own privacy notices.
8. Retention
We keep personal data only for as long as the purpose requires and within the periods below. At the end of the period we delete or anonymize them.
| Personal data | Retention period |
|---|---|
| Tax documents | Ten (10) years from the end of the tax period in which the supply took place (Section 35(2) of Act No. 235/2004 Coll.) |
| Other accounting records, payment and prepayment records, pro-forma documents and receipts | The periods required by Czech tax and accounting law |
| Contract and order data and correspondence with customer representatives | The term of the contract and thereafter four (4) years, covering the general three-year limitation period for claims arising from the contract |
| Card tokens | Until the card is removed from the account or the account is closed |
| Platform accounts | The duration of the account |
| Security and activity logs of the Platform | Twelve (12) months from the date of the record or, for the logs of management and maintenance sessions concerning a customer's servers, until twelve (12) months after the end of the last prepaid service period of the order under which those servers are provided, whichever is later (Annex 08, Part B, section B.2.4, to the Master Services Agreement) |
| Access records of the DCXPS Facility | Twelve (12) months from the date of the record or, for the records of access to the hall in which a customer's servers are installed, until twelve (12) months after the end of the last prepaid service period of the order under which those servers are provided, whichever is later (Annex 08, Part B, section B.2.3, to the Master Services Agreement) |
| Video recordings of common areas of the DCXPS Facility | Twenty-one (21) days or, where a recording concerns an incident, until the incident has been resolved |
| Screening records | The term of the contract and five (5) years after its end |
| Notices and review requests under the Digital Services Act | Six (6) months after our decision or, where a dispute is pending, until it has been finally resolved |
| Data of prospective customers | Twenty-four (24) months after the last contact |
| Objections to marketing e-mails | For as long as we send marketing e-mails, so that we respect the objection |
9. Your rights and complaints
9.1 Your rights. Under Articles 15 to 22 of the GDPR you have the right:
(a) of access to your personal data (Article 15);
(b) to rectification (Article 16);
(c) to erasure (Article 17);
(d) to restriction of processing (Article 18);
(e) to data portability, for personal data you have provided to us and that we process by automated means on the basis of a contract or of your consent (Article 20);
(f) to object (Article 21; section 4); and
(g) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22).
We notify each recipient of a rectification, erasure or restriction as Article 19 of the GDPR requires, and we inform you about those recipients on request.
9.2 Exercising your rights. You can exercise your rights by writing to privacy@chapek.io. We respond without undue delay and in any event within one (1) month of receipt of your request. Where necessary, taking into account the complexity and number of requests, we may extend that period by two (2) further months; we then inform you of the extension, with the reasons, within the first month (Article 12(3) of the GDPR). We may ask you to confirm your identity.
9.3 Automated decisions. We take no decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
9.4 Complaints. You have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů) in the Czech Republic or with the supervisory authority of the Member State of your habitual residence, of your place of work or of the place of the alleged infringement (Article 77 of the GDPR).
10. Security
10.1 We protect the personal data described in this notice with the technical and organizational measures that we apply to the Services and that are described in Annex B of the Data Processing Agreement and in Annex 08 to the Master Services Agreement, including access control, encryption, logging, processing in the Union by personnel located in the Union, and incident response.
11. Marketing e-mails
11.1 We send marketing e-mails about our own similar services to the e-mail address that you or your organization gave us in connection with an order of the Services, as permitted by Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services, as amended. You can refuse such e-mails free of charge when you give us the address and at any time afterwards, including by the link in each e-mail.
13. Changes to this notice
13.1 We update this notice when our processing changes. The current version and its effective date are published at chapek.io/legal, and we notify account holders of material changes through the Platform.