Privacy Policy

Privacy Policy (the “Policy”).

1. Introductory provisions and definitions

1. The terms “Application”, “Provider” and “User” have the same meaning as in the Terms and Conditions. In connection with personal data protection, a User may also be referred to as a “Data Subject”.
2. The controller of personal data is the Application Provider, Qsiga s.r.o., registered office at Suchý vršek 2107/30, 158 00 Prague 5, Company ID: 29009235.
3. A processor is an entity that processes personal data for the Controller on the basis of applicable law or the Controller’s instructions, typically under a data processing agreement.
4. The Provider does not disclose Users’ personal data to unauthorised third parties and does not use it for advertising purposes unless otherwise stated for a specific processing activity.

2. Personal data we process

1. For the operation of the Application we process in particular:
   • E-mail – used as the User’s login name.
   • Password – used to authenticate the User
2. The legal basis for processing data necessary to operate the Application is primarily performance of a contract and legitimate interest.
3. For customers using paid services, we process data necessary for contractual, accounting and tax purposes, in particular:
   • name and surname,
   • company name,
   • billing address,
   • Company ID,
   • VAT ID.
4. The legal basis for this processing is primarily performance of a contract and compliance with legal obligations in accounting and taxation.
5. A User may also provide a telephone number, for example for technical support. A telephone number is not required for ordinary use of the Application unless a specific service requires otherwise.
6. On the public Erpena website we use strictly necessary cookies and, after consent is given, analytics cookies. Details are available in our Cookie Policy.

3. How and where we process data

1. For the cloud version, Application data is stored on the Provider’s production and backup servers. The Provider uses hosting supplied by Avatech s.r.o. for the physical server infrastructure. This does not apply to on-premise installations operated in the Customer’s infrastructure.
2. Access to servers and production data is limited to authorised persons to the extent necessary for operation, technical administration, support and security of the service.
3. Personal data may be processed manually and automatically. We keep records of processing activities to the extent required by applicable law.
4. The Application is not intended for children under 16 and the Provider does not intentionally collect their personal data for the purpose of providing the Application.
5. Under the current cloud service model, Application data is stored and processed within the European Economic Area unless otherwise agreed with the Customer for a specific service.

4. Rights of the data subject

1. To exercise your rights, please contact us using the details at the end of this Policy. We may reasonably verify the identity of the applicant. For manifestly unfounded or excessively repetitive requests, we may proceed as permitted by applicable law.
2. To the extent provided by applicable law, you have in particular the right:
   • to access your personal data,
   • to rectify inaccurate and complete incomplete personal data,
   • to erasure of personal data,
   • to restriction of processing,
   • to object to processing,
   • to lodge a complaint with the competent supervisory authority.
3. Some rights can be exercised directly through the Application

5. Retention periods

1. We retain personal data only for as long as necessary for the purpose for which it is processed and for any additional period required by applicable law.
2. Data required to operate the Application is kept for the duration of the contractual relationship. Under the current operational setup, data is removed from production systems after the service ends and subsequently from backups according to the configured retention periods.
3. Accounting and tax data is retained for the periods required by applicable law.
4. Data used for technical support is retained for as long as necessary to resolve the request and, where needed for follow-up support, for the duration of the contractual relationship.

6. Final provisions

1. The User undertakes to notify the Provider without undue delay of facts that may affect the accuracy or lawfulness of processing of the User’s personal data.
2. The User undertakes to provide the Provider with reasonable cooperation necessary to handle requests and comply with personal data protection obligations.
3. The Provider may update this Policy, in particular when the service, processing activities or legal requirements change.
4. The current version of this Policy is always available at www.erpena.com.
5. The effective date of this version of the Policy must be updated before publication.