1. Controller
The controller of personal data is DVDent spol. s r.o., ID No. 25435710, registered office Chovatelů 336, 413 01 Vědomice, Czech Republic, entered in the Commercial Register kept by the Regional Court in Ústí nad Labem, section C, file 18292 (the “clinic”). Contact for questions about personal data: [to complete: e-mail].
2. What data we process
- Access request: e-mail, name (optional), request text, language.
- Account: account status and the date it changed, access expiry date, the clinic’s internal note (for example the course you attended), chosen language, time of the last sign-in.
- Password: only as a one-way hash (argon2id). We do not know the password itself and it cannot be derived from the hash.
- Agreement to the terms of use: the terms version and the time of agreement.
- Sign-in: while you are signed in, data about the sign-in (time, browser type). Failed sign-in attempts are stored with the entered e-mail and IP address for at most two hours, to protect against password guessing.
- Change records: who approved or rejected a request and when, and who revoked or restored access and when.
- Technical server records: the account identifier and, for blocked requests, the IP address. [to complete: retention period of server logs]
Statistics on downloads and views of materials are kept without linking them to a particular user.
3. Purpose and legal basis
- Handling your request and providing access to the materials: processing necessary to provide the service you request (Art. 6(1)(b) GDPR). [verify: for clinic employees possibly legitimate interest or the employer’s obligations]
- Security of the service and protection of the materials: protection against account misuse, records of access changes, technical records. This is the clinic’s legitimate interest (Art. 6(1)(f) GDPR).
Processing is not based on consent. Agreeing to the terms of use is agreement to the contractual rules for using the materials, not consent to the processing of personal data.
4. Who has access to the data
- Authorised clinic staff who manage access.
- Octal Systems s.r.o., the operator of the application, as a processor under a contract with the clinic. [verify: data processing agreement, Art. 28 GDPR]
- Hosting providers: application server [to complete: operator and location of the server]; file storage Hetzner Online GmbH, Germany; sending e-mails [to complete: mail server provider].
We do not transfer the data outside the European Union [verify against hosting] and do not use it for automated decision-making or profiling.
5. How long we keep the data
- For as long as the account exists.
- When the account is closed, personal data is removed from the database immediately. Only an anonymous record that the account existed remains, together with change records without name and texts.
- Rejected requests and accounts with revoked or expired access: [to complete: period, e.g. 12 months; then erasure].
6. Cookies
The service uses only necessary cookies: sign-in, protection of forms against forgery and the language choice. It uses no analytics or advertising cookies.
7. Your rights
You have the right of access to your data, to rectification and erasure, to restriction of processing and to data portability, and the right to object to processing based on legitimate interest. You can close your account, and with it your personal data, at any time yourself on the My account page. You can exercise the other rights at the contact in section 1. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).