Personal data processing policy of the Stavario online application

version 1.1.

1. Introduction and identification of the controller

This document presents the Personal Data Processing Policy for customers and users of the Stavario online application, operated by Vím o všem s.r.o., Company ID: 06935338, with its registered office at Smetanova 1249/6, 419 01 Duchcov, Czech Republic (hereinafter the "Company" or the "Controller"). The Company is a personal data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation; hereinafter the "GDPR"). These principles apply to both customers – entrepreneurs (B2B) and consumers (B2C) – and to all natural persons who use the Stavario application or otherwise come into contact with us.

The aim of this document is to explain clearly what personal data about you as a data subject we collect and process when providing services, selling products, operating the website and the Stavario online application, and when communicating with you as an existing or potential customer. You will also learn for what purposes and on what legal basis we use your data, to whom we may transfer it, what rights you have and how long we keep your data. All processing of personal data is always carried out in accordance with applicable personal data protection legislation, in particular Regulation (EU) 2016/679 (GDPR), Act No. 110/2019 Coll., on the processing of personal data, and relevant Polish legislation in the field of personal data protection.

2. What data we collect

We process only such personal data as is necessary for the stated purposes. Typically we process the following categories:

Basic identification and address data. Name, surname, business name, date of birth, Company ID, VAT ID, address of residence or business, billing address, electronic signature.
Contact data. Email address, phone number, contact or social-media profile address.
User account data. Login credentials (username, encrypted password) and account settings.
Service-use and transaction data. Orders, licences, transactions and payments.
Communication and interaction data. Records of communication with our Company (email, support chats, etc.).
Technical data. Automatically collected when you use the website or the application – IP address, cookie identifiers, browser and OS data, access times, activity logs.
Data processed on the basis of your consent. In particular contact data for marketing communications, personalised advertising, biometric signature data if you use the in-app signing feature.

3. How we use the data (purposes and legal bases)

Provision of our services and contract performance. (Legal basis: performance of a contract.)
User account administration and customer support. (Legal basis: performance of a contract.)
Customer communication. (Legal basis: performance of a contract; legitimate interest.)
Ensuring functionality and security of the application. (Legal basis: legitimate interest.)
Invoicing and compliance with accounting and tax obligations. (Legal basis: performance of a contract and legal obligation.)
Compliance with other legal obligations. (Legal basis: legal obligation.)
Debt recovery and legal disputes. (Legal basis: legitimate interest.)
Fraud and service-abuse prevention. (Legal basis: legitimate interest.)
Promotion of our services to existing customers. Every email contains a simple opt-out option. (Legal basis: legitimate interest – direct marketing.)
Newsletters and commercial communications based on consent. Consent is voluntary and may be withdrawn at any time. (Legal basis: your consent.)
Personalisation of content and advertising. (Legal basis: legitimate interest, or consent.)
Analytics and development of new functionality. Primarily aggregated or anonymised data. (Legal basis: legitimate interest.)
Enabling electronic signing of documents. (Legal basis: your consent; subsequent storage – legitimate interest.)

4. With whom we share the data (recipients)

We do not share your personal data with any third parties for their own marketing purposes, nor do we sell it. The main categories of recipients are:

Processors – service suppliers to the Company. IT, analytics and marketing providers, payment services, accountants and tax advisors, lawyers, external sales agents.
Public authorities. When required by law.
Other persons on lawful grounds. Where necessary to protect our rights or property.
Legal successors of the Company. In case of sale or merger.

We do not transfer your data to third countries outside the EU unless additional GDPR safeguards are met (see section 9).

5. How you can manage your data – your rights

As a data subject you have the following rights under the GDPR:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure ("right to be forgotten") (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to notification of rectification/erasure/restriction (Art. 19 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR) - in particular against direct marketing
Right to withdraw consent (Art. 7(3) GDPR)
Right to lodge a complaint with a supervisory authority - in the Czech Republic at the Office for Personal Data Protection (uoou.cz); in Poland at the President of the Personal Data Protection Office (uodo.gov.pl); in Slovakia at the Office for Personal Data Protection (dataprotection.gov.sk); in other EU/EEA Member States at the local DPA. (Art. 77 GDPR.)

You can exercise your rights by contacting the Controller:

Email: info@stavario.com
Postal address: Vím o všem s.r.o., Smetanova 1249/6, 419 01 Duchcov, Czech Republic

We handle requests without undue delay, at the latest within one month of receipt.

6. Automated processing and decision-making

No automated individual decision-making within the meaning of Art. 22 GDPR takes place. Stavario uses AI features to streamline selected processes; however, AI never makes legally binding decisions without human review.

7. Cookies and similar technologies

We use necessary, analytical and marketing cookies. Necessary cookies do not require your consent; analytical and marketing cookies are only processed based on your consent under Art. 6(1)(a) GDPR. For details see our Cookie Policy.

8. Security of personal data

We have implemented technical and organisational measures in accordance with Art. 32 GDPR: modern encryption (HTTPS/TLS), firewalls, antivirus protection, regular backups, role-based access ("need-to-know"), staff training and regular testing.

9. International transfers

Your personal data is processed primarily in the Czech Republic and the EU. If a transfer to a third country outside the EU/EEA becomes necessary, we always ensure: (a) an adequacy decision by the European Commission, (b) Standard Contractual Clauses (SCC), or (c) other GDPR safeguards. There is currently no systematic transfer of your data outside the EU/EEA.

10. Liability for data entered by the user (B2B processing)

If you store personal data of third parties in the Stavario application, our Company acts as a processor and you (or your company) act as the controller. You must ensure the lawfulness of processing, comply with information obligations, obtain consents where required, and refrain from uploading special categories of personal data without an explicit legal basis. Vím o všem s.r.o. is not liable for processing of personal data entered by the user into the application under their own account.

11. Retention period

Customer data. Duration of the contract + 10 years from the end of the year in which the contract terminated (Accounting Act, VAT Act).
Accounting and tax documents. 10 years from the end of the relevant accounting period.
Communication and interaction records. Duration of the contract + 1–3 years.
Marketing data. Until consent is withdrawn; for existing customers for the duration of the contract + 1–3 years.
Cookie data. Session cookies are deleted when the browser closes. Persistent cookies typically have a lifespan of 6–12 months. Server logs are typically retained for 6 months.

After these periods, we delete or anonymise the personal data.

Addendum: Partner Material Calculations

Re Article 1 - The Company's role in the processing of data entered by users

When processing personal data of customers and users of the application for its own purposes, Vím o všem s.r.o. acts as a personal data controller. However, if the Licensee stores and manages the personal data of third parties through the Online Application and itself determines the purposes and means of their processing, Vím o všem s.r.o. acts as a processor of this data in providing the relevant service. The specific roles of the individual entities in the use of Partner Services are further described in this policy.

Re Article 2 - What data we collect

Data related to partner calculations. In the case of voluntary use of the Partner Service, data contained in the project documentation, technical parameters of the construction, project location, parcel number, cadastral area identification, inquiry identifier, and, where applicable, the name and surname of the investor or other related persons may be processed. The scope of processing is limited to the data necessary for the specific purpose. The data may also constitute personal data if they allow for the indirect identification of a natural person.

Re Article 3 - How we use the data

Mediation of partner material calculations. Based on an active request from an authorised user, project documentation and necessary related data may be transferred to a professional partner for the purpose of preparing a bill of materials, a technical design, a calculation or a price quotation. The result may subsequently be transferred back to the Stavario application and made available to the user. If we act as a processor when transferring personal data entered by the Licensee, we proceed on the basis of the Licensee's documented instruction and the corresponding contractual agreement. The legal basis for the processing of third parties' personal data is determined by the respective controller. To the extent of our own processing of personal data related to the handling of the request, we proceed according to the corresponding legal basis under Art. 6 GDPR.
Checking for duplicate projects. Within the provision of Partner Services, the professional partner may carry out a check to determine whether a material calculation, quotation or inquiry for the specific construction or project already exists in its own records. The parcel number, cadastral area or other necessary project identifier may be used for this check. The professional partner acts as a separate controller in this comparison if it determines the purposes and means of this processing. Processing of personal data for checking duplicates may be based on a legitimate interest under Art. 6(1)(f) GDPR only if the conditions for this legal basis are met, in particular the necessity of the processing and its proportionality in relation to the rights and interests of the data subjects. The professional partner is responsible for fulfilling its information obligations and for the lawfulness of this processing.

Re Article 4 - Recipients of personal data

Professional partners providing material calculations. Based on a voluntary request from an authorised user, project documentation and necessary related data may be transferred to contractual professional partners for the purpose of preparing bills of materials, technical designs, calculations and price quotations. A partner for these services is in particular Wienerberger s.r.o. When preparing its own quotations and checking for duplicates in its own database, this partner acts as a separate controller of personal data to the extent that it determines the purposes and means of processing. The transfer of data does not automatically establish an authorisation for their use for unrelated direct marketing.

Re Article 10 - Responsibility for entered data

Transfer of data within Partner Services

If the Licensee, through an authorised user, requests the processing of a partner material calculation, the Licensee is responsible, in its capacity as a personal data controller, for being authorised to make the relevant data available for this purpose and for having fulfilled the corresponding information obligations towards the data subjects. Vím o všem s.r.o., in its capacity as a processor, carries out the transfer of personal data on the basis of the Licensee's documented instruction and in accordance with the relevant contractual agreement.

Allocation of responsibility

The Licensee's responsibility for the lawfulness of the entered and disclosed data does not release Vím o všem s.r.o. or the professional partner from their own statutory obligations under the GDPR. If the professional partner determines its own purposes and means of processing personal data, it is responsible for such processing to the extent of its role as a controller.

Re Article 11 - Data retention period

Data related to partner calculations. Project documentation and related personal data transferred for the purposes of Partner Services are processed for the period necessary to handle the relevant request and subsequently only to the extent and for the period corresponding to the statutory purpose of their further retention. When processing data on behalf of the Licensee, their retention and erasure are governed by the relevant contractual agreement and the Licensee's instructions. If the professional partner acts as a separate controller of personal data, it determines the statutory retention period in accordance with its obligations under the GDPR and informs the data subjects thereof.

12. Supervisory authorities

Czech Republic – Office for Personal Data Protection (ÚOOÚ). Pplk. Sochora 27, 170 00 Praha 7. Web: uoou.cz · Email: posta@uoou.cz · Tel.: +420 234 665 111.
Poland – Urząd Ochrony Danych Osobowych (UODO). ul. Stawki 2, 00-193 Warszawa. Web: uodo.gov.pl · Email: kancelaria@uodo.gov.pl · Tel.: +48 606 950 000.
Slovakia – Úrad na ochranu osobných údajov SR. Hraničná 12, 820 07 Bratislava. Web: dataprotection.gov.sk.
Other EU/EEA Member States. Please contact your local Data Protection Authority. A list is available at edpb.europa.eu.

13. Changes to these principles

We reserve the right to update these principles. Material changes will be notified in advance by email or in-app notification. The current version is always available on our website.

These Principles are effective from 31 January 2026 (version 1.1).

Contact: info@stavario.com | Vím o všem s.r.o., Smetanova 1249/6, 419 01 Duchcov, Czech Republic

Privacy Policy