Privacy Policy
1. Controller
TOPVENDI s.r.o., Radlická 2343/48, Smíchov, 150 00 Praha 5, Czech Republic (VAT ID CZ04952057) is the controller of the personal data described here. Contact: email.
2. What we collect
- Contact details you enter at checkout: name, email address, phone number.
- Order data: what you bought, the amount, currency, promo code used, and payment status.
- Billing data collected by Stripe at checkout, including country and address (needed to determine VAT) and, optionally, a business VAT ID. We never receive your full card number.
- Learning data: your progress, the answers and materials you submit during the tasks, and the documents generated for you.
- Technical data: IP address (stored as a hash for anti-abuse rate limiting), browser and device information, and access logs.
- Telegram data if you choose to connect the reminder bot: your Telegram user ID and username.
3. Why we use it, and on what legal basis
- To provide the practicum (account, access, lessons, AI assistant, support) — performance of a contract, Art. 6(1)(b) GDPR.
- To take payment and issue invoices — contract and legal obligation, Art. 6(1)(b) and (c).
- To meet accounting and tax obligations, including EU VAT reporting — legal obligation, Art. 6(1)(c).
- To keep the service secure and prevent abuse (rate limiting, fraud prevention) — legitimate interests, Art. 6(1)(f).
- To send service messages about your access and progress — contract.
- To send optional Telegram reminders — your consent, Art. 6(1)(a); you can turn them off at any time.
4. Who we share it with
We use the following categories of processors, each bound by a data processing agreement:
- Stripe — payment processing, tax calculation and receipts.
- Our learning platform and hosting providers — to run the platform on which the practicum is delivered.
- Email delivery provider — to send you access and service emails.
- Telegram — only if you connect the reminder bot.
- AI providers — to power the assistants that help you complete the tasks; the text you submit in a task is sent to them for processing.
We do not sell your personal data and we do not share it for third-party advertising.
5. International transfers
Some of our processors operate outside the European Economic Area. Where that is the case, transfers are based on the European Commission's Standard Contractual Clauses or another valid transfer mechanism. You can request details of the safeguards in place by writing to us.
6. How long we keep it
- Account and learning data: while your account exists, and afterwards only as needed to resolve disputes.
- Order, payment and tax records: for the retention period required by Czech accounting and VAT law.
- Technical logs and IP hashes: a short period, for security and abuse prevention.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased where the law allows;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing already carried out.
Write to our contact address to exercise any of these. You can also complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the supervisory authority in your own country.
8. Cookies
We use cookies that are necessary to run the site and keep you signed in, and cookies set by Stripe during checkout for payment and fraud prevention. We do not use advertising cookies.
9. Changes
We may update this policy. The current version is always published on this page, with the date of the last update at the top.