Data Processing Agreement
English translation for your convenience. The binding version is the Czech version; in case of any discrepancy, the Czech version prevails. Annex 1 to the Terms and Conditions, concluded under Art. 28(3) of Regulation (EU) 2016/679 (GDPR). Version effective from 4 August 2026. It is concluded together with the service contract and applies only if your documents contain personal data.
Who is who
You, the client, are the controller. The processor is Pravano MG s.r.o., Company ID (IČO) 29860148, with its registered office at Lešenská 168, Kostelec, 763 14 Zlín, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno (Czech Republic), section C, file 153218.
This annex concerns only personal data contained in the documents you hand over to us for the check. Data we collect ourselves (your contact and billing details, communication) we process as a controller – that is governed by the Privacy Policy.
A recommendation first: please provide documents without personal data where possible (anonymised or pseudonymised). Specific names are usually unnecessary for assessing regulatory compliance, and the best data protection is data we do not have to process at all.
1. Subject matter, duration, nature and purpose of processing
Subject matter and purpose: carrying out the ordered readiness check for a European regulation and producing the related outputs. Nature of processing: collection, structuring, consultation, use, storage and erasure. Duration: for the duration of the service and then for the period stated in Art. 8.
Categories of data subjects: usually employees and collaborators of the controller, contact persons of its suppliers and customers, and other persons named in the documents.
Type of personal data: identification and contact data (name, position, business e-mail, phone), data on job position and responsibility, data contained in the documents handed over. We do not process special categories of data under Art. 9 GDPR and ask you not to provide them; if we nevertheless find them, we will notify you and ask for instructions.
2. Processing only on your instructions
We process personal data only on your documented instructions, including with regard to transfers to a third country. The order of the service and this annex are deemed your instruction to the extent necessary to provide the service. If Union or Czech law requires us to process data, we will inform you before processing, unless that law prohibits it.
We are obliged to inform you if, in our opinion, an instruction infringes the GDPR or other data protection provisions.
3. Confidentiality
Persons involved in processing on our side are bound by confidentiality, which continues after the cooperation ends. Only the managing director, as the sole authorised person, has access to your documents.
4. Security (Art. 32 GDPR)
- encrypted transfer (TLS) and encrypted storage with the providers listed in Art. 5;
- access control – admin interface protected by a token, access for authorised persons only;
- logging of actions in the administration and records of sent messages;
- data minimisation – only what is necessary enters the outputs and AI processing;
- regular backups and recoverability of data;
- separation of operational databases (content / operations / business data).
5. Further processors (Art. 28(2) and (4))
You grant us a general authorisation to engage these further processors:
- Cloudflare – hosting of the application and databases, traffic protection;
- Resend – sending transactional e-mails;
- Anthropic – AI assistance in preparing outputs (see Art. 3 of the Privacy Policy; we pass on only the necessary data and every output is reviewed by a person);
- Google Workspace – operation of e-mail mailboxes;
- providers of invoicing and accounting.
We contractually impose on each further processor the same obligations we have towards you. We will notify you of any intended change or addition by e-mail at least 15 days in advance; you may raise a reasoned objection and, if no agreement is reached, terminate the contract without penalty. We remain fully liable to you for the performance of the obligations of further processors.
Transfers outside the EU take place on the basis of an adequacy decision or standard contractual clauses approved by the European Commission.
6. Assistance with data subjects’ rights
If a data subject whose data we process for you contacts us directly, we will not answer them ourselves and will inform you of the request without undue delay. We will provide you with all reasonable technical and organisational assistance in handling the request (access, rectification, erasure, restriction, portability, objection).
7. Assistance with security breaches and impact assessments (Art. 32–36)
We will notify you of a personal data breach without undue delay (usually within 24 hours) after becoming aware of it, to the e-mail address given in the contract. We will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken. Notifying the supervisory authority is your responsibility as controller.
We will also assist you with data protection impact assessments and prior consultation with the supervisory authority.
8. What happens to the data at the end
After the provision of the service ends, we will erase documents containing personal data or return them to you, at your choice, and delete existing copies – unless Union or Czech law requires us to keep them. Unless you instruct otherwise, we will erase the documents within 12 months of delivering the outputs. We keep the outputs themselves and the contract documentation under Art. 5 of the Privacy Policy for the defence of legal claims.
9. Demonstrating compliance and audits
On your request we will provide all information necessary to demonstrate that we meet our obligations under this article and will allow for audits, including inspections, carried out by you or an auditor you appoint. An audit takes place during working hours, by agreement at least 14 days in advance, at most once a year (unless a security breach has occurred) and subject to confidentiality regarding our trade secrets.
10. Final provisions
This annex forms an integral part of the Terms and Conditions and is governed by Czech law. In the event of a conflict between this annex and the Terms in matters of personal data protection, this annex prevails. If you need it signed as a separate document, write to info@pravano.cz – we will send it promptly. This English text is a translation; in case of any discrepancy, the Czech version prevails.