Privacy Policy
This policy describes how the operator of the Forgmatic platform handles the personal data of website visitors and of users who have created an account.
If you are reading this as a customer of a shop running on the platform, you are probably looking for that shop's policy — the controller of your data is its operator, not the platform operator.
Who is the controller
The controller is the operator of the Forgmatic platform. Contact details, including identification and address, are in the footer of this site; for data protection matters, use the contact e-mail shown there.
What data we process
- Registration and billing data — name, e-mail, phone, organisation name and identifiers, billing address.
- Operational data — sign-in records, IP address in truncated form, browser type, activity records in the administration.
- Content you put into the service — we process this for you as a processor, not as a controller; it is governed by the data processing agreement.
- Communications — the content of messages sent via the contact form or by e-mail.
Why and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service and managing the account | performance of a contract |
| Invoicing and accounting | legal obligation |
| Security and abuse prevention | legitimate interest |
| Sending service news | consent, or legitimate interest for existing customers |
| Traffic analytics | consent |
Who we share data with
We share data only with processors who run parts of the service for us — hosting, file storage, e-mail delivery, payment processing and error tracking. The current list is published on the Sub-processors page.
Some processors may process data outside the European Economic Area. In that case the transfer is covered by the European Commission's standard contractual clauses or another appropriate safeguard.
How long we keep data
- Account data — for the term of the contract and 30 days after it ends.
- Accounting records — 10 years under the Accounting Act.
- Sign-in and security records — 12 months.
- Contact-form messages — 24 months.
- Data processed on the basis of consent — until consent is withdrawn.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
An overview and how to exercise these rights is on the GDPR — your rights page. You can access and delete your data yourself from your account.
You also have the right to lodge a complaint with the Czech Data Protection Authority (www.uoou.gov.cz).
Cookies
The use of cookies is described in the separate Cookie Policy.