Privacy policy.

1.Data controller

The controller of personal data is Český Partner s.r.o., registered office at Kaprova 42/14, Staré Město, 110 00 Praha 1, Czech Republic, company ID 29059950, registered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 163682 — the operator of the Webero platform (webero.co).

We are not required to appoint a data protection officer and have not appointed one. For any privacy matter write directly to support@webero.co.

2.Two roles, two responsibilities

For data about YOU as a customer of the platform — account, billing, support correspondence — we are the controller and these policies apply.

For data you put into the platform about YOUR OWN customers — contacts from an enquiry form, e-shop orders, newsletter subscribers — we are only the processor. You are the controller: you decide why it is processed and for how long, and you are answerable for it to your customers. We handle it only on your instructions and to the extent needed to run the service.

3.What data we process

We keep only what the service cannot run without. This is the complete list:

• Account: e-mail, name, phone (optional) and a password hash. We do not store the password itself — the database holds a one-way hash it cannot be recovered from. If you enable two-factor authentication we also store its encrypted key and backup codes.
• Billing: billing details, subscription history, issued documents and payment records (amount, status, variable symbol, date paid). We do not hold your card number — it is entered directly with the payment gateway.
• Content you create: text, photographs, site settings and e-shop products. Any personal data inside them is your choice and the section on the two roles applies.
• Form messages: name, e-mail, phone, the message and the sender’s IP address. The IP is stored to protect the form against bots and abuse.
• Newsletter: the e-mail address and the page you subscribed from.
• Connected social accounts: account identifier, profile name and an encrypted access token. We do not obtain private messages, passwords or payment details.
• Operational records: technical logs needed for security and debugging, and a record of our support staff accessing your administration.

4.Why we process it and on what basis

To perform the contract: running the site, signing in, billing the subscription and support. The service cannot be provided without this data.

To meet legal obligations: accounting and tax rules regarding issued documents in particular.

For legitimate interests: securing the service, protecting forms against abuse and bots, debugging and defending legal claims.

On the basis of consent: the newsletter and any future traffic measurement. Consent can be withdrawn at any time; for the newsletter, by using the unsubscribe link in every e-mail.

5.Who we share data with

We do not sell data and do not pass it on for third-party marketing. We share it only with processors the service could not run without:

6.Transfers outside the European Union

The database and the application itself run in the European Union (Frankfurt). Two processors on the list above are however based in the United States — the AI model provider and, in part, the e-mail sender.

For these transfers we have standard contractual clauses approved by the European Commission under Article 46 GDPR in place. We will provide a copy on request.

7.What happens to AI inputs

A brief you enter into the AI builder or the text rewriter is sent to the language model provider we have a processing agreement with. Inputs are not used to train their models.

Do not put data into the AI tools that you are not entitled to pass to a third party — in particular sensitive personal data about your own customers.

8.Support access to your administration

When you report a problem, our administrator may look into your administration. Every such access is logged — who, when and to which site — and the record cannot be deleted from inside the application.

We do not enter anyone’s administration without a reason and we do not copy content out of it.

9.How long we keep data

Account details and site content for as long as the account exists. After a site is suspended for non-payment they remain available for at least 30 days so you can download them; the project is then archived and subsequently deleted.

Billing documents for the period required by accounting and tax law — we cannot shorten that even at your request.

Form messages and operational records for as long as needed to handle them and for security, then deleted.

Newsletter data until you unsubscribe.

10.Security

All transfers are encrypted. Passwords are stored only as a one-way hash; social network access tokens and two-factor keys are encrypted.

Access to data is limited by role and you can enable two-factor authentication on your account. Backups are made regularly and stored separately.

11.Your rights

You have the right of access, rectification and erasure, the right to restriction of processing, to data portability, and the right to object to processing based on legitimate interests. Any consent given may be withdrawn at any time.

Most of this you can do yourself in the account administration — edit details, export content and close the account. For anything else write to support@webero.co; we reply within one month at the latest.

If you are a visitor or a customer of a site built on Webero, exercise your rights with the operator of that site — they are the controller, not us. We are happy to help them handle the request.

12.Supervisory authority

If you believe the processing breaches the rules, you may lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

13.Connecting social accounts

If you connect a social network account (for example Instagram) to your site, we process only the access tokens necessary to display public content on that site. We neither obtain nor store private messages, passwords or payment details.

The data is used solely to display public content — typically photographs — on a website operated on the Webero platform.

You can disconnect at any time in your site administration (Settings → Integrations). All tokens are deleted immediately on disconnection.

14.Cookies

Which files we store in the browser and why is described in the cookie policy.

15.Changes to this policy

This policy may change, in particular when a new processor or feature is added. We announce any material change by e-mail at least 30 days in advance; the date of the last update is always at the top of this page.