Privacy Policy

This policy is effective from 1 November 2020.

This is an English translation of the Privacy Policy that applies to the Czech market (controller: Antivirus s.r.o.). It is provided for information only; the legally binding version is the Czech one.

This privacy policy (the “Policy”) informs you how Antivirus s.r.o., with its registered office at Inovační 122, Hodkovice, 252 41 Zlatníky-Hodkovice, Company ID (IČO): 088 72 848, registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 325903 (“Antivirus” or the “Company” or the “Controller”), obtains, collects, processes and stores your personal data in connection with your user relationship or other relationship with the Company.

1. General provisions

1.1. The purpose of this Policy within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) is to inform you which personal data of natural persons the Company, as the controller of personal data, processes in the course of providing its services, for what purposes and for how long the Company processes such personal data in accordance with applicable law, to whom and for what reason it may transfer such data, and also to inform you of the rights that natural persons have in connection with the processing of their personal data and how they may exercise them. 1.2. This Policy applies to the processing of data of our users, i.e. you, if you are a natural person, and/or of your employees or members of your governing bodies, if you are a legal entity, or of visitors to the Company’s website https://www.patrongo.com/, in each case to the extent of the personal data corresponding to your position in relation to the Company. All services we provide are intended for you as our User (the “User” or “you”).

2. Controller of personal data

2.1. This Policy is effective from 1 November 2020 and is issued in accordance with the GDPR in order to fulfil the Company’s information obligation as a controller under Article 13 of the GDPR.

2.2. The controller of personal data is the Company Antivirus s.r.o., with its registered office at Inovační 122, Hodkovice, 252 41 Zlatníky-Hodkovice, Company ID (IČO): 088 72 848, registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 325903

3. Data protection officer

3.1. The Company is not obliged to appoint a data protection officer. No data protection officer has been appointed in the Company. 3.2. You may contact Antivirus as the controller of personal data directly at:

• Antivirus s.r.o.
• Inovační 122, Hodkovice,
• 252 41 Zlatníky-Hodkovice
• E-mail: support@patrongo.com

4. Categories of personal data processed by Antivirus

4.1. Personal data is any information relating to a natural person, i.e. to you, by which the Company is able to identify you. In connection with the provision of its services, the Company may process the following categories of personal data. 4.2. Basic personal identification data 4.2.1. This is data that is, or in certain cases may be, necessary for your registration in the Patron application (the “Application”), in particular the following personal data:

• your e-mail address;
• password.

4.2.2. If you use the option of registering via third-party platforms, such as Facebook or Google, Antivirus may collect and further process your personal data that is already associated with your account on the relevant platform. In such a case, this may include, for example, your:

• first name and surname;
• profile picture;
• e-mail address;
• telephone number;
• gender;
• date of birth;
• city.

4.3. Data necessary for the provision of the service 4.3.1. This is personal data that we strictly need in order to provide you with our service consisting in the detection of potentially excessive expenses and possible risks associated with missing products or services, namely:

• form of address (this may be your name, but also a made-up nickname);
• age;
• gender;
• postal code of your place of residence;
• data on the expenses on your bank account and on the bank with which your bank account is held.
• a basic overview of the income and expenses on your bank account and of the bank with which your bank account is held;
• data on subjectively excessive expenses on your bank account that the Application has assessed as such.

4.4. Data obtained in the course of providing the service 4.4.1. This is personal data that you provide to us in the course of the provision of the service. 4.4.2. In connection with Partner offers, the Company may process data on whether you have completed the arrangement/activation of a service with a Partner (e.g. order, activation, commencement of the service), or whether a cancellation/withdrawal has occurred. This data is used to evaluate the cooperation, to prevent fraud and to credit the Reward to the Patron Wallet.

This concerns the following personal data:

• a record of your communication with our chatbot;
• a record of your communication with a Specialist;
• data on your most recent activity in the Application;
• telephone number;
• information on previous expenses that have been detected as a potentially excessive expense, a possible risk associated with a missing product or service, or an opportunity to obtain an additional reward, and their parameters;
• information on whether a contract has been concluded with a Partner or a Final Provider (as defined in the Terms and Conditions) and on the value of that contract;
• information on whether you are an invited user within the meaning of Article 11 of the Terms and Conditions, and on which user invited you to install the Application;
• your rating of satisfaction with the work of the Specialist.

4.5. Data necessary for the use of the “Invite friends and get a reward” programme 4.5.1. This is data that you link with the application by sending, via SMS, a unique link generated by you to a telephone number. When you click the “invite” button, an invitation is created and the following data is stored in the database:

• telephone number
• the label (most often the first name and surname) under which the telephone number is saved in the contacts

5. Purpose, period and legal basis of the processing of personal data

5.1. Processing for the performance of a contract, for compliance with legal obligations and for the legitimate interests of the company 5.1.1. Processing of personal data in the performance of a contractual obligation 5.1.1.1. In order for the Company to provide you with its services, it needs to know your personal data, which it must then also process. We process your personal data in particular for the purpose of enabling your access to the Application and for the purpose of fulfilling the obligations we have undertaken towards users of the Application, where the legal basis for the processing is therefore the performance of a contract. For these purposes, personal data is processed to the extent defined in Articles 4.1, 4.2, 4.3, 4.4 and 4.5 of this Policy. 5.1.1.2. We obtain the personal data processed in this way directly from you upon your registration in the application and further in the course of the provision of our services. 5.1.1.3. This personal data is processed by the Company only for the duration of the contractual relationship between you and the Company and for a further period of three years from the termination of the provision of services between you and the Company, or for such period as the Company is required by law. 5.1.1.4. Facilitation of a Partner offer - if you choose to resolve a specific opportunity and give your express consent to the transfer of data to a Partner, the Company processes your personal data for the purpose of ensuring redirection to the Partner’s website/digital process or, where applicable, the transfer of the necessary contact data. 5.1.1.5. For the purpose of evaluating and completing the arrangement/activation of a service with a Partner, and for the purpose of crediting the Reward, the Company processes the conversion status. The legal basis is the performance of a contract (the provision of the Application’s functionality and the reward) and/or the legitimate interest in the prevention of fraud and in the correct settlement of the cooperation; where the nature of a specific integration so requires, the Company may also require your separate consent within the specific Partner offer.

5.1.2. Processing of personal data in the performance of a legal obligation 5.1.2.1. In providing its services, the Company is obliged to comply with obligations arising from the following legislation, namely Act No. 563/1991 Coll., on Accounting (the “Accounting Act”); Act No. 586/1992 Coll., on Income Taxes (the “Income Tax Act”) and Act No. 235/2004 Coll., on Value Added Tax (the “VAT Act”). 5.1.2.2. Certain personal data may be stated on accounting documents (i.e. on invoices or other documents) if we ever have reason to issue such an accounting document. The following acts: the Accounting Act, the Income Tax Act or the VAT Act require the Company to retain these documents for up to 10 years. Therefore, if the Company has a legal obligation to archive these documents, your personal data stated on the relevant document is stored together with them. 5.1.3. Processing of personal data on the basis of a legitimate interest 5.1.3.1. In the event that you fail to fulfil your obligation, or we suffer other damage or harm on your part, we may also process personal data on the basis of a legitimate interest consisting in the recovery of our receivables and/or the establishment, protection and exercise of the Company’s legal claims. For this purpose, we may retain your personal data for the limitation period under Act No. 89/2012 Coll., the Civil Code. 5.1.3.2. The Company is entitled to process your e-mail address within the meaning of Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services, for the purpose of disseminating commercial communications relating to the Services and Products, provided that you have not refused such communications. 5.1.3.3. The Company may send you general notices related to the provision of the Products and Services (e.g. a notice that there is an opportunity to optimise expenses in a certain category, or information on the availability of an opportunity in the Application). This communication forms part of the provision of the Services. 5.1.4. Processing of personal data on the basis of your consent 5.1.4.1. The Company processes your personal data in principle in cases where this is required by law, where the processing of data is necessary for the performance of a contract or where it takes place on the basis of the Company’s legitimate interest. Only exceptionally do we process personal data on the basis of your consent, in accordance with the purpose and for the period stated in that consent.

6. Third parties to which we transfer personal data

6.1. In fulfilling its commitments and contractual obligations, the Company uses the professional and specialised services of other entities. If these suppliers process personal data transferred by the Company, they have the status of processors of personal data and process personal data only within the instructions of the Company and may not use it otherwise. 6.2. These are in particular:

• cooperating Specialists who help you detect a potentially excessive expense, a possible risk associated with a missing product or service, or an opportunity to obtain an additional reward, and propose further steps;
• Partners whose Partner offers may be displayed to users in the Application in the form of an opportunity, a banner, notifications or SMS.
• providers of the user interface for the purpose of automatically connecting your bank account to the Application (CRIF and Finbricks s.r.o., or Komerční banka, a.s., see the General Terms and Conditions);
• cooperating attorneys;
• external providers of accounting and tax services;
• external providers of services for the administration of IT systems, computer networks and hardware.

6.3. We have concluded personal data processing agreements with the processors of personal data referred to in the preceding paragraph, which guarantee at least the same level of protection of your personal data as the protection provided by the Company as the controller in accordance with this Privacy Policy. 6.4. In fulfilling its legal obligations, the Company transfers your personal data to administrative authorities and public offices. 6.5. If you decide to contact a Final Provider and conclude a contract with it, that contract will be transferred to the Final Provider. 6.6. If you are an invited user within the meaning of Article 11 of the Terms and Conditions, the person who sent you the invitation to install the Application will be provided with information on the completion of your registration in the Application and the connection of your bank account / bank accounts. However, that person will only be informed that the above steps have been taken, not of the numbers of the connected accounts or other detailed information. 6.7. If you use a Partner offer and are redirected to the Partner’s website/digital process, the Company may transfer a technical identifier (e.g. a referral ID) to the Partner and the Partner may transfer the conversion status (e.g. ordered, activated, cancelled, withdrawn) to the Company, to the extent necessary for:

• measuring the success of the cooperation,
• crediting the Reward to the Patron Wallet,
• customer support related to resolving the opportunity,
• preventing fraud and misuse of rewards.
  The Company and the Partner transfer to each other only the necessary data. The detailed scope and security of the transfer are governed by a contract between the Company and the Partner.

7. Security of personal data

7.1. The Company has implemented and maintains the necessary and appropriate technical and organisational measures, internal controls and information security processes in accordance with the best care for users and with regard to their rights, corresponding to the possible risk to data subjects. At the same time, it takes into account the state of technological development with the aim of protecting personal data against accidental loss, destruction, alteration, unauthorised disclosure or access. These measures may include, among other things, in particular the adoption of appropriate steps to ensure the accountability of employees who have access to sensitive data and documents, employee training, regular backups, data recovery and incident management procedures, software protection of the devices on which personal data is stored, and others. 7.2. The Company’s staff are bound by a duty of confidentiality regarding all facts concerning you, including after the termination of their employment. A signed confidentiality declaration forms part of the employment contract of each employee of the Company.

8. Your rights in relation to personal data

8.1. If you exercise any of your rights under this Article 8 or under applicable law, we will inform each recipient to whom the data has been disclosed under Article 6 of this Policy of the measure taken or of the erasure of your personal data or the restriction of processing in accordance with your request, provided that such communication is possible and/or does not involve disproportionate effort. 8.2. If you wish to exercise these rights and/or obtain the relevant information, you may contact us by e-mail at support@patrongo.com or in writing at the address of the Company’s registered office. 8.3. When you exercise your rights, we may ask you to provide certain identification information that you have provided to us. Providing such data is necessary to verify whether the relevant request was actually sent by you. We will respond within one month of receiving your request; however, in justified cases we reserve the right to extend this period by two months. 8.4. Right of access to personal data 8.4.1. Under Article 15 of the GDPR, you have the right of access to your personal data, which includes the right to obtain from the Company:

• confirmation as to whether it processes your personal data,
• information on the purposes of the processing, the categories of personal data concerned, the recipients to whom the personal data have been or will be disclosed, the envisaged period of processing, the existence of the right to request from the Company rectification or erasure of personal data relating to your personal data or restriction of their processing, or to object to such processing, the right to lodge a complaint with a supervisory authority, all available information as to the source of the personal data where they are not collected from the data subject, the fact that automated decision-making, including profiling, takes place, and the appropriate safeguards for the transfer of data outside the EU, and, provided that the rights and freedoms of others are not adversely affected, also a copy of the personal data.

8.4.2. In the case of a repeated request, the Company will be entitled to charge a reasonable fee for a copy of the personal data. 8.5. Right to rectification of inaccurate data 8.5.1. Under Article 16 of the GDPR, you have the right to rectification of inaccurate personal data that the Company processes about you. The User is also obliged to notify changes to their personal data and to prove that such a change has occurred. At the same time, the User is obliged to cooperate with the Company if it is found that the personal data it processes about the User are not accurate. We will make the rectification without undue delay, but always with regard to the technical possibilities available. 8.6. Right to erasure of personal data 8.6.1. Under Article 17 of the GDPR, you have the right to erasure of personal data concerning you, unless the Company demonstrates legitimate grounds for the processing of such personal data. The Company has mechanisms in place to ensure the automatic anonymisation or erasure of personal data where they are no longer needed for the purpose for which they were processed. 8.7. Right to restriction of processing 8.7.1. Under Article 18 of the GDPR, the data subject has the right to restriction of processing until the matter is resolved if they contest the accuracy of the personal data or the grounds for their processing, or if they object to their processing. 8.8. Right to data portability 8.8.1. Under Article 20 of the GDPR, you have the right to the portability of data concerning you that you have provided to us as the controller, in a structured, commonly used and machine-readable format. You also have the right to ask us to transfer such data to another controller. 8.8.2. If the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be granted. 8.9. Right to object to the processing of personal data 8.9.1. Under Article 21 of the GDPR, you have the right to object to the processing of your personal data by the Company. 8.9.2. Unless the Company demonstrates compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, the Company will cease the processing on the basis of the objection without undue delay. 8.10. Right to withdraw consent to the processing of personal data 8.10.1. If you give the Company consent to the processing of personal data, you may withdraw it at any time. The withdrawal must be made by an express, intelligible and specific expression of will, either in writing to the address of the Company’s registered office or via the e-mail address support@patrongo.com. 8.11. Right to lodge a complaint with the data protection authority 8.11.1. You have the right to lodge a complaint regarding our processing of your personal data with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7. The Office’s website: https://www.uoou.cz/.

9. Updates to the privacy policy

9.1. Please note that we may amend or update this Privacy Policy. Any changes to this Policy will become effective upon their publication on the Company’s website.

10. Cookies

On the website we use cookies that are necessary for it to work and to store your choice (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications). We use analytics and marketing cookies (Google Analytics and Google Ads, Meta Pixel, Sklik and LinkedIn Insight Tag) only with your consent (Art. 6(1)(a) GDPR) to measure traffic and advertising, for at most 2 years. Data may reach providers in the USA under the EU-US Data Privacy Framework. You can withdraw your consent at any time via “Cookie settings” in the website footer.