Privacy Policy

This Privacy Policy explains how organization Michal Štefaňák (we, us, our), registered in Czechia with registered address at Zelenecká Lhota 93, 507 23, Czechia, collects, uses, and protects personal data in connection with Helmly (Service). This Policy should be read together with our Terms of Service.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

Michal Štefaňák, registered in Czechia under registration number 19882823, is the provider of the Service. For most of the personal data described in this Policy, we act as the "data controller" - we decide why and how it is processed.

Because the Service lets you store information about your own clients, we act in two different capacities:

• As a controller, for your account data (e.g. your name, email, billing details, and how you use the Service), which we determine the purposes and means of processing for, as described in this Policy.
• As a processor, for the data you input about your own clients (e.g. client names, contact details, project or billing information), which we process only on your instructions, for the purpose of providing the Service to you. In this respect, you are the controller of your clients' personal data, and you are responsible for having a valid legal basis to collect and process it, including notifying your clients as required by applicable law.

Account data: name, email address, password (hashed), and any profile details you provide when registering.

Billing data: billing address and payment details, processed on our behalf by our payment processor, Stripe. We do not store full card details ourselves.

Content you provide: information you enter into the Service about your clients, activities, projects, tasks, and invoices.

Usage data: log data, device and browser information, IP address, pages visited, and actions taken within the Service, collected automatically.

Communications: information you provide when you contact us for support or other inquiries.

We use personal data we control to:

• create and manage your account, and provide the Service to you;
• process payments and manage your subscription;
• communicate with you about your account, changes to the Service, or support requests;
• maintain the security, integrity, and performance of the Service;
• comply with our legal obligations, including tax and accounting requirements;
• send you service-related notices and, where you have opted in, product updates or marketing communications.

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract - to provide the Service and manage your account and subscription.
• Legal obligation - to comply with tax, accounting, and other regulatory requirements.
• Legitimate interests - to secure and improve the Service, prevent fraud and abuse, and communicate essential service information, balanced against your rights and interests.
• Consent - for optional marketing communications and non-essential cookies, which you may withdraw at any time.

We process the personal data you upload about your clients solely to provide the Service to you, and strictly according to your instructions. We do not use this data for our own marketing purposes, and we do not sell it.

You are responsible for ensuring you have a valid legal basis to collect and process your clients' personal data, and for responding to any data protection requests from your clients relating to that data. We will assist you in fulfilling such requests to the extent required by applicable law, using the tools available within the Service or by contacting us directly.

We use cookies and similar technologies that are strictly necessary to operate the Service (e.g. to keep you logged in), and, where you consent, analytics cookies to help us understand how the Service is used.

We share personal data only with third parties who help us operate the Service, under appropriate data processing agreements, including:

• Hosting provider: Websupport.cz, hosted in Czechia.
• Payment processor: Stripe.

We may also disclose personal data where required by law, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets. We do not sell personal data to third parties.

We host data in the EU. Where any of our service providers process data outside the European Economic Area, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

10.1. We retain your account data and uploaded content for as long as your account remains active.

10.2. If you request account deletion, your personal data will be deleted or anonymized within 30 days, except where tax or legal record-keeping obligations require longer retention (up to 10 years for financial records).

10.3. If your subscription is cancelled due to non-payment, your data will be retained for a grace period of 60 days to allow account restoration before permanent deletion.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your personal data, in certain circumstances;
• Restrict or object to certain processing;
• Port your data to another service, in a structured, machine-readable format;
• Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at contact@helmly.eu. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.

We do not use your personal data for any processing that produces legal or similarly significant effects through automated decision-making, including profiling, without human involvement.

The Service is not directed at, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority, or with the supervisory authority in Czechia.

For any questions about this Privacy Policy or our data practices, contact us at:

Michal Štefaňák
Zelenecká Lhota 93, 507 23, Czechia
Email: contact@helmly.eu