Privacy and cookie policy

1Who is responsible for your data

The controller is Tekovate s.r.o., IČO 22505075, Matrosovova 667/27, 709 00 Ostrava, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ostrava, section C, file 98485.

For clients and staff in Vietnam, Công ty TNHH Một Thành Viên Appointra Việt Nam (tax code 0319555077, 18Bis/18 Nguyễn Thị Minh Khai, Sài Gòn Ward, Ho Chi Minh City, Vietnam) is the controller of the contracts, quotations and employment records it signs itself. Tekovate runs Teko Center for Appointra Việt Nam as its processor under an agreement between the two companies.

Our person responsible for data protection can be reached at security@tekovate.cz. You can also send privacy questions and requests to legal@tekovate.cz.

2What this policy covers

It does not cover tekovate.cz or the products Appointra, Firate, TekoCore and TekoPoint, which have their own policies.

3What we collect, person by person

Visitors of public pages. Your browser sends your IP address, browser type (user agent) and the page address. Cloudflare, our hosting provider, processes them to deliver the page and stop attacks. We do not keep your IP in our database, except in a rate-limit counter that is deleted within one hour. We count how often a partner's referral link, a partner document or a co-marketing link is opened (at most one count per address per hour); we keep the number, not who opened it. We use no advertising pixel. Only on the EET 2.0 guide (tekocenter.site/eet), and only after you click Agree in its cookie notice, we measure how the page is used (see "EET 2.0 guide" below and Cookies).

Clients who open a link we sent (/tl, /bg, /hd). We record that the link was opened, how many times and when it was last opened, and notify the Tekovate person who sent it. We do not store your IP for this. Link previews and bots are not counted. We keep the comments and questions you write, with the name you give.

Signing a quotation (/bg). Your name, position, email, company, the signature you draw (optional), the time, the quotation version and a SHA-256 fingerprint of its content. As proof of who signed: your IP address, browser (user agent) and the country Cloudflare derives from the IP.

Signing a contract (/hd). The client details you fill in (company, registration number, VAT ID, address, representative, position, email, phone), your comments, your signature (drawn online or an uploaded scan) and the same proof data as above. When you type a registration number, the page looks it up in public registers (ARES, EU VIES, the Vietnamese tax register) to fill in the company details.

EET 2.0 guide (/eet). Your answers to the four questions (type of business, legal form, how you take payments, number of shops or yearly income band), and the email you leave to see and receive the result. If you ask for a call back: business name, your name, phone, email and when to call. A separate, unticked box lets you agree to marketing emails; we record that choice with the time and the wording of the box. This becomes a lead in Teko Center. Measurement, only if you agree in the cookie notice: under a random ID (we do not store it with your email or name, but combined with time and answers it could point to you, so we treat it as personal data) we record which parts of the page you see, your answers to the four questions, whether you ticked the marketing box, which videos you open, whether you download the PDF or ask for a call, how long you look at the page and how far you scroll, the site or campaign you came from, device type, page language, and the country and city that Cloudflare derives from your IP address (we do not store the IP). We keep it for 13 months. You can change your choice at any time with Cookie settings at the bottom of the page.

Referral form (/refer) and the contact form on /deck. Business name, registration number (optional), your name, phone, email, city, language, what you need, and your confirmation that Tekovate may contact you. This becomes a lead in Teko Center; the partner who referred you sees its status.

Partners, their staff and suppliers (portal). Account data (name, email, phone, role, company, registration and tax IDs, address, website, logo, language); your password only as a salted PBKDF2-SHA256 hash; sign-in sessions with IP and browser; a short fingerprint of a new device (browser family plus the first part of the IP, hashed) to warn you about unknown sign-ins; acceptance of the partner or supplier terms (version, time, IP, browser); clients you refer and their status; quotes, orders, tasks, messages and files you exchange with us; payout and bank details; learning progress; emails we send you.

Clients and prospects in our sales records. Company and contact details we get from you, from a partner who referred you, from public registers (ARES, the Slovak register, GLEIF, EU VIES, the Vietnamese tax register) or from your public website; notes from calls and meetings; call recordings and their summaries if the call ran through CloudTalk; quotations, contracts, invoices and payments.

Tekovate staff and contractors. See Part B.

We do not ask for special categories of data (health, beliefs, biometrics). Please do not put them in comments or forms.

4Why we use it and on what legal basis

The legal bases come from Article 6(1) GDPR: (a) consent, (b) contract or steps before a contract that you asked for, (c) a legal obligation, (f) our legitimate interest, which we weigh against your rights.

AI. Some features send text to AI models: summaries of call notes, a first draft of a quotation, reading a bank statement, a first sorting of new leads, answers to staff questions about our own data. A person reviews the result. No decision with legal or similarly significant effect on you is made by AI alone. The providers are listed under "Who else handles your data".

5How long we keep it

When a period ends we delete the data or make it anonymous. We keep it longer only when the law requires it or for an ongoing legal claim.

6Who else handles your data

We do not sell personal data. These providers process it for us under a data processing agreement. Where data leaves the EU/EEA, see the next section.

We also give data to authorities when the law requires it (tax office, social security, courts), and between Tekovate s.r.o. and Appointra Việt Nam where a Vietnamese client or employee is involved.

7Transfers outside the EU

Some providers are in the USA or other countries. We transfer data only on one of these bases: an EU adequacy decision (including the EU-US Data Privacy Framework for certified companies such as Cloudflare and Google), or the EU standard contractual clauses (Commission Decision 2021/914) with extra safeguards where needed.

Data shared with Appointra Việt Nam goes to Vietnam under the standard contractual clauses.

For AI we use only Anthropic models (USA) and Cloudflare Workers AI. We do not send personal data to AI models hosted in China or other countries without a valid transfer basis; if the allowed models are unavailable, the feature stops and shows an error instead of switching to another provider.

You can ask for a copy of the safeguards at legal@tekovate.cz.

8Your rights

You may ask us to:

• see the data we have about you and get a copy (Art. 15);
• correct wrong or incomplete data (Art. 16);
• delete data we no longer need or have no basis to keep (Art. 17);
• restrict processing while we check a complaint (Art. 18);
• receive data you gave us in a common machine-readable format (Art. 20);
• object to processing based on legitimate interest, including direct marketing, which we then stop (Art. 21);
• withdraw consent at any time, without affecting what we did before.

Write to legal@tekovate.cz from the email we know, or tell us how to verify you. We answer within one month; for complex requests we may extend this by two months and tell you why.

You can complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz, or to the authority in the EU country where you live or work. In Vietnam, data protection is supervised by the Ministry of Public Security under the Personal Data Protection Law.

9How we protect it

• Everything travels over HTTPS; the internal system is reachable only after sign-in with a company account.
• Each role sees only what it needs (for example, payroll only for HR and finance); every change is written to an audit log.
• Partner passwords are stored only as salted hashes; repeated wrong passwords lock the account for 30 minutes.
• Public links use long random codes, can expire and can be revoked; pages are not indexed by search engines.
• The database and files are kept in the EU.

If a breach puts your rights at risk, we tell the supervisory authority within 72 hours and tell you without undue delay.

10Cookies and browser storage

We use what is strictly necessary for the site to work or what you set yourself; under Section 89(3) of Czech Act No. 127/2005 Coll. and Article 5(3) of the ePrivacy Directive this needs no consent. The one exception is measurement on the EET 2.0 guide (tekocenter.site/eet): it starts only after you click Agree in the cookie notice on that page, the Decline button is just as prominent, and you can change your choice at any time with Cookie settings at the bottom of the page. We use no advertising cookies.

Browser storage stays on your device and is not sent to us. You can delete it in your browser settings; the site still works, it only forgets your choices.

Fonts are served from our own servers. Our pages do not load fonts, scripts or images from Google or other third parties, so your browser does not connect to them when you open a page.

11Changes to this policy

When we change this policy we publish the new version here with a new date. If the change matters for you (a new purpose, a new kind of provider, a move outside the EU), we tell partners and staff in the portal or by email before it applies. Earlier versions are available on request.

12Notice for Tekovate staff and contractors

This part applies to employees, people on agreements (DPP, DPČ), contractors, interns and candidates of Tekovate s.r.o. and Appointra Việt Nam. Your employer is the controller of your data.

Employment and payroll. Name, date of birth, personal and tax identification numbers, ID card or passport number, nationality, address, contact details, bank account, salary and benefits, working time, leave, sick leave notices, social and health insurance data, tax deductions and children for tax relief, contracts and their annexes with e-signature proof (IP, browser, time, SHA-256), HR documents and your photo. Legal basis: (b) the employment or service contract and (c) labour, tax and social insurance law. Payslips are generated in Teko Center and delivered through Google Drive, Google Chat or email.

KPIs and onboarding. Goals, results, scores and bonuses; the onboarding form and setup tasks. Basis: (b) and (f) managing work fairly.

Work tools. Your company Google account, sign-ins and actions in Teko Center (audit log), tasks, comments and files. Basis: (f) running and securing our systems.

Trợ lý Mèo (the Tekovate assistant). The bot reads messages in Google Chat groups it has been added to, and keeps a copy for 90 days in a database in the EU, to record tasks and progress and to answer questions about work. It never reads private chats it is not part of and stays silent in groups with external members. Some partner Slack channels are read the same way. Message text may be sent to the AI providers listed above. Basis: (f) organising work.

What we do not do. No keystroke logging, no screen recording, no location tracking.

Recipients: payroll and tax advisers, banks, the tax office, social and health insurers, Google and Cloudflare as processors. Your rights are the same as in Part A; write to legal@tekovate.cz or to HR.