Privacy Policy

This policy explains how the Vouchermat service (vouchermat.com) processes personal data under Regulation (EU) 2016/679 (GDPR).

1. Who processes the data

The controller of personal data is Dominik Korčák, Company ID (IČO) 09101209, with registered office at Bieblova 158/10, 613 00 Brno, Czech Republic (the “operator”). Contact for data protection: app@vouchermat.com.

2. What data we process and why

For each processing activity, we state its purpose and legal basis under Article 6(1) GDPR:

• performance of a contract (point b) – we need the data to provide you with the service or to handle what you have asked for,
• legal obligation (point c) – the processing is required by law, e.g. keeping invoices,
• legitimate interest (point f) – we have a reasonable reason for it (security, support, information for customers) and it does not unduly intrude on your privacy; you can object to it,
• consent (point a) – processing only with your explicit consent, which you can withdraw at any time.

• User account – name, e-mail, password (stored only as a hash), business name, and the billing and bank details you fill in. Purpose: providing the service. Legal basis: performance of a contract.
• Plan payments – payment and invoice data; for bank transfers, the bank’s e-mail notifications of received payments (amount, variable symbol, counter-account), which we use to match payments automatically. Payment card details are processed only by the Stripe payment gateway – we never see them. Purpose: payments for the service and bookkeeping. Legal basis: performance of a contract and legal obligation.
• Vouchermat news – the account user’s e-mail. As our customer, you receive occasional news about the service. Legal basis: legitimate interest (sending information to our own customers under Section 7(3) of Czech Act No. 480/2004 Coll.). This also includes automatic e-mails based on how you use the service (e.g. help with finishing your setup or tips after your first sale); for these e-mails we record that they were sent and whether a link was clicked. You can opt out when registering and at any time later via the “Unsubscribe” link in every e-mail.
• Communication and support – copies of e-mails the service sends you (e.g. payment confirmations, payment requests), the date of your last login to the admin and the mobile app, and internal notes from our communication with you. Purpose: customer support and tracing message delivery. Legal basis: legitimate interest.
• Enquiries and the quiz – the e-mail, phone, name and answers you submit. Purpose: replying to your enquiry and offering the service. Legal basis: performance of a contract (handling your enquiry) and legitimate interest (offering a service you have shown interest in). If you tick “I want to receive news” in the form, we also send you news and tips by e-mail – legal basis: consent; you can withdraw your consent via the “Unsubscribe” link in every e-mail.
• Website operation and security – IP address, browser data, login records, form protection (Google reCAPTCHA). Purpose: security and protection against abuse. Legal basis: legitimate interest.
• Analytics and marketing – only with your consent from the cookie banner (legal basis: consent), see section 5.

3. Data of your businesses’ customers

We process the data of people who order a voucher from you (name, e-mail, phone, delivery address, dedication) as a processor on your behalf – you, as the seller of the vouchers, are the controller. We process this data only to handle orders and vouchers in Vouchermat; we do not use it for our own marketing and do not pass it on, except to the providers listed in section 4.

If you turn on payment matching, we also process your bank’s e-mail notifications of received payments (amount, variable symbol, counter-account, payer name), solely to match them with orders. If your customers pay by card, the payment is processed by Stripe on your own Stripe account. We delete your customers’ data when the project or account is deleted.

4. Who we share data with

• our hosting and e-mail provider (servers in the EU),
• Stripe (card payments for plans; your customers’ card payments go through your own Stripe account),
• Google (reCAPTCHA and, with consent, Google Analytics and Google Ads),
• Meta Platforms (Meta Pixel, with consent),
• Seznam.cz / Mapy.cz (address suggestions in the order form).

Some of them may process data outside the EU (USA); such transfers are governed by standard contractual clauses or the EU–US Data Privacy Framework.

5. Cookies

• Necessary – login, form security, storing your cookie choice. The website does not work without them; they do not require consent.
• Analytics – Google Analytics 4 (via Google Tag Manager): anonymous statistics on traffic and how the website is used. Only with consent.
• Marketing – Meta Pixel and Google Ads: ad measurement and targeting. Only with consent.

You can change or withdraw your consent at any time in the cookie settings. We remember your choice for 6 months.

6. How long we keep data

Account and project data for as long as the account exists; accounting documents (plan invoices) for 10 years as required by law; copies of sent e-mails and login records for as long as the account exists; enquiries for no more than 2 years; analytics data for 14 months.

When you request deletion of your account, we delete the account and all project data (orders, vouchers, services, uploaded files) within 30 days of the request. We keep only the invoices for the Plus plan with billing details, which we are legally required to keep for 10 years. The same applies if we cancel the account (e.g. for long-term inactivity under the terms and conditions).

7. Your rights

You have the right to access your data, to have it corrected and erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent. Write to us at app@vouchermat.com.

You can request account deletion yourself in the admin under Profile → Personal details → Delete account. We delete the account and project data after 30 days; until then you can cancel the request. The Plus subscription stops renewing once the request is made. We will e-mail you about the request and about the deletion.

You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).