Privacy Policy
Valid from: 16. října 2026
01. Data controller
The controller of personal data is:
Gosubi s.r.o.
IČO: 29592411
Registered office: Krnovská 45/42, 746 01 Opava
Email: [email protected]
Website: gosubi.com
This Privacy Policy provides information about the processing of personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and related legislation of the Czech Republic.
02. Scope
This policy applies to:
- website visitors,
- customers of the GOSUBI service,
- users of customer accounts,
- individuals making bookings through systems operated by customers,
- business partners,
- people interested in the GOSUBI service (e.g. those who asked for the brochure or for the EET 2.0 notice),
- individuals communicating with the Controller.
03. Categories of data processed
3.1 Data of GOSUBI customers
- first and last name,
- company name, company ID,
- billing details,
- email and phone number,
- subscription and payment history data,
- communication history.
3.2 Data of system users
- login credentials,
- IP address and device identifiers,
- system logs and audit records,
- activity history.
3.3 Data of customers' clients
If a customer uses GOSUBI to run a salon or branch, the following may be processed:
- name, surname, phone, email,
- booking and visit history,
- marketing preferences,
- notes entered by the customer.
This data is processed on the customer's behalf as a processor under Art. 28 GDPR.
3.4 Data of people interested in the service
- e-mail address, possibly the business name and trade,
- when and where you asked for the brochure (web page, trade fair, sales representative),
- for news: when you ticked the box, its exact wording and when you confirmed your consent,
- for the EET 2.0 notice: when and on which page you asked for it, and the exact wording of the consent,
- which e-mails we sent you and when,
- a record of unsubscribing (address and date only).
04. Purposes and legal bases of processing
Art. 6(1)(b)
Performance of a contract
- account registration,
- providing the service,
- customer support,
- sending the brochure you asked for (steps taken at your request before entering into a contract),
- billing and subscription management.
Art. 6(1)(c)
Compliance with a legal obligation
- accounting,
- tax obligations,
- compliance with statutory obligations.
Art. 6(1)(f)
Legitimate interest
- protecting infrastructure,
- fraud prevention,
- network security,
- keeping a list of unsubscribed addresses so we never write to them again,
- system usage statistics.
Art. 6(1)(a)
Consent
- marketing communication,
- sending GOSUBI news, if you confirmed your consent with the link in an e-mail,
- sending a notice once EET 2.0 is available in GOSUBI; you can withdraw this consent at any time by e-mail to the address in section 1,
- analytics cookies,
- marketing cookies.
Consent may be withdrawn at any time.
Data obtained from Google APIs (Google Calendar) is processed solely for the features described in section 16, that is, to determine free slots and to write bookings. The purposes listed above — marketing communication, analytics, marketing cookies and system usage statistics — do not apply to this data.
05. Automated decision-making
No automated profiling
The Controller does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR that would produce legal or similarly significant effects.
06. Data retention period
| Data category | Retention period |
|---|---|
| User account | for the duration of the contract |
| Invoices | 10 years |
| Audit logs | 12 months |
| Security logs | 12 months |
| Marketing consents | until withdrawn |
| People interested in the service (brochure, news) | 12 months from the last contact; with confirmed news until withdrawn |
| People waiting for the EET 2.0 notice | until the notice is sent, at most 12 months |
| Unsubscribed addresses | indefinitely, address and date only |
| Support communication | 3 years |
| Booking data | max. 5 years after account closure |
After these periods, the data is deleted or anonymized.
07. Data recipients
Personal data may be disclosed to:
- IT service providers,
- accounting and tax advisors,
- public authorities,
- cloud service providers.
Data is not sold to third parties.
08. Sub-processors
The Controller mainly uses the following providers:
| Provider | Purpose | Registered office |
|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure | Germany |
| Google Ireland Ltd / Google LLC | Google Analytics, Google Workspace | Ireland / USA |
| OpenAI, LLC | Platform AI features | USA |
| SMS Connector Business | SMS notifications and confirmations | EU |
| Seznam.cz, a.s. | Email communication | Czech Republic |
Data from a Google account is not passed to any of the sub-processors listed above. In particular, it does not enter analytics tools or artificial intelligence features; it remains within the scope described in section 16.
09. International data transfers
Some providers may process data outside the European Union. In such cases, the Controller relies on:
- Standard Contractual Clauses (SCC),
- European Commission adequacy decisions,
- the EU–US Data Privacy Framework.
10. Security measures
The Controller uses appropriate technical and organizational measures:
- HTTPS/TLS encryption of all communication
- Access control and multi-factor authentication for administrators
- Separation of customer data (multi-tenant architecture)
- Regular data backups
- Security incident monitoring and audit logging
11. Data subject rights
The data subject has the right to:
- Right of accessRequest access to the personal data we hold about you.
- Right to rectificationCorrection of inaccurate or incomplete personal data.
- Right to erasureErasure of personal data where the legal conditions are met.
- Right to restriction of processingRestriction of processing in cases stipulated by law.
- Right to data portabilityReceive the data in a machine-readable format.
- Right to objectObject to processing based on legitimate interest.
- Right to withdraw consentWithdraw consent to processing for marketing purposes at any time.
- Right to lodge a complaintLodge a complaint with the Office for Personal Data Protection (uoou.cz).
12. Exercising your rights
Requests can be sent to:
Request contact
Response deadline
The Controller will respond without undue delay, no later than within 30 days.
13. Cookies Policy
Cookies are small text files stored on a user's device when visiting a website.
Necessary cookies
legitimate interestUsed for user login, system security, and the website functioning correctly.
These cookies cannot be declined.
Analytics cookies
user consentTool: Google Analytics
Purpose: measuring traffic, evaluating website performance, and improving services.
Marketing cookies
user consentUsed only when marketing tools are activated.
14. Managing cookies
On first visiting the website, users are shown a cookie banner allowing them to accept all cookies, decline optional cookies, or set preferences.
This choice can be changed at any time.
15. AI features of the platform
Notice regarding AI features
Some system features use artificial intelligence provided by OpenAI. The User acknowledges that:
- inputs may be processed by the AI service provider,
- AI-generated output may contain inaccuracies,
- the user bears responsibility for the use of the output.
The User must not enter special category personal data under Art. 9 GDPR through the AI features without an appropriate legal basis.
16. Google Calendar and data from your Google account
When a staff member connects their Google account, GosuBi works with the events in their primary calendar, and only within the auth/calendar.events scope.
- What we readEvents in the period being checked for availability, so we never offer a slot when the staff member is already busy.
- What we writeThe event for a booking — updated when the booking changes, deleted when it is cancelled.
- What it is never used forCalendar data is not used for advertising, not sold, not shared with third parties and not used to train artificial-intelligence models.
- How longTokens are kept while the connection is active. Disconnecting in the application or revoking access in the Google account deletes them together with the events we fetched.
Use of information received from Google APIs adheres to the following policy, including its Limited Use requirements: Google API Services User Data Policy.
17. Changes to this policy
The Controller is entitled to update this policy.
The current version is always published on the website gosubi.com.