Privacy Policy

As a user of PaYard services and a data subject under GDPR (and Czech data protection law), you have certain rights regarding your personal data. We are committed to respecting your rights and have processes in place for you to exercise them. These rights include:

• Right of Access: You have the right to obtain confirmation from us as to whether or not we are processing personal data about you, and if so, to request a copy of that personal data, along with information about how we process it. This is commonly known as a “data subject access request.” Upon request, we will provide you with a summary of the personal data we have about you, the purposes of processing, the categories of data, the recipients to whom the data has been disclosed, and other required information (unless an exception applies). The first copy of your data will be provided free of charge, but we may charge a reasonable fee for additional copies or repetitive requests, as permitted by law.

• Right to Rectification: If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. We encourage you to keep your account information up-to-date. For example, you can correct basic profile details by logging into your account. For changes that you cannot make yourself (such as correcting KYC information), you can contact us with proof of the correct data, and we will make the correction if appropriate. We may need to verify the accuracy of the new data you provide before updating our records.

• Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data in certain circumstances, for example if the data is no longer necessary for the purposes it was collected, you withdraw consent (for data that was processed based on consent and we have no other legal ground), or you object to processing and we have no overriding legitimate grounds to continue. We will assess such requests on a case-by-case basis. Please note that this right is not absolute – sometimes we must retain certain data despite a deletion request, due to legal obligations or other exemptions. For instance, we cannot delete data that we are required to keep under AML laws or other regulations immediately upon request, even if you close your account, because we must comply with mandatory retention periods. Likewise, if you request erasure, we might retain minimal information to record that you asked for deletion or to prevent further contact (e.g., maintaining your email in a suppression list). If we must deny a deletion request, we will explain our reasoning (unless we are legally prevented from doing so).

• Right to Restrict Processing: In certain situations, you have the right to request that we limit the processing of your data (basically to store it but not use it). You can exercise this right if: (a) you contest the accuracy of the data (for a period allowing us to verify it); (b) the processing is unlawful and you oppose erasure and prefer restriction instead; (c) we no longer need the data but you need it for the establishment, exercise or defense of legal claims; or (d) you have objected to processing (see below) and we are verifying whether our legitimate grounds override yours. When processing is restricted, we will flag the data and only process it for specific reasons (like with your consent, for legal claims, to protect others’ rights, or important public interest) as per GDPR. We will inform you before lifting any restriction.

• Right to Data Portability: For personal data that you have provided to us and that we process by automated means on the legal basis of your consent or for performance of a contract, you have the right to receive that data from us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller (or have us transfer it, where technically feasible) directly. This right enables you to take your data to other services easily. It applies to things like account data you provided in signup, or perhaps transaction data you initiated, if processed automatically. We will provide the data in a reasonable format (likely CSV or JSON files) that should be interoperable with other services. Note that this right does not apply to data we generate internally (like risk scores) or data collected on a legal obligation basis, and it should not adversely affect others’ rights.

• Right to Object: You have the right to object, on grounds relating to your particular situation, to any processing of your personal data that we conduct based on legitimate interests (Art. 6(1)(f) GDPR). If you lodge an objection, we must stop processing the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless we need to continue processing for the establishment, exercise, or defense of legal claims. In practice, this means if you object to something like our use of your data for analytics or security monitoring under legitimate interest, we will consider your objection and either cease the contested processing or provide a justification as to why our need to process outweighs your privacy concern. In any event, if your objection is to direct marketing, we will honor it absolutely – you can object at any time to processing of your personal data for direct marketing (including any profiling related to marketing) and we will stop using your data for that purpose immediately. (E.g., if you receive marketing emails and object or unsubscribe, we will cease marketing to you.)

• Right to Withdraw Consent: Where we rely on your consent to process personal data (for example, for sending promotional emails or for using certain cookies), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that took place before the withdrawal. If you withdraw consent, we will stop the processing that was based on consent. For instance, if you withdraw consent to marketing, we will remove you from our marketing list. To withdraw consent, you can use the specific method provided (such as clicking “unsubscribe” in an email, or toggling off a cookie in our preference center) or contact us directly. There is no penalty for withdrawing consent; however, note that if consent was necessary to provide a service (e.g., if we required consent to process certain optional data), we might not be able to continue that aspect of service after withdrawal.

• Right not to be Subject to Automated Decisions: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is (i) necessary for entering into or performing a contract between you and us, (ii) authorized by law, or (iii) based on your explicit consent. In clear terms, this means if we ever were to make a completely automated decision about you with a substantial impact (for example, an automated refusal of service or an automated risk scoring that blocks your account without human intervention), you would have the right to request human intervention, to express your point of view, and to contest the decision. Currently, PaYard does not make any such purely automated decisions without human review that would have profound effects on individuals. Certain processes may be automated (like initial fraud detection flags), but final decisions involving denial of service or reporting to authorities involve human evaluation for fairness and accuracy. If you believe you have been subject to an unfair automated decision, please contact us to review the matter.

To exercise any of your rights, you can contact us at support@payard.cz with your specific request. To protect your privacy, we may need to verify your identity before fulfilling your request (for example, by asking you to write to us from the email associated with your account, or by providing information that matches our records). This is to ensure we don’t disclose data to someone impersonating you. We will respond to your request as soon as possible and at the latest within one month, as required by GDPR. If your request is complex or we have received many requests, we may extend the response time by up to two further months, but we will inform you of the extension and the reasons for it.

We will notify you of the actions we take on your request, or if we cannot comply, we will explain the reason (e.g., certain data cannot be erased due to legal obligations). In some cases, we may refuse requests that are manifestly unfounded or excessive (for instance, repetitive requests), in which case we will justify our decision or charge a reasonable fee as allowed by law.

Importantly, you also have the right to lodge a complaint with a supervisory data protection authority if you believe that we have infringed your data protection rights (see below for details on the Czech authority). However, we kindly ask that you contact us first so we can try to resolve your concern directly – we take privacy matters seriously and will do our best to address any issues.