Effective from the date of publication. The Czech version is binding; this English version is a translation.
1. Controller
The controller of personal data is Universal Smart Solutions s.r.o., Company ID 01442023, VAT ID CZ01442023, registered office Drahelčická 166, 252 18 Úhonice, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file C 206764 (“USS”, “we”).
Privacy contact: info@uss.plus, or in writing to our registered office. We have not appointed a Data Protection Officer as we are not required to.
This policy explains how we process personal data under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. It applies to the uss.plus website, to communication with us, to our customers and suppliers, and to our online applications that link to it. Our products AutoOffice and classroom.now have their own privacy policies on their websites.
2. What data, why, and on what legal basis
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form, e-mail, phone | name, e-mail, phone (optional), message | answering your enquiry, preparing an offer | steps prior to a contract at your request (Art. 6(1)(b) GDPR), otherwise our legitimate interest in replying (Art. 6(1)(f)) | 2 years after last contact unless a contract follows |
| Information e-mails (consent box in the form) | name, e-mail | information about our services | consent (Art. 6(1)(a) GDPR; Section 7 of Act No. 480/2004 Coll.) | until consent is withdrawn |
| Customers and suppliers | identification and contact details, contact persons, billing data | concluding and performing the contract | contract (Art. 6(1)(b)) | contract term plus 4 years (limitation period) |
| Accounting and tax | data on accounting documents | legal obligations | legal obligation (Art. 6(1)(c)) | 10 years |
| Marketing to existing customers | offering similar services | legitimate interest (Section 7(3) of Act No. 480/2004 Coll.) | until you object, max. 3 years after last purchase | |
| Website analytics | truncated IP address, browser and device data, pages visited, time | statistics and improving the website | legitimate interest (Art. 6(1)(f)) | max. 25 months |
| Spam protection (Google reCAPTCHA) | IP address, browser data and on-page behaviour | protection against bots and abuse | legitimate interest (Art. 6(1)(f)) | per Google’s terms |
| Network and service security | IP addresses and traffic metadata (no content) | detecting and handling security incidents | legitimate interest (Art. 6(1)(f)) | short-term; longer only where needed for a specific incident |
| Legal claims | data relating to the matter | disputes, enforcement | legitimate interest (Art. 6(1)(f)) | for the proceedings and limitation period |
We do not make automated decisions within the meaning of Art. 22 GDPR and do not profile you.
3. Google Sign-In and USS online applications
If you sign in to one of our applications with your Google account, we receive from Google only the data you approve on Google’s consent screen (typically your name, e-mail address and profile picture), and any further data listed for the specific application. We use it solely to sign you in and to provide the features of the application you chose (Art. 6(1)(b) GDPR).
USS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized AI models. Humans access it only with your consent, for security purposes, or where required by law. You can revoke the application’s access at any time in your Google account settings; we will then delete the data within 30 days unless we are legally required to keep it.
4. Cookies
- Strictly necessary cookies (e.g. remembering your cookie banner choice, form protection) are stored without consent because the website cannot work without them.
- Analytics run on our own self-hosted Matomo instance without cookies and with truncated IP addresses. Data is not shared with Matomo or other companies.
- Google reCAPTCHA protects the contact form; Google may store its own data on your device. Google’s Privacy Policy and Terms apply.
We do not use marketing or advertising cookies. You can delete or block cookies in your browser at any time.
5. Recipients
Data is processed by our employees and contractors bound by confidentiality, and by our processors under Art. 28 GDPR contracts: IT, hosting, e-mail and cloud providers; accounting, tax and legal advisors; Google Ireland Limited (reCAPTCHA, Google Sign-In). We disclose data to public authorities where required by law.
We do not transfer data outside the EU/EEA, except for Google services, where transfer to the USA may occur on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest (and to direct marketing at any time), to withdraw consent at any time (without affecting prior processing), and to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
Send requests to info@uss.plus or to our registered office. We reply without undue delay and within one month at the latest (extendable by two months for complex requests, in which case we will inform you). Requests are free of charge. We may ask you to verify your identity if we have reasonable doubts.
7. Security
We protect data with appropriate technical and organisational measures: encrypted transfer (HTTPS), role-based access control, system updates, backups and security monitoring. We process data mainly on our own infrastructure in the Czech Republic.
8. Changes
We may update this policy. The current version with its effective date is always published on this page; we notify our contractual partners of material changes.