Privacy policy

Valid from 23 October 2026.

1. Who processes the data

The MůjStavebník service is operated, and personal data are controlled, by Michal Barvíř, IČO 10869409, registered office at T. G. Masaryka 956, 517 21 Týniště nad Orlicí, Czech Republic, a natural person doing business under the Trade Licensing Act, entered in the Trade Register (Trade Licensing Office Kostelec nad Orlicí). Data protection contact: barvirmichal@seznam.cz, phone +420 736 439 177, postal address T. G. Masaryka 956, 517 21 Týniště nad Orlicí. We are not required to appoint a data protection officer (we do not process data on a large scale or special categories of data as a core activity).

For data of website visitors, prospects, support users and customers' billing data we are the controller. For data that companies enter into the application (their employees, customers, suppliers, attendance, photos) the respective company is the controller and we are its processor – we process them only on its instructions and for the purpose of providing the service. The terms of this processing (Art. 28 GDPR) are Article 12 of the terms and conditions. If you are an employee or customer of a company that uses MůjStavebník, please exercise your rights primarily with that company; any request we receive will be forwarded to it without undue delay.

2. What data, why and on what legal basis

Purpose	Data	Legal basis (GDPR)	How long
Contact form, demo, support chat	name, company, e-mail, phone, message text	pre-contractual steps and legitimate interest in replying (Art. 6(1)(b) and (f))	3 years from the last communication
Account and provision of the service	name, e-mail, phone, company details, role, login credentials (password only as a secure hash)	performance of a contract (point (b))	for the term of the contract and the export periods under the terms and conditions
Invoicing and accounting	billing details, payments	legal obligation (point (c)) – accounting and VAT laws	10 years from the end of the year in which the document was issued
Security of the service	IP address, device, sign-in and change records (audit trail)	legitimate interest in protecting the service and data (point (f))	at most 2 years
Error reports	technical description of the error, screen, app version (e-mails and numbers are removed automatically)	legitimate interest in the service working properly (point (f))	30 days after resolution, unresolved at most 180 days
Phone notifications	device identifier for notifications	performance of a contract (point (b))	until the device signs out or notifications are turned off
Establishing and defending legal claims	data from the contract and communication	legitimate interest (point (f))	for the limitation periods

Providing data for the account and invoicing is a contractual and statutory requirement – without them the service cannot be provided. You provide data in the contact form and chat voluntarily. We do not obtain data of companies' employees and customers directly from them but from the company that entered them into the application (Art. 14 GDPR). We do not carry out automated decision-making or profiling with legal or similarly significant effects.

3. Location during attendance

The app stores the phone's location only at the moment a worker records arrival or departure, together with accuracy, time and device. We do not track location continuously or determine it in the background. The employer as controller decides on the use of location for attendance and on informing employees; the employee can see their location for each record.

4. Who we share data with

We do not sell data or share it for marketing. We use only necessary processors bound by a data processing agreement and confidentiality:

server provider – operation of the service and backups on servers in the European Union,
e-mail delivery – system e-mails (verification, invoices, notifications),
Apple and Google – delivery of notifications to iPhone and Android; only the device identifier and a short notification text are transferred,
artificial intelligence model provider (Anthropic PBC, USA) – only when a company uses the interior design assistant; the request text and design dimensions are transferred, not personal data of employees or customers; the provider does not use these data to train models,
payment gateway and bank – only if a company pays by card or connects its own bank account,
OpenStreetMap map tiles – maps in the app; the browser's IP address is sent to their servers,
public registers (ARES) – after an ID number (IČO) is entered we load public company data.

The website and app fonts are loaded from our own server. Public authorities may also obtain data where the law so provides.

5. Transfers outside the European Union

Some processors (Apple, Google, Anthropic) are based in or have servers in the USA. Transfers take place on the basis of the European Commission's adequacy decision (EU–US Data Privacy Framework) for processors certified under it, otherwise on the basis of standard contractual clauses approved by the European Commission (Art. 46 GDPR). We will send you a copy of the safeguards on request.

6. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing and data portability. You may object at any time to processing based on legitimate interest. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it. Just write to barvirmichal@seznam.cz; we will reply without undue delay and within one month at the latest, verifying that the request comes from you. Exercising your rights is free of charge.

Deleting your account. You can delete your MůjStavebník account yourself in the app: My account → Delete account → confirm with your password. An employee's or site manager's account and their sign-ins on all devices are deleted immediately; work and attendance records remain with the company, which must keep them as the employer. For a company owner, a request to cancel the account and the whole company is created; support completes it within 30 days and confirms by e-mail. Documents that the law requires to be archived (invoices) are kept for the statutory period. Without the app, simply write from the e-mail address the account is registered to, to the address given in section 1.

If you believe we process data in breach of the rules, you can lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Data Protection Office), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the authority in your country of residence.

7. Security

Traffic runs exclusively over HTTPS, each company's data is separated, we back up daily, administrator access is protected by two-factor authentication and important changes are recorded in the audit trail. A security breach that could put your rights at risk will be reported to the authority within 72 hours and the persons concerned will be informed. More on the Security page.

8. Cookies

We only use strictly necessary cookies and browser storage – details on the Cookies page.

9. Changes to this information

We update this information when processing or regulations change; the current version is always on this page and we inform customers of significant changes by e-mail or in the app.