Privacy Policy

Effective from 1 January 2025 · TapTime · GDPR (EU) 2016/679

1. Data Controller

The controller is the operator of the TapTime platform. Contact via the contact form. Processing is carried out in accordance with GDPR Regulation (EU) 2016/679 and Act No. 110/2019 Coll.

2. Data We Collect

Provided by you

Name and email
Date of birth
Profile photo
Location (with consent)
Messages and event content

Automatically

IP address
Browser type
Pages visited
Date and time of access
Cookies
Push notification device tokens

Payment

Card numbers are not stored
Transaction date
Amount and service type
Billing name

Payments are processed by a certified payment gateway (PCI DSS). TapTime only retains transaction records for accounting purposes.

3. Purpose and Legal Basis of Processing

Purpose	Legal basis
Service operation	Contract performance
Payment processing (boost, banners)	Contract performance
Accounting and tax records	Legal obligation
Transactional email delivery	Contract performance
Push notifications	Consent
Security and fraud prevention	Legitimate interest
Analytics and improvement	Legitimate interest
Marketing communications	Consent
Google Ads — personalised advertising	Consent

4. Data Sharing with Third Parties

We do not sell data to third parties. We share it only with:

Payment gateway Payment processing for paid features. PCI DSS certified.

Hosting / email Technical operational services under a data processing agreement (Art. 28 GDPR).

Google LLC Google Sign-In, Analytics, Ads — per Google's privacy policy. Data may be processed outside the EEA (EU Standard Contractual Clauses).

Public authorities Only where required by law or court order.

5. Data Retention

User account and data Active account + 2 years after deletion

Messages Deleted with account deletion

Transaction records 10 years (Accounting Act)

Push notification tokens Until consent is withdrawn

Access logs 90 days

Consent records Validity of consent + 3 years

6. Your Rights (GDPR)

Access

Copy of your personal data

Rectification

Correct inaccurate data

Erasure

Delete data (except legal obligations)

Restriction

Limit the way data is processed

Portability

Export data in machine-readable format

Objection

Object to processing based on legitimate interest

Withdrawal of consent

Withdraw consent at any time without affecting prior lawful processing

Submit a request via the contact form. We will respond within 30 days. Complaints: Office for Personal Data Protection (uoou.cz).

7. Automated Decision-Making

TapTime does not use automated decision-making or profiling that would produce legal effects or similarly significantly affect you (Art. 22 GDPR).