Privacy Policy

1. Controller and roles

For website operation, registrations, invoicing and support, the controller is Jitka Hořavová, IČO 88201856, Jiráskova 436/8, 789 85 Mohelnice, Czech Republic, a self-employed natural person trading as Codecron (not a separate legal entity). Contact: support@koragate.tech. For customer-uploaded workspace data, the customer may be controller and KoraGate provider processor; we conclude an Article 28 GDPR agreement at the customer's request (support@koragate.tech).

2. Personal data categories

Account data: name, email, email verification, invitations, communications and securely hashed passwords (never in readable form). Workspace data: names, memberships, roles, projects, tasks, comments, files and client requests, sometimes entered by the customer as controller. Billing: invoicing details, subscriptions and payment identifiers; you enter card data directly with Stripe; we do not see or store it. Technical data: IP addresses, login times, security events, logs and cookie IDs. Optional analytics/advertising data depend on consent.

Contract cancellation requests. When you cancel using the “Cancel contracts here” button, we process the data you enter (name, email, contract designation, optional customer number), the time of receipt and the processing result in order to handle the cancellation and to prove its receipt (Article 6(1)(c) and (f) GDPR). We keep them for 3 years.

3. Purposes, grounds and retention

Accounts and contracts: Article 6(1)(b) GDPR for natural-person customers, and generally Article 6(1)(f) for business contact persons; retained for the life of the account and 30 days after a deletion request is received (longer only as needed to establish or defend legal claims). Invoicing: Article 6(1)(c), according to applicable accounting and tax laws, generally 5 to 10 years. Security and support: Article 6(1)(f), we keep logs and support tickets for up to 12 months. Google Analytics 4, Google Ads and Meta Pixel: Article 6(1)(a) consent where personal data are processed; cookie access is also regulated by Section 89(3) Czech Electronic Communications Act. Retention within those services follows their own settings and terms.

4. Recipients

DigitalOcean: hosting and backups, data centre in Frankfurt am Main, Germany. Resend (Amazon SES infrastructure): transactional emails, invitations and notifications; messages sent to the support address are processed by Resend and forwarded to the operator's mailbox at Seznam.cz. Stripe: payment services and, for certain purposes, independent controller; you enter card data directly with Stripe. Google Ireland and Meta Platforms Ireland: optional analytics and advertising only with relevant consent. Authorities and advisers may receive data where lawful.

Video (YouTube). The home page contains a demo video from YouTube. The player loads only after you click the Play button, from the youtube-nocookie.com domain; until then no data is transmitted to YouTube. After the player starts, the provider (Google group companies) may process your IP address and device data under its own privacy policy, which may include transfers outside the EEA. The processing is based on your active action (clicking play). You can also open the video directly on YouTube.

Protecting forms from bots (Cloudflare). The registration and contact forms are protected by Cloudflare Turnstile. When you open a form, a verification element is loaded from the challenges.cloudflare.com domain and Cloudflare, Inc. may process your IP address, browser and device data and the result of the check in order to tell humans from bots; under its own privacy policy this may include transfers outside the EEA. The processing is based on our legitimate interest in securing the service and protecting it from spam and abuse (Art. 6(1)(f) GDPR). We do not use the check for advertising or for profiling visitors.

5. International transfers

We store data primarily in a data centre in the EU. Some email, payment and advertising providers may transfer data outside the EEA. Each such transfer relies on a Chapter V GDPR mechanism, in particular an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

6. Storage, deletion and backups

After cancellation the account is deactivated and workspace content is deleted on request no later than 30 days after it is received. Encrypted backups are kept for 14 days on the server and up to 30 days off the server, then expire. Legally required records and justified claims material may be retained for longer. Processor data follow customer instructions and the DPA.

7. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction, portability and object to legitimate-interest processing. Consent can be withdrawn at any time without retroactive effect. Contact support@koragate.tech; requests are normally answered within one month, subject to lawful extensions. You may complain to the Czech Data Protection Authority: https://uoou.gov.cz.

8. Cookies

Strictly necessary identifiers support login, security and user-requested features. Optional analytics and advertising only run following valid consent. Details: https://koragate.tech/cookies.

First-party anonymous traffic measurement. To understand how many people use the website, where they come from and which pages are useful, we run our own measurement on our server. It uses no cookies or other storage on your device and does not store your IP address: a daily-changing anonymous fingerprint is created on the server from the IP address, browser and date, from which a person cannot be identified, and the IP address is used only to determine the country. We store the page address without parameters, the referring site domain, device type, browser, operating system, language and country. Bots and requests with Do Not Track or Global Privacy Control are not measured. The legal basis is legitimate interest (Article 6(1)(f) GDPR, operating and improving the service); records are deleted after 400 days and are not shared with third parties. You can object to this processing at support@koragate.tech.

9. Security and automated decisions

We protect data with encrypted transmission (HTTPS), password hashing and logical segregation of workspaces. We make no solely automated decisions with legal or similarly significant effects under GDPR Article 22.

10. Changes

This notice may be updated following changes in purposes, recipients or technology. Material changes will be communicated appropriately and new processing purposes handled according to GDPR. Effective date: 17 October 2026.

Legal basis: Czech Civil Code 89/2012 Sb.; Czech Consumer Protection Act 634/1992 Sb.; GDPR (EU) 2016/679; Czech Electronic Communications Act 127/2005 Sb.

https://eur-lex.europa.eu/eli/reg/2016/679/oj | https://uoou.gov.cz | https://coi.gov.cz

Additional information for EU users

GDPR and supervisory authorities

This English version describes processing under the GDPR in the EU/EEA. The Czech controller can be contacted at support@koragate.tech; data subjects may complain to a competent supervisory authority under GDPR Article 77.

Processor and transfers

Where a workspace customer determines the purposes and means of processing third-party data, the customer is the controller and KoraGate the processor; we conclude an Article 28 GDPR agreement at the customer’s request (support@koragate.tech).