Privacy Policy

The data controller is RP&OP a.s., a company with company ID (IČO) 19347600, registered office at Vratislavská 396/6, 181 00 Praha 8 – Bohnice, operator of the rpop.cz platform (the "Controller").

For any matter relating to the processing of personal data you can contact us at info@rpop.cz or +420 608 527 563.

Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on personal data processing.

Account data — on registration and sign-in we process your name, email, phone and login credentials (the password is stored only as a secure hash) to let you manage your account, orders and favourites.

Orders and invoicing — for orders we process the buyer's billing and identification data (name or company name, address, company/VAT ID) to conclude and perform the contract and issue accounting documents.

AML identification — for company transfers we process client identification data (name, date of birth, national ID number, identity document, beneficial owner details) under a legal obligation set by Act No. 253/2008 Coll. (the AML Act).

Selling a company — if you offer a company for sale through the form, we process your contact details and details of the offered company to assess and broker the sale.

Inquiries and contact — name, email, phone and message content from inquiry and contact forms to reply to and handle your request.

Server logs — technical data (IP address, browser type, access time) processed automatically to keep the platform secure and operational.

Performance of a contract (Art. 6(1)(b) GDPR) — running your account, handling orders and providing the service.

Compliance with a legal obligation (Art. 6(1)(c) GDPR) — bookkeeping under Act No. 563/1991 Coll. and client identification under the AML Act.

Legitimate interest (Art. 6(1)(f) GDPR) — securing the platform, preventing abuse, and handling inquiries that have not yet led to a contract.

Consent (Art. 6(1)(a) GDPR) — only where explicitly requested; you may withdraw consent at any time.

We disclose your data only to processors that help us run the platform, always under a data processing agreement:

Forpsi (INTERNET CZ, a.s.) — server and database hosting in the Czech Republic.

Microsoft 365 (Microsoft Ireland Operations Ltd.) — corporate email mailbox.

Forpsi SMTP — sending transactional emails (confirmations, password resets, notifications).

Google (Google Ireland Ltd.) — only if you choose to sign in with your Google account.

Mapy.cz / Seznam.cz, a.s. — address suggestions in forms.

We do not use Stripe or any other payment processor — payments are made by bank transfer. Data may be disclosed to public authorities where required by law.

We process data within the EU/EEA. The exception is Google and Microsoft, where transfers to third countries may occur; such transfers are covered by the European Commission's Standard Contractual Clauses or other appropriate safeguards under GDPR.

Accounting and tax documents — 10 years under the Accounting Act and the VAT Act.

AML identification data — 10 years from the transaction under the AML Act.

Account data — for the lifetime of the account; after deletion we erase it without undue delay unless another legal obligation applies.

Inquiries and contact messages — for the time needed to handle them and a reasonable period afterwards.

You have the right to access, rectify or erase your data, to restrict processing, to data portability and to object. Where consent was given, you may withdraw it at any time.

You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

We do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

The platform uses only strictly necessary cookies; we use no analytics or marketing cookies and therefore show no cookie banner. See the Cookie Policy (/cookies) for details.