Privacy notice

This is an English translation provided for information only. The Czech version of this privacy notice is legally binding; in case of any discrepancy, the Czech version prevails.

1. WHO PROCESSES YOUR PERSONAL DATA

The controller of personal data related to the operation of the Devulti service is:

321 CREATIVE CREW s.r.o.
Gargulákova 513/2
614 00 Brno-Husovice, Czech Republic
Company ID (IČO): 03535657
VAT ID (DIČ): CZ03535657
a company registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 85073
data box: pujrxst

hereinafter the "Controller".

Contact e-mail for questions concerning the protection of personal data:
[email protected]

2. WHO THIS NOTICE APPLIES TO

This notice applies in particular to:

visitors of the devulti.com website,
persons interested in the Devulti service,
customers of the Devulti service,
persons acting on behalf of customers,
users of customer accounts,
persons communicating with technical or customer support.

This notice governs the processing of personal data for which 321 CREATIVE CREW s.r.o. itself determines the purpose and means of processing.

If a customer of the Devulti service stores in the system personal data of its own employees, salespeople, clients, prospects or other persons and determines the purpose of their processing, the customer acts as the controller of these data and 321 CREATIVE CREW s.r.o. generally as their processor.

3. WHAT PERSONAL DATA WE PROCESS

In connection with the operation of Devulti we may process in particular:

Identification data:

first name and surname,
company name,
company ID (IČO),
VAT ID (DIČ),
where applicable, other identification data provided at registration or invoicing.

Contact data:

e-mail address,
telephone number,
billing or contact address.

Data related to the user account:

login identifier,
information about the user's organisation,
user role and permissions,
registration date,
data about the use of the account,
operational records related to the user's activity.

Contractual and payment data:

chosen plan,
length of the subscription,
order history,
billing data,
payment status,
data necessary to match a payment with an order.

Payment card data are not normally stored directly by 321 CREATIVE CREW s.r.o. Payment transactions are handled by the payment service provider Stripe.

Communication data:

content of communication with customer support,
technical requests,
bug reports,
other communication related to the service.

Technical data:

IP address,
information about the web browser and device,
date and time of access,
operational logs,
information about system errors,
security records.

4. WHY WE PROCESS PERSONAL DATA

Registration and provision of the Devulti service:
We process personal data in particular for the purpose of:

creating a user account,
providing the Devulti service,
managing the subscription,
making a particular subdomain available,
administering user permissions,
technical and customer support.

The legal basis is in particular the performance of a contract or taking steps prior to entering into a contract.

Invoicing and compliance with legal obligations:
We process identification and billing data in particular for the purpose of:

issuing invoices,
keeping accounts,
tax records,
compliance with other legal obligations.

The legal basis is compliance with a legal obligation of the Controller.

Payments:
Payments for the Devulti service may be processed through the Stripe payment service.

When processing a payment, Stripe may obtain data necessary to carry it out, for example data about the payment method, identification of the payer, transaction data and technical data related to the payment.

The scope of processing of personal data by Stripe is also governed by its own terms and privacy policy.

Security of the service:
We may process technical information, IP addresses and operational logs in particular for the purpose of:

securing the service,
preventing misuse,
detecting unauthorised access,
handling technical incidents,
protecting the rights of customers and the Operator.

The legal basis is the legitimate interest of the Controller in ensuring a secure and stable operation of the service.

Development of the service:
We may also use aggregated or otherwise appropriately processed operational information for the purpose of:

developing new features,
optimising the user interface,
detecting technical problems,
evaluating the load on the service.

The legal basis is the legitimate interest of the Controller in developing and improving the service.

5. DATA STORED BY CUSTOMERS OF THE DEVULTI SERVICE

Through Devulti, customers may store their own data, for example information related to development projects, real estate, salespeople or other persons.

If these data contain personal data and the purpose of their processing is determined by the customer:

the customer acts as the controller of the personal data

and

321 CREATIVE CREW s.r.o. acts as the processor of the personal data.

321 CREATIVE CREW s.r.o. processes these data only for the purpose of the technical operation of the Devulti service and according to the customer's instructions.

The customer is responsible in particular for:

the existence of a legal basis for processing the data,
fulfilling the information obligation towards data subjects,
the correctness and lawfulness of the data entered,
the scope of the data stored in the system.

Detailed processing terms are also set out in the Devulti General Terms and Conditions.

6. PROCESSORS AND OTHER RECIPIENTS OF PERSONAL DATA

In operating the Devulti service we use other suppliers and providers of technical services.

Hosting and server infrastructure:
Pavel Dostál – XONE.cz
Hradební 81/6
796 01 Prostějov, Czech Republic
Company ID (IČO): 76498042
VAT ID (DIČ): CZ8212133798

The hosting provider provides the technical infrastructure necessary to operate the service and may, to the necessary extent, have access to data stored on the server infrastructure.

Delivery and security of the website:
Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

All traffic of the Devulti website and application passes through the Cloudflare network, which provides its delivery, encryption and protection against attacks. In doing so, Cloudflare processes in particular IP addresses, technical data about requests and security records.

Payment services:
We use Stripe to process payments.

Stripe processes in particular data necessary to carry out payment transactions, prevent fraud, comply with regulatory obligations and provide payment services.

Other recipients:
To the necessary extent, data may also be made available to:

accountants and tax advisers,
providers of technical support,
legal advisers,
public authorities, where required by law.

7. TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of our suppliers may also process personal data outside the European Economic Area, in particular in the United States of America.

For such transfers, appropriate data protection mechanisms under the GDPR are used, in particular:

adequacy decisions of the European Commission,
the EU–US Data Privacy Framework,
standard contractual clauses of the European Commission,
where applicable, other mechanisms permitted by law.

This concerns in particular the services of Cloudflare and Stripe.

8. HOW LONG WE KEEP PERSONAL DATA

We keep personal data only for as long as necessary for the respective purpose.

User account:
We keep the data necessary to operate the user account for the duration of the contractual relationship.

After it ends, some information may be kept for the period necessary to:

protect legal claims,
resolve any disputes,
comply with legal obligations,
ensure the security of the service.

Unconfirmed registration:
If you do not confirm your registration via the link sent to the e-mail address provided, we will delete it together with the data provided within 7 days of its submission.

Billing and accounting data:
Invoices, tax documents and other data required by law are kept for the period prescribed by law.

Customer data:
Data entered by the customer are kept for the duration of active use of the service.

After the service ends, the data may normally be kept for a limited technical period, in particular to allow the deactivation of the account to be completed or because operational backups exist.

Unless agreed otherwise, active customer data may be deleted within approximately 30 days of the end of the service.

Some copies of them may persist for a limited time in technical or security backups until they are automatically overwritten.

9. COOKIES

The Devulti website uses cookies and similar technologies.

Necessary cookies:
Necessary cookies enable in particular:

the proper functioning of the website,
user login,
maintaining the user session,
system security and protection against attacks (including technical cookies of the Cloudflare service).

These cookies may be used without consent if they are strictly necessary for the functioning of the requested service.

Analytics and marketing cookies:
The Devulti website currently does not use analytics or marketing cookies. If we introduce them in the future, they will be activated only after consent has been given, and we will supplement this notice.

10. SECURITY

We use reasonable technical and organisational measures appropriate to the nature of the service and the risk of processing.

These may include in particular:

management of access permissions,
secure data transfers,
user authentication,
software updates,
operational and security logging,
backups,
restricting access to the infrastructure,
separation of customer access.

No internet system, however, can be considered absolutely secure, and the Controller cannot guarantee complete protection against every conceivable kind of cyber attack.

11. RIGHTS OF DATA SUBJECTS

Under the conditions laid down by the GDPR, you have in particular the right:

of access to your personal data,
to their rectification,
to erasure,
to restriction of processing,
to data portability, where the relevant conditions are met,
to object to processing based on legitimate interest,
to withdraw consent given.

Where processing is based on consent, the consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

12. HOW YOU CAN EXERCISE YOUR RIGHTS

You can send your requests concerning the protection of personal data to:
[email protected]

or in writing to:

321 CREATIVE CREW s.r.o.
Gargulákova 513/2
614 00 Brno-Husovice, Czech Republic

If it is necessary to verify the identity of the applicant, we may request reasonable additional information.

13. COMPLAINT WITH THE SUPERVISORY AUTHORITY

If you believe that your personal data are processed in breach of the law, you have the right to lodge a complaint with:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
Pplk. Sochora 27
170 00 Praha 7, Czech Republic

14. AUTOMATED DECISION-MAKING

In its standard operation, Devulti does not use solely automated decision-making that would produce legal effects concerning the user or similarly significantly affect them.

15. CHANGES TO THIS PRIVACY NOTICE

We may reasonably change this notice in particular in response to:

changes of the Devulti service,
engagement of new suppliers,
changes of the technologies used,
changes of the law.

The current version will be published on the Devulti website.

Effective from: 9 September 2026

Text version: 2026-09-09

Čeština · English · Slovenčina