STAGING ENVIRONMENT
MoveConcept logo

Privacy Policy

This is an English translation of the Czech original. If the two versions differ, the Czech version prevails.

MoveConcept, s.r.o. hereby informs users of the MoveConcept platform about the manner and scope of the processing of their personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

1. Controller

MoveConcept, s.r.o.
IČO (Company ID No.): 22645039
Registered office: Korunní 2569/108, Vinohrady, 101 00 Praha 10
Registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 418828
E-mail: support@moveconcept.cz
Data box (datová schránka): ypzkgrb

2. What personal data we process

  • Account data: first name and surname, username, e-mail, phone number, password (in secured form), date of birth, profile text and photos, links to social networks, privacy settings, two-factor authentication data, identifiers for sign-in with Google or Apple.
  • Data on participation in activities: registrations, tickets (participant's name, e-mail, phone number and date of birth), check-in data, Stamina Points earned. We also process this data about unregistered guests whom another user has signed up for an activity.
  • Payment and billing data: transaction amounts and currency, organizers' billing details (name or company name, IČO (Company ID No.), DIČ (VAT No.), address, contact), and for organizers' bank accounts only the bank name and the last four digits of the account number. Payment card data is processed exclusively by Stripe; we have no access to it.
  • Communication: messages in private and group chats on the platform, notifications, messages from the contact form, questions asked to the AI assistant on the contact page.
  • Marketing data: the e-mail address subscribed to the newsletter. Subscription is voluntary, and every e-mail we send contains a link to unsubscribe immediately.
  • Technical data: IP address, browser type, session data, operation logs, cookies (see the Cookie Policy).

3. Purposes and legal bases of processing

  • Maintaining the user account and operating the platform — performance of a contract (Article 6(1)(b) GDPR).
  • Registration for activities, ticket sales and payment processing — performance of a contract; disclosure of the data to the organizer is necessary for the participation to take place.
  • Payouts to organizers and their verification (Stripe Connect) — performance of a contract and compliance with legal obligations (anti-money laundering legislation).
  • Issuing accounting documents and bookkeeping — compliance with legal obligations (Article 6(1)(c) GDPR).
  • Sending the newsletter — consent (Article 6(1)(a) GDPR), which can be withdrawn at any time.
  • Traffic analysis and service improvement — consent to analytics cookies, or legitimate interest in internal analysis of operations (Article 6(1)(f) GDPR).
  • Finding people you know through phone contacts — in the mobile app, a user can, with their consent, have the phone numbers in their contacts matched against the phone numbers in other users' profiles. The app sends to the server only one-way fingerprints (hashes) of the numbers, not the numbers themselves or names, and the server only compares them and does not store them. If your profile contains a phone number, people who have your number in their contacts can find you this way; no one will see your number unless you make it public yourself. You can remove the phone number from your profile at any time, and you will then no longer be findable by it. Users you have blocked or who have blocked you cannot find you this way — legitimate interest in connecting users who know each other (Article 6(1)(f) GDPR).
  • Ensuring security, investigating reports and protecting legal claims — legitimate interest.

4. Who we disclose data to

  • Activity organizers — data of the participants in their activities to the extent necessary for organizing the activity and checking participants in (name, contact, ticket data). The organizer may use it only for the activity in question.
  • Stripe Payments Europe, Ltd. (Ireland) — processing of payments and payouts; Stripe receives the e-mail and payment data of buyers, and the identification data of organizers for identity verification.
  • Mailjet / Sinch — sending the newsletter; we disclose only the e-mail address.
  • Pusher (Pusher Ltd.) — real-time delivery of messages and notifications (data centre in the EU).
  • Google — analytics tools (Google Analytics, Google Tag Manager) and the internal analytics environment Google BigQuery, in which we process the platform's operational data.
  • Google (Gemini API) — the AI assistant on the contact page. The text of the question you type into the assistant is sent to Google for processing so that the assistant can answer it. We recommend that you do not write sensitive data into the chat — answers to ordinary questions about how the platform works do not require any personal data. We use the paid version of the service, under which Google does not use the submitted questions to train its models.
  • Microsoft — the Microsoft Clarity analytics tool (anonymized recordings of behaviour on the website, based on consent).
  • Hosting and IT infrastructure providers and external accounting or legal advisers.

We have concluded data processing agreements with our processors under Article 28 GDPR.

5. Transfers to third countries

Some providers (Google, Microsoft, Stripe) may also process data on servers outside the EU/EEA, in particular in the USA. Such transfers take place exclusively on the basis of an adequacy decision under Article 45 GDPR (the EU–U.S. Data Privacy Framework) or standard contractual clauses under Article 46 GDPR.

6. Retention period

  • Account data and content on the platform — for as long as the account exists; after the account is closed, for the period necessary to protect legal claims.
  • Messages from the contact form — 30 days from submission, after which they are deleted automatically.
  • Questions asked to the AI assistant and its answers — 90 days from submission. We keep them so that we can improve the assistant's answers and add what it is missing. Before storing them, we automatically remove e-mail addresses, phone numbers, payment card numbers, birth numbers (rodné číslo) and account numbers from the text. We do not store your IP address or account identifier with them. After 90 days, the records are deleted automatically.
  • Transaction data and tax documents — for the period set by law (up to 10 years).
  • Newsletter e-mail address — until consent is withdrawn (unsubscription).
  • Technical logs and session records — for a limited period necessary to keep operations secure.

7. Your rights

You have the right of access to your data, the right to rectification or erasure, to restriction of processing, to data portability, the right to object to processing based on legitimate interest and the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise your rights by e-mail at support@moveconcept.cz. We respond to requests within one month at the latest.

8. Children

The platform is intended for persons over 15 years of age. A person under 15 may give consent to the processing of personal data in connection with information society services only with the approval of their legal guardian (Section 7 of Act No. 110/2019 Coll.). We process children's data as a controller only to the extent necessary for participation in an activity for which they were signed up by a legal guardian or another adult.

9. Photos and recordings from activities

Photos and audiovisual recordings documenting the course of activities may be taken at them, and we may use them to promote the platform (website, social networks) on the basis of legitimate interest, or Section 84 et seq. of the Civil Code. You can object to this processing at any time with the organizer or at support@moveconcept.cz and the recording will be removed unless another legitimate ground prevails.

10. Security

We take technical and organizational measures appropriate to the risk of the processing, in particular encrypted communication (HTTPS), storing passwords in secured form, access control and the option of two-factor authentication for the account.

11. Supervisory authority

You have the right to lodge a complaint with the Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

12. Privacy in the McCheck app

The McCheck mobile app (a check-in app for organizers) is operated by MoveConcept, s.r.o., IČO 22645039, with its registered office at Korunní 2569/108, Vinohrady, 101 00 Praha 10 — the same controller of personal data as for the website moveconcept.cz. The processing of data in the McCheck app is governed by this policy in full.

Account deletion. You can delete your account and personal data yourself. In the McCheck app, open Settings → Account → Delete account. On the website, use the page moveconcept.cz/account/delete. You do not need to write to us or call us.

Deleting the account ends the MoveConcept account as a whole, including access to the website. We will remove your name, e-mail, phone number, date of birth, profile photo and your messages. We keep issued accounting and tax documents and transaction records as required by law for the period stated in section 6.

If you organize paid Activities, the rules in Article 8 of the Terms for Organizers also apply: we will cancel upcoming Activities and refund the admission fee to Participants, and if you have funds in your wallet, we will request their payout to your bank account on your behalf.

How long it takes. We will delete the account and personal data once everything is settled. If we refund the admission fee to Participants, the money usually appears on the card within 5 to 10 business days; the exact time depends on the Participant's bank. If we owe you proceeds from an Activity that has already taken place, we pay them out 14 days after it ends. This does not affect your right to erasure under section 7 of this policy.

13. Changes to this policy

We may update this policy; the current version is always available on this page. Last updated: 28 August 2026.