EOS Digital s.r.o. provides and operates in particular:
- the EOS Club® Member Platform – a software service for managing the membership agenda of organisations, available through a web interface and a mobile application (hereinafter the „Tool“ or the „Platform“);
- the EOS Club® Website – a service operating the individual clubs' own online presentation (hereinafter the „Website“);
- the website www.eos.cz and its language version www.eosclub.app – the Company's own online presentation. The processing of personal data is identical for both addresses of the online presentation; where these Policy refer to www.eos.cz, this also means www.eosclub.app.
The Platform and the Website are two separate services which may, but need not, be interlinked.
This Privacy Policy (hereinafter the „Policy“) describes how the Company processes personal data as a controller in connection with the activities set out above. These Policy do not apply, as regards the content of membership data, to processing in which the Company acts as a processor for the User – in particular to the personal data of members processed in the Tool and on the Website; that processing is governed by a separate Personal Data Processing Agreement (Articles 2.1 and 2.3). These Policy fulfil the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Controller of personal data
In relation to the processing described in these Policy (Article 2.2), the controller of personal data is EOS Digital s.r.o., Id. No. 05110645, with its registered office at 17. listopadu 725, 562 01 Ústí nad Orlicí, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Hradec Králové, File No. C 37191 (hereinafter the „Company“ or the „Provider“).
Contact details: e-mail office@eos.cz, for personal data protection matters data@eosclub.app, Czech certified electronic mailbox (datová schránka) ID 83rv83i.
2. The Company's role: when it is a controller and when a processor
To understand these Policy correctly, it is necessary to distinguish the Company's two roles:
2.1 The Company as a processor – membership data
The Company's customer is an organisation, association or club, or a self-employed natural person, that has concluded a service agreement with the Company (hereinafter the „User“). The Company processes as a processor the personal data of natural persons whom the User records through the Tool, including children and young people (hereinafter the „members of the User“; this term means natural persons recorded by the User in the Tool, including persons who do not have their own access account – it is therefore not the same term as „Active Members of the User“ under the GTCs, which covers only persons with an access account). The controller of this data is the User, who decides on the purpose and scope of its processing; the conditions are governed by a separate Personal Data Processing Agreement. The information obligation towards the members of the User is fulfilled by the User as their controller; consents and information on processing are provided to and managed for the members by the User through the Tool, for which the Company provides only the technical means. These Policy do not apply to the processing described above.
2.2 The Company as a controller
As a controller, the Company processes the personal data of Users and of the persons acting on their behalf (in particular their representatives, employees and administrators accessing the Tool, also referred to in the Tool and in the GTCs as the „User's administrator“), and the personal data of visitors to the website www.eos.cz, as described in Article 3 of these Policy.
2.3 The Company as a processor – the Website
Where the Company also provides the User with the service of operating its own online presentation (the Website), it processes as a processor the personal data of members of the User processed in connection with the Website, whether published on it (in particular team rosters) or not yet published in its administration (e.g. drafts), and the personal data from forms placed on it; the controller of this data is the User, who decides on its publication. This processing is governed by a separate Personal Data Processing Agreement and these Policy do not apply to it. Third-party tools (in particular traffic analytics, social media plug-ins and embedded content) which the User activates on the Website itself process personal data under the responsibility of the User as controller.
3. Purposes of processing, legal bases and retention periods (the Company as a controller)
The Company processes the data described in this Article as a controller for its own purposes (in particular the operation, security and development of the service, communication with Users and compliance with its own statutory obligations). This does not concern the personal data of members of the User processed for the User under Article 2.1, to which these Policy do not apply; the fact that certain operational and technical data arise in connection with the Tool does not alter the Company's position as controller of its own operational data.
3.1 Conclusion and performance of the service agreement (including the trial version)
This purpose covers all services the Company provides to the User under the agreement, in particular making the Tool available and operating it, and any service of operating the Website (Article 2.3). The Company processes the personal data of members of the User processed in the actual operation of the Tool and the Website as a processor (Articles 2.1 and 2.3), not under this Article; this purpose concerns the data of the User and of the persons acting on its behalf.
Scope of data: for a User that is a self-employed natural person, the name, surname, Id. No., registered office, telephone number and e-mail address; for a User that is a legal entity, the identification and contact details of its representatives or employees (usually the name, surname, position, telephone number and e-mail address).
Legal basis: performance of the contract, or steps taken prior to entering into a contract, under Article 6(1)(b) GDPR (for a self-employed natural person); the legitimate interest of the Company in concluding and performing the contract with the represented User under Article 6(1)(f) GDPR (for representatives and employees of a User that is a legal entity).
Necessity: providing the data is necessary for the conclusion and performance of the contract; without it the contract cannot be concluded.
Retention period: for the term of the contract and subsequently for the limitation period applicable to the obligations arising from it.
3.2 Ensuring the security, stability and proper operation of the Tool
Scope of data: operational and technical data on activity in the Tool (in particular login and operational logs, IP address) – see Article 20.3 of the GTCs.
Legal basis: the legitimate interest of the Company in security, stability, prevention of misuse and improvement of the quality of the service under Article 6(1)(f) GDPR.
Retention period: operational logs 14 days, fault records 90 days, data backups 14 to 30 days; the guaranteed data recovery window is governed by Article 11.5 of the GTCs. The Company retains login records (including the IP address) for the term of the user account, as they serve to trace the login history and to carry out security checks of unusual or unauthorised logins to the account; after the account is cancelled, the Company deletes or anonymises them within one year at the latest, with the exception of data which the Company is entitled to retain further under Article 7.3.
3.3 The mobile application and its distribution
The mobile application of the EOS Club® Member Platform is distributed through application stores, in particular Google Play and the Apple App Store, or through another comparable application store used by the Company for distribution. In connection with the installation and operation of the application, technical device identifiers and operational data necessary for the functionality and security of the application may be processed. The application is distributed in all stores as the same technical product; it does not integrate technical services specific to the operators of individual application stores and, regardless of the store from which it was installed, it uses solely the recipients and third-party services listed in Articles 4 and 5. The application may further use third-party services, in particular for the delivery of push notifications, security and payment services; the overview of recipients and any transfer to third countries is governed by Articles 4 and 5.
Scope of data: unique identifiers of the device and of the application instance allowing indirect identification (in particular the application instance identifier used for the security and stability of the application) and the operational data on the use of the application linked to them (e.g. crash and error records); data on the device type and operating system alone, without any link to these identifiers, is not considered personal data.
Legal basis: the legitimate interest of the Company in the functionality, stability and security of the application under Article 6(1)(f) GDPR.
Retention period: operational and technical records under Article 3.2; the application instance identifier for as long as the application is installed and used.
3.4 Communication and customer support
Scope of data: identification and contact details and the content of the communication (fault reports, enquiries, complaints).
Legal basis: performance of the contract under Article 6(1)(b) GDPR, or the legitimate interest in providing support under Article 6(1)(f) GDPR.
Retention period: for the term of the contract and for the limitation period.
When handling and sorting customer support enquiries, the Company may use third-party tools, including tools with artificial intelligence features; their operation may involve the transfer of personal data to third countries under the conditions of Article 5. Where a customer support enquiry contains personal data of members of the User in respect of which the Company acts as a processor, its processing and any transfer to third countries are governed by the Personal Data Processing Agreement concluded with the User, including its list of sub-processors; to that extent, these Policy do not apply to it (Article 2.1).
3.5 Sending commercial communications and the Provider's Advertising Messages
Scope of data: the name, surname and e-mail address of the User's contact person (the User's administrator).
Legal basis: the legitimate interest of the Company in promoting its own similar services to its customers under Article 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Sb.; in other cases, consent under Article 6(1)(a) GDPR. The subscription may be refused (unsubscribed from) at any time. Further rules on Advertising Messages in the Tool's interface are set out in Article 23 of the Company's General Terms and Conditions (hereinafter the „GTCs“).
Retention period: until consent is withdrawn or an objection is raised.
3.6 Cookies and similar technologies
3.6.1 Cookies and similar technologies may be used on the website www.eos.cz. The Tool itself (the web application and the mobile application) does not use analytical or marketing cookies and does not require a cookie banner; it uses technically necessary means for login and basic functionality. To provide specific features, the Tool uses functional third-party services (in particular the display of maps and, in the Shop module, a parcel delivery service); their providers are listed among the sub-processors (Article 4) and their use may involve the transfer of data to third countries (Article 5).
3.6.2 Technically necessary cookies are processed on the basis of the legitimate interest of the Company in the proper functioning of the website under Article 6(1)(f) GDPR. Without them, certain features cannot be provided.
3.6.3 Analytical and marketing cookies on the website www.eos.cz are processed solely on the basis of the data subject's consent under Article 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Sb., on Electronic Communications. The data subject grants and manages consent through the cookie settings tool available on the website and may withdraw it at any time. The use of these cookies may involve the transfer of data to third countries (Article 5). The specific analytical and marketing tools used and their providers: Google Analytics and Google Ads (remarketing) – Google Ireland Limited, reg. no. 368047, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland; Meta Pixel – Meta Platforms Ireland Limited, reg. no. 462932, Merrion Road, Dublin 4, D04 X2K5, Ireland; Sklik (retargeting) – Seznam.cz, a.s., Id. No. 26168685, Radlická 3294/10, Smíchov, 150 00 Prague 5, Czech Republic. Within the analytical and marketing tools listed above, a transfer to third countries occurs only in the case of the tools of Google and Meta. The deployment of these tools is technically ensured through the Google Tag Manager service (Google Ireland Limited), which serves to manage measurement and marketing scripts and does not itself store cookies.
3.7 Compliance with legal obligations
Scope of data: billing and identification details, data in accounting and tax documents.
Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR (in particular the Accounting Act, the Value Added Tax Act and the Income Tax Act).
Retention period: for the period laid down by the applicable legislation.
3.8 Asserting and defending legal claims
Scope of data: the data set out in the contract and in the communication, data needed to assert or defend claims.
Legal basis: the legitimate interest of the Company in protecting its rights and property under Article 6(1)(f) GDPR.
Retention period: for the duration of the dispute and for the limitation period during which claims may be asserted.
4. Recipients of personal data and sub-processors
4.1 In providing the service, the Company uses sub-processors, in particular providers of hosting, infrastructure, storage, e-mail and supporting services and customer support. The current list of sub-processors, including their identification, the purpose of their engagement and their registered office, is always available at www.eosclub.app/list-of-sub-processors and the Company updates it on an ongoing basis.
4.2 Other recipients may be the Company's accountants, tax advisors, auditors and legal counsel, as well as courts and public authorities, where necessary for compliance with legal obligations or the protection of the Company's rights.
5. Transfers of personal data to third countries
5.1 As a rule, the Company processes personal data within the European Union or the European Economic Area. For defined services, however, personal data may be transferred to third countries, in particular to the United States of America – in connection with the analytical and marketing tools on the website www.eos.cz (Article 3.6.3) and in connection with customer support tools (Article 3.4), where the Company uses them. Such a transfer takes place only where appropriate safeguards under Article 44 et seq. GDPR are ensured, in particular on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or on the basis of standard contractual clauses adopted by the European Commission under Article 46 GDPR, together with an assessment of the conditions of the given transfer. The Company will provide a copy of the safeguards used upon request sent to data@eosclub.app.
5.2 The Website and the Tool may contain links to third-party websites and services (in particular social networks and application stores). These third parties process personal data under their own policies, for which the Company is not responsible; we recommend that you familiarise yourself with their policies.
6. Rights of the data subject
6.1 The data subject has the right vis-à-vis the Company: (i) of access to personal data, (ii) to rectification, (iii) to erasure, (iv) to restriction of processing, (v) to data portability, (vi) to object to processing based on legitimate interest and (vii) to withdraw consent given, where the processing is based on consent.
6.2 These rights may be exercised with the Company in writing at the address of its registered office, electronically at data@eosclub.app, or via the Czech certified electronic mailbox (datová schránka) ID 83rv83i.
6.3 If you are a member of a User (an organisation, association or club), exercise your rights to personal data processed in connection with your membership, including data published on the Website, with your organisation as the controller (Articles 2.1 and 2.3); in respect of this data the Company is merely a processor. If the Company receives such a request, it will forward it to the relevant organisation without undue delay and assist that organisation in handling it. Consents and information on processing are provided to you and managed in the Tool by your organisation.
6.4 The data subject also has the right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz) if they believe that the processing of their personal data has infringed personal data protection legislation.
7. Deletion of the user account and related data
7.1 Where the Tool or the mobile application allows a user account to be created, the person to whom the account belongs has the right to request at any time the deletion of their account and of the personal data related to that account.
7.2 Where a request for deletion of an account may be submitted depends on the Company's role under Article 2 of these Policy. Where the account belongs to a member of the User whose personal data the Company processes as a processor (Article 2.1), the request is submitted to the User as controller; the Company assists the User in handling such a request and provides it with the necessary technical support. Where the account belongs to a person accessing the Tool on behalf of the User (in particular its representative, employee or administrator), whose personal data the Company processes as a controller (Article 2.2), the request may be submitted directly to the Company by the means set out in Article 6.2.
7.3 Where the account belongs to a person whose personal data the Company processes as a controller (Article 2.2), the Company will, upon request, delete the user account and the personal data associated with it; this does not apply to data which the Company is obliged or entitled to retain further in order to comply with its own legal obligations or to protect its legitimate interests (in particular accounting and tax documents and data necessary for asserting or defending legal claims for the limitation period under Article 3). The scope of the data retained in this way and the period of its retention are set out in Article 3 of these Policy.
7.4 Where handling the request requires a longer period, the Company will notify the applicant accordingly and, once the deletion is complete, will provide them with a confirmation.
7.5 Where the account belongs to a member of the User whose personal data the Company processes as a processor (Article 2.1), the Company as processor will carry out the erasure on the basis of and to the extent of the documented instruction of the User as controller; the User as controller decides on the erasure itself and its scope, as well as on any further retention of this data. The User may be obliged to retain certain data further, in particular in order to evidence the use of public funding (sports grants).
7.6 This Article is without prejudice to the right to erasure under Article 6 or to the possibility of exercising the other rights of the data subject.
8. Minors
8.1 The members of a User commonly include children and young people who use the Tool, including through the mobile application. The personal data of children and young people is administered by the User; the Company never processes it as a controller (Article 2.2), but processes it exclusively as a processor (Article 2.1) for the User, who is the controller in relation to them and is responsible for the legal basis of the processing, for obtaining consent (for a child under 15 years of age, consent is given or approved by the holder of parental responsibility pursuant to Section 7 of Act No. 110/2019 Sb.) and for fulfilling the information obligation.
8.2 If the Company finds that, as a controller, it is processing the personal data of a child under 15 years of age without the required legal basis, it will delete such data without undue delay.
9. Automated decision-making and profiling
9.1 The processing of personal data carried out by the Company as a controller under Article 2.2 does not involve automated decision-making or profiling that would produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 GDPR.
9.2 Advertising Messages in the Tool's interface (Article 23 of the GTCs) are handled by the Company's own advertising system. Targeting is based solely on the category of the recipient (in particular the type of organisation, the region and the type of sport), the selection is random and does not involve profiling of individual members of the User. Advertising Messages are not displayed to members of the User under 18 years of age (Article 23.2 of the GTCs).
10. Security of personal data
10.1 The Company has adopted and maintains appropriate technical and organisational measures to secure personal data against unauthorised or accidental access, alteration, destruction, loss or misuse, taking into account the nature of the processing and the risks under Article 32 GDPR.
10.2 The Company continuously adapts the specific form of the measures adopted in the operation of the Tool to the state of the art and the level of risk and maintains it in separate security documentation (Technical and Organisational Measures), which it is entitled to update without thereby reducing the level of protection achieved.
10.3 The Company imposes a duty of confidentiality on the persons who come into contact with personal data and also binds its sub-processors contractually.
11. Applicable legislation
The processing of personal data is governed in particular by Regulation (EU) 2016/679 (GDPR), Act No. 110/2019 Sb., on Personal Data Processing, Act No. 127/2005 Sb., on Electronic Communications, Act No. 480/2004 Sb., on Certain Information Society Services, and other generally binding legislation.
12. Changes to the Policy and effective date
12.1 The Company is entitled to update these Policy. The current version is always available on the Company's website.
12.2 These Policy take effect on 12 October 2026.
