The company GOPAY (the ‚GOPAY‘ or the ‚Data Controller‘) means GoPay Czech, odštěpný závod zahraniční právnické osoby Worldline NV, Kingdom of Belgium, with its registered office at Senovažné nám. 1736, 370 01 České Budějovice, company registration number: 221 774 69, registered in the Commercial Register maintained by the Regional Court in České Budějovice, Section A, Insert 11596. The terms “we”, “us”, “our” and similar used in these Terms and Conditions have the same meaning. GOPAY is a payment institution within the meaning of the Payments Act and operates the GoPay Payment System.

This privacy policy (the “Privacy rules”) governs how we approach the processing of personal data and secure its protection in the GoPay Payment System. We follow Czech Act No. 110/2019 Coll., on personal data processing (the ‚PDPA‘), and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the ‚GDPR‘).

When processing personal data we take care to ensure that no harm is caused to the rights of natural persons in connection with the processing of personal data. At the same time we are obliged to comply with the provisions of the relevant legislation and to apply proportionate measures to protect the legal order, democratic society and its specific important interests, as set out below.

Under Section 2(1)(b)(5) of Act No. 253/2008 Coll., on certain measures against the legalisation of the proceeds of crime and the financing of terrorism, as amended (the ‚AML Act‘), we are an obliged entity.

Under Sections 7 and 8 of the AML Act, an obliged entity is required, in order to prevent the financial system being misused for the legalisation of the proceeds of crime and the financing of terrorism, to carry out identification of its clients to the extent of the personal data set out below and, in the cases laid down by law, also to carry out checks on clients under Section 9 of the AML Act.

Within the meaning of the PDPA and of the GDPR we are entitled to process your personal data (the “PD”) to the following extent:

The PD is processed for 10 years from the transaction or from the end of the business relationship between you and the data controller (whichever is later). You are aware that, as the data subject, you cannot withdraw this consent.

The data controller is entitled to provide this data to the relevant state authorities on request, and you understand this.

If a personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, the data controller will notify you of the breach without undue delay.

If we were to process your personal data for another reason requiring your explicit consent, we will request it in advance of such processing.

As the data subject you acknowledge the above and also acknowledge the following notice about your rights.

If a data subject requests information about the processing of their personal data, the data controller is obliged under Section 12 of the PDPA to provide this information without undue delay. The information always includes a statement about the purpose of processing the personal data, the personal data or categories of personal data being processed, including all available information about its source; the nature of automated processing in connection with its use for decision-making, where acts or decisions are made on the basis of such processing whose content is an interference with the rights and legitimate interests of the data subject; and the recipients or categories of recipients. The data controller has the right to require reasonable payment for providing the information, not exceeding the costs necessary to provide it. The data controller's obligation to provide information to the data subject under Section 12 of the PDPA may be fulfilled on the controller's behalf by a processor.

Any data subject who finds or believes that the data controller or a processor is processing their personal data in a way that conflicts with the protection of the data subject's private and personal life or conflicts with the law, in particular where the personal data is inaccurate with regard to the purpose of its processing, may, under Section 21 of the PDPA, a) ask the data controller or processor for an explanation, b) require the data controller or processor to remedy the situation that has arisen; this may in particular involve blocking, correcting, supplementing or destroying the personal data. If the data subject's request under the previous sentence is found justified, the data controller or processor will remedy the defective situation without delay. If harm other than material harm has arisen as a result of the processing of the data subject's personal data, the data subject's claim is pursued under a special act. If, in processing personal data, obligations imposed by law have been breached by the data controller or by a processor, they are jointly and severally liable for them.

You acknowledge that, in addition to the rights set out above under the PDPA, further rights arise for you from the date the GDPR takes effect under Articles 15 to 23 of the GDPR, namely the right to request access from the data controller to the personal data concerning you (including confirmation as to whether personal data concerning you is being processed), the right to request its correction or erasure, or restriction of processing, and the right to object to processing, as well as the right to data portability. You further acknowledge that you have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

You acknowledge that the Privacy rules contain all the information provided to the data subject under Article 13 of the GDPR.

If you are dissatisfied with the quality of the services provided by GOPAY, follow the GOPAY Complaints Procedure, which is published on the company's website.

By continuing to use the functions of the GoPay Payment System you express your free, specific, informed and unambiguous indication of will that you understand the processing of your personal data under these Privacy rules and that you have been duly informed and instructed about the processing of your personal data.

We are entitled to amend these Privacy rules unilaterally in accordance with applicable legislation, and you agree to this entitlement.

If we amend the Privacy rules, we are obliged to notify all registered users of the GoPay Payment System of the change in advance by an e-mail message containing a link to the new Privacy rules.

The Privacy rules are issued in electronic form and are available on the GOPAY website.

The Privacy rules take effect on 1 April 2025.