Information on the Processing of Personal Data

We have divided the personal data we process into the following categories below:

• Identification data, such as first name, surname, job title/position, the name of your employer or the company you represent, and the company's Company ID (IČO) and VAT ID (DIČ). This data is needed to identify the contracting party, to conclude and perform the contract, and for communication.

• Contact data, such as email address, phone number and the company's registered office address. This data is needed to communicate with you, send invoices and fulfil contractual obligations.

• Login data, such as your username (email address) and password (stored in hashed form). This data is needed to create and manage your user account in the Application and to authenticate you when logging in.

• Contractual relationship and performance data, such as the date the contract was concluded, the contract term, the agreed scope of the Service (chosen plan, number of licences, agreed modules and storage capacity), payment method, invoices, order value, payment information, and data needed to handle complaints and other claims.

• Communication data, i.e. information about our mutual communication, such as emails, records from the contact form on the Website, records of online meetings and demo presentations, and the content of communication within customer and technical support (support@staybrand.io).

• Website and Application usage data, i.e. information about your use of our Website and Application and your behaviour on them, such as IP address, device identifiers, timestamps of logins and actions (logs), records of active sessions, time spent in the Application, browser and operating system information, and other similar data. This data is used mainly to ensure operation, security and performance, to audit actions performed on templates, and to evaluate the availability of the Service.

• Cookie data, i.e. data obtained from cookies and similar technologies that we use on the Website. For details, see the Cookie Policy (https://staybrand.io/en/cookies) on the Website.

Your personal data is processed for the purposes described below. For each purpose of processing you will also find the scope of personal data processed and the data retention period.

B.1. Performance of the mutual contractual relationship

We primarily process personal data in order to fulfil the mutual contractual obligations between you (or the company you represent) and us in connection with the provision of the Stay Brand Service, on the basis of a contract that arises upon acceptance of an order under the General Terms and Conditions (or upon conclusion of a written contract). This purpose also includes sending emails relating to the performance of the mutual contractual relationship, information about the status of the Service, invoicing, and customer and technical support.

For this purpose we process your Identification data, Contact data, Login data, Contractual relationship and performance data, and Communication data.

The legal basis for this processing is the performance of the contract between you and us, and the necessity of taking steps at your request prior to entering into the contract. Where you are not directly a party to the contract (e.g. you are an employee or representative of the customer), the legal basis is our legitimate interest in performing the concluded contract.

Data is processed for the duration of the contractual relationship and thereafter for as long as necessary to fulfil obligations arising from that contract.

B.2. Managing your user account and Workspace

In the Application you create a user account through which you access the Service and your virtual workspace ("Workspace"). For this purpose we process your personal data in order to create and manage your user account, authenticate you when logging in, assign user roles, manage licences (seats), record your activity in the Application, and ensure access to the outputs of the Service (in particular templates, brand assets, CRM records and digital business cards).

For this purpose we process your Identification data, Contact data, Login data and Application usage data.

The legal basis for this processing is the performance of the contract concluded under the General Terms and Conditions; for users who are not directly a party to the contract, the legal basis is our legitimate interest in the proper performance of the contract concluded with the customer.

Personal data will be processed for the duration of the contractual relationship. Once the contract ends, data uploaded to the Workspace will be permanently and securely deleted, including from all backups, no later than 30 calendar days after the contract ends, unless otherwise required by law.

B.3. Contact forms, demo requests and business communication

The Website includes a contact form and other similar tools through which you can contact us, for example if you are interested in the Service, want to request a demo, need technical support, or want to arrange a meeting or consultation.

In such cases we process your Identification data, Contact data and Communication data (including data relating to arranging a meeting, such as the date and time, and the content of your enquiry).

Submission of the contact form is protected against automated (robotic) submissions by the Cloudflare Turnstile service, which for this purpose processes your IP address and technical browser signals; the legal basis for this processing is our legitimate interest in securing the Website. Together with your enquiry, we also store the time the form was submitted and any consent you granted to receiving marketing communications (newsletter), for the purposes of demonstrating compliance.

The legal basis for this processing is our legitimate interest in ensuring mutual communication and handling your queries, as well as the necessity of taking steps at your request prior to entering into a contract.

Personal data will be processed for as long as necessary to handle your query, or for further purposes in connection with the subsequent performance of a contract.

B.4. Internal records, statistics and protection of our rights

We may process your data for the purposes of keeping internal records, recording payments made, producing statistical reports, protecting our rights and legal claims, and ensuring that we are able to defend ourselves against any claims you may bring. For this purpose we may also retain IP addresses and other operational logs from the Service and the Website.

For this purpose we process your Identification data, Contact data, Contractual relationship and performance data, Communication data, and Website and Application usage data.

The legal basis for this processing is our legitimate interest in keeping internal records and statistics and protecting our rights.

Data is processed for the duration of the applicable statute-of-limitations periods, which typically may be up to 10 years from the occurrence of the relevant events from which the limitation period is calculated.

B.5. Compliance with legal obligations

We may also process your personal data in order to comply with our legal obligations, in particular in the area of tax and accounting. We must issue an invoice for every order, keep accounting records, pay taxes, etc. At the same time, we need to be prepared to cooperate with public authorities where required by law (in particular tax authorities, courts, bailiffs, police authorities, or the Office for Personal Data Protection).

For this purpose we process your Identification data, Contact data, and Contractual relationship and performance data, always to the extent required by the relevant legal regulations.

The legal basis for this processing is compliance with our legal obligations.

Data is processed for the period laid down by law. For example, in the area of accounting and tax, this period can be up to 10 years, given the possibility of audits.

B.6. Marketing, newsletter and references

We may use your personal data to send you offers of our services, product news (e.g. new modules, template improvements, ROI tips) and our content newsletter, "news and tips for effective brand management". We may also list you (or your company) as a reference client, for example by including the company name and logo in references on the Website and in marketing materials.

For this purpose we process your Identification data (where known) and Contact data.

The legal basis for this processing is:

• our legitimate interest in direct marketing to existing customers and in building references, provided that you are our customer and have not opted out of receiving business communications;

• your consent, provided that you sign up to our newsletter via the checkbox in the contact form on the Website or in another way (e.g. by subscribing to the newsletter).

We will process your personal data until you opt out of receiving business communications, which you can do via the unsubscribe link in each individual email, or for the duration of the contractual relationship (in the case of references).

B.7. Operation of the Website and Application, and security

We process your personal data to ensure the operation of the Website and Application and to ensure their security. Processing your personal data may therefore also serve to make sure the Website and Application work as you expect, that everything displays correctly, and that browsing and using them is safe. In this connection we process in particular operational logs, records of active sessions and IP addresses.

For this purpose we process your Website and Application usage data and Cookie data.

The legal basis for this processing is our legitimate interest in the proper functioning and secure operation of our Website and Application.

Data is generally processed for the duration of your visit to the Website or session in the Application, for a maximum of 1 year from when it was obtained.

Your personal data may be shared with the following recipients (processors or independent controllers):

• Vercel Inc. (USA) as the provider of the hosting and deployment platform on which the front-end environment of the Application and Website runs, and as the provider of anonymous aggregated traffic statistics for the Website (Vercel Web Analytics);

• Amazon Web Services, Inc. (USA, or AWS EMEA SARL for EU regions), Supabase Inc. (USA) and Neon Inc. (USA) as providers of the database and cloud infrastructure on which Application data is stored;

• Cloudflare, Inc. (USA) as the provider of CDN services, protection against attacks on the availability of the Website and Application, object storage (R2), and the Turnstile service used to protect forms on the Website against automated (robotic) submissions;

• Google LLC, or Google Ireland Limited, as the provider of the API interfaces for AI-based features (e.g. generative features in the template editor); data is transferred only to the extent necessary to fulfil the specific request, and the provider is not authorised to use the transferred data to train its general models;

• Google LLC (Google Analytics) and Microsoft Corporation (Microsoft Clarity) as providers of analytics tools for measuring traffic and analysing visitor behaviour on the Website; these tools are activated exclusively on the basis of your consent given via the cookie banner (see the Cookie Policy for details);

• the provider of the transactional email (SMTP) service used to send system and transactional emails from the Application and Website (e.g. delivery and confirmation of enquiries from the contact form, invitation links, notifications, password resets), as well as providers of payment and invoicing systems, CRM tools, marketing automation tools for sending the newsletter, and similar IT service providers that we use to run our organisation, to the extent necessary to perform their function;

• accountants, tax advisors and external legal counsel, to the extent necessary to keep accounts, meet tax obligations and provide related advice, as well as public authorities that request the transfer of personal data from us for the purpose of "Compliance with legal obligations", where we are required to do so under applicable legislation (in particular tax authorities, police authorities and judicial authorities).

Some of the recipients listed above are established outside the European Economic Area, in particular in the United States of America (e.g. Vercel, Inc., AWS, Inc., Cloudflare, Inc., Google LLC). Where we share your personal data with controllers and processors in third countries (outside the EEA), we do so only where such parties provide sufficient safeguards under Art. 44 et seq. of the GDPR, in particular on the basis of a European Commission adequacy decision (e.g. the EU-U.S. Data Privacy Framework, for recipients certified under it), standard contractual clauses, or other appropriate safeguards. Wherever technically and commercially possible, we primarily choose the EU regions of the relevant providers.

You have the right to (i) request access to your personal data; (ii) withdraw your consent; (iii) request rectification of your personal data; (iv) request erasure of your personal data; (v) request restriction of the processing of your personal data; (vi) request the portability of your personal data; (vii) object to the processing of your personal data; or (viii) lodge a complaint with the relevant supervisory authority.

For any matters relating to the processing of your personal data, whether a question, exercising your rights, sending us a complaint, etc., you can contact us via the email address given at the beginning of this document.

Right of access

You have the right to obtain confirmation from us as to whether or not we process your personal data. If we do process your personal data, you also have the right to request access to information about the purpose and scope of processing, the recipients of the data, the processing period, the right to rectification, erasure, restriction of processing and objection to processing, the right to lodge a complaint with a supervisory authority, and the source of the personal data (this information is already provided in this document). You may also ask us for a copy of the personal data being processed. We provide the first copy free of charge; further copies may be subject to a fee. The scope of the data provided may be limited so as not to adversely affect the rights and freedoms of others.

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time. Withdrawing your consent does not affect the lawfulness of processing carried out before the consent was withdrawn, nor will it result in the termination of processing carried out on another legal basis.

Right to rectification

You have the right to request that we rectify inaccurate personal data concerning you. Depending on the purpose of processing, you may also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. If you have an active user account in the Application, you can correct much of your personal data directly through the user interface.

Right to erasure (the "right to be forgotten")

You have the right to request the erasure of your personal data where: we no longer need your personal data for the purposes for which it was collected or processed; you withdraw the consent on the basis of which the personal data was processed, and there is no other ground for its processing; you object to the processing and there are no other overriding grounds for processing, or you object to processing for the purposes of direct marketing; or your personal data is processed in breach of applicable law. However, you cannot exercise this right where processing is necessary to comply with our legal obligations or for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data where: you contest the accuracy of your personal data (in which case you may request restriction of processing until the accuracy of the data has been verified); the processing is unlawful and, instead of erasure, you request restriction of processing; we no longer need your personal data for the purposes for which it was collected or processed, but you require it for the establishment, exercise or defence of legal claims; or you have objected to the processing of your personal data (in which case you may request restriction of processing pending verification of whether our legitimate interests override yours).

Right to data portability

You have the right to receive a copy of your personal data that we process automatically on the basis of your consent or for the performance of a contract. We will provide this data in a commonly used, machine-readable format either to you or to a controller you designate, where this is technically feasible. The scope of the data provided may be limited so as not to adversely affect the rights and freedoms of others.

Right to object

You have the right to object to the processing of your personal data that we carry out on the basis of our legitimate interest. We will stop processing your data if there are no other overriding grounds for processing and the processing is not necessary for the establishment, exercise or defence of legal claims, or if you have objected to processing for the purposes of direct marketing.

In addition to exercising your rights with our company, you can also lodge a complaint with the relevant supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), based at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, website: www.uoou.cz.

In certain modules (in particular the template editor and related features), the StayBrand Service uses AI-based functions provided by third parties (e.g. generative AI for creating text and visual variants). These features serve exclusively as a creative tool for you (or for the customer whose user you are); they are not used to evaluate you as a person and do not make automated decisions that would produce legal effects concerning you or similarly significantly affect you.

Within the processing of your personal data where we act as controller, there is no automated decision-making or profiling within the meaning of Art. 22 GDPR that would produce legal effects concerning you or similarly significantly affect you.

We obtain your personal data primarily directly from you, in connection with entering into and performing a contract, communication via the contact form (in particular the "No-obligation enquiry" form on the Website), booking systems, email or telephone, and when you visit the Website and use the Application.

In some cases we may also obtain your personal data from third parties, typically from your employer or the company you represent, if that person designates you as their contact person, administrator (in the role of Owner or Editor) or user in connection with entering into a contract for the provision of the Service. In such cases we process your Identification data and Contact data on the basis of our legitimate interest in performing the concluded contract. We will inform you about the processing of your personal data no later than one month after obtaining it.

We are entitled to update this processing notice from time to time, so please check it regularly. We will publish any changes to this document on our Website.

This document is effective from 7 July 2026.