Platform Privacy Policy
Version 2, effective Oct 9, 2026
This policy describes how the operator of the Forgmatic platform handles the personal data of website visitors and of users who have created an account.
If you are reading this as a customer of a shop running on the platform, you are probably looking for that shop's policy. The controller of your data is the shop's operator, not the platform operator.
Who is the controller
The controller is Petr Zeman - Forgmatic, registered at Orechov 88, 59452 Orechov, company ID No. (IČO) 07924925, the operator of the Forgmatic platform. For data protection matters, write to the contact email shown in the footer of this site.
What data we process
- Registration and billing data — name, email, phone, organization name and identifiers, billing address.
- Operational data — sign-in records, IP address in truncated form, browser type, activity records in the administration.
- Content you put into the service — we process it for you as a processor, not as a controller. It is governed by the data processing agreement.
- Communications — the content of messages sent via the contact form or by email.
- Business outreach to companies — the company's name and identifiers, and the name, job role, work email and phone of a contact person that the company has published itself (business registers, company directories, its own website). For each company we record what we sent and how it replied. The link in our email carries the company's personal code. With your consent to marketing cookies, we use it to match a visit to the demo shop with the company. If you sign up straight from that link, the code in the address is sent with the sign-up even without consent; nothing is stored in your browser.
Why and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service and managing the account | performance of a contract |
| Invoicing and accounting | legal obligation |
| Security and abuse prevention | legitimate interest |
| Sending service news | consent, or legitimate interest for existing customers |
| Business outreach to companies that could use the service | legitimate interest |
| Matching a visit from the link in a business email | consent |
| Monitoring errors on our servers | legitimate interest |
| Error reports from your browser | consent |
Who we share data with
We share data only with processors who run parts of the service for us: hosting of the website, application and database, file storage, email delivery, payment processing, bot protection for forms, error tracking and availability monitoring. Who they are, what they do for us and where they are based is on the Subprocessor list page.
Error tracking has two parts. We always monitor errors on our servers, because the service cannot be run reliably without it. Errors from your browser are sent to Sentry only if you allow analytics cookies. What is sent and how to withdraw consent is described in the Cookie Policy.
If you sign in with a Google account, Google learns about the sign-in and handles it as an independent controller under its own policy. We look up company details by company ID in the public Czech business register ARES.
The database and uploaded files are stored in the European Union (Frankfurt, Germany). Some processors are US companies and may process data there as well. In that case the transfer is covered by the European Commission's standard contractual clauses, and where applicable also by the EU-US Data Privacy Framework. The safeguard for each processor is shown on the list.
How long we keep data
- Account data — for the term of the contract and 30 days after it ends.
- Accounting records — 10 years under the Accounting Act.
- Audit log (sign-ins, administrative actions, data exports) — 24 months.
- Contact-form messages — 24 months.
- Business outreach data — 3 years after our last contact with the company. If you object, we delete the data and will not contact the company again.
- Data processed on the basis of consent — until consent is withdrawn.
These periods are the same for all plans. Deleted data stays in encrypted database backups for a while: we keep daily backups for 30 days and the first backup of each month for 90 days. Deleted data is gone from backups no later than 90 days after deletion.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
An overview and how to exercise these rights is on the GDPR — your rights page. You can access and delete your data yourself from your account.
You also have the right to lodge a complaint with the Czech Data Protection Authority (www.uoou.gov.cz).
Cookies
The use of cookies is described in the separate Cookie Policy.