Personal data protection

1. Data controller

The controller of your personal data is the oneBase project, based in the Czech Republic (the “Controller”). For any questions concerning the protection of personal data, you can contact us at info@onebase.cz.

2. What data we process

In operating the oneBase platform, we process the following categories of data:

• Registration data: username, email address, first name and surname
• Login data: password (stored in encrypted form — hash)
• Contact data: data entered via contact forms (name, email, message)
• Pre-order data: product, date, notes
• Newsletter subscription data: email address, selected product
• Technical data: IP address, browser type, time of access (for security purposes)

3. Purposes of processing

We process your data exclusively for the following purposes:

• Operation of the user account and authentication
• Provision of ordered services and products
• Communication with users (answering enquiries, support)
• Sending news and updates (only with your consent)
• Management of pre-orders and licenses
• Ensuring the security of the platform and preventing misuse
• Compliance with legal obligations

4. Legal basis for processing

We process your data on the basis of:

• Performance of a contract — to provide the services for which you have registered
• Legitimate interest — to ensure security and technical operation
• Consent — to send marketing communications and news
• Legal obligation — to comply with legal requirements

5. Sharing of data

We do not sell your personal data or share it with third parties for marketing purposes. Data may be shared only in the following cases:

• With providers of technical services (hosting, email services) for the purpose of operating the platform
• On the basis of a legal request from public authorities
• With your explicit consent

6. Data storage and security

All data is stored on servers in the European Union. We use encrypted connections (HTTPS), store passwords exclusively in hashed form (bcrypt) and perform regular backups.

Access to personal data is restricted to authorized persons and only to the extent necessary for the performance of their duties.

7. Retention period

We retain your data for the duration of the user account and thereafter for the period necessary to comply with legal obligations (typically 3 years after the account is closed, for tax and accounting purposes).

We retain data from contact forms for 2 years, and newsletter subscription data until you unsubscribe.

8. Your rights

As a data subject, you have the right:

• Right of access — to obtain information about the data being processed
• Right to rectification — to request the correction of inaccurate data
• Right to erasure — to request the deletion of data (the “right to be forgotten”)
• Right to restriction of processing — to request that processing be restricted in certain situations
• Right to data portability — to receive data in a machine-readable format
• Right to withdraw consent — to withdraw previously given consent at any time
• Right to lodge a complaint — with the Czech Office for Personal Data Protection (ÚOOÚ)

9. Cookies and traffic analytics

We always use technically necessary cookies — they keep you logged in, maintain the session and remember your choice regarding analytics (ob_consent, 180 days). The website does not work without them, so we do not need your consent for them.

Traffic analytics is provided by the Metricool tool. It runs only with your consent — without it, its script is not loaded from Metricool’s servers at all. When analytics is enabled, Metricool receives the address of the page visited, where you came from, information about your browser and device, and your IP address; Metricool may also store its own identifier in your browser. We use the data only to evaluate website traffic, not for advertising. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can give or withdraw your consent at any time: Cookie settings.

Linking with Discord (optional)

If you link your oneBase account with our community server on Discord, we store your Discord ID and username so that we can assign you roles based on the products you use and resolve your questions faster. The support team on Discord can then see your name, which oneBase products and plans you use and your recent tickets — not your e-mail, address or payments. You can cancel the link at any time in your account settings or with the /odpojit command. The legal basis is your consent, which you give by confirming the link (Art. 6(1)(a) GDPR).

10. Changes to this policy

This Privacy Policy may be updated. You will be informed of material changes by email or by an announcement on the platform at least 30 days in advance.

Last updated: 1 April 2025