Personal Data Protection Policy
PDR Academy — training courses in PDR technology
Effective from: 19. 10. 2026
Version: 1.2 — new: Google visitor statistics and ad measurement only with your consent in the cookie banner (sections 2.7, 4.11 and 7)
This document explains what personal data we process about you, why we do it, how long we keep it and what rights you have. We have tried to write it in plain language. If anything is unclear, please get in touch — you will find our contact details right in the first section.
1. Who we are and how to contact us
The controller of your personal data (that is, the party that decides why and how your data is handled) is:
Invest Center s.r.o.
Vojtěšská 211/6, 110 00 Praha 1, Czech Republic
IČO (company registration number): 03787184
not registered for VAT
Invest Center s.r.o. operates this website, the entire booking and administration system and the training courses themselves under the PDR Academy brand. "PDR Academy" is a trading name, not a separate company. Invest Center s.r.o. is also the controller for the visitor statistics and ad measurement on this website (section 4.11).
Contact for anything concerning personal data:
| info@pdracademy.eu | |
| Telephone | +420 605 100 600 |
| Address | Invest Center s.r.o., Vojtěšská 211/6, 110 00 Praha 1 |
| Course venue | Průmyslová 357, 252 50 Vestec, Praha-západ |
A contact person for personal data protection is available at the details above. We have not appointed a data protection officer (a "DPO") — the law does not require us to, because we do not meet the conditions of Article 37 of the GDPR (we are not a public authority, we do not systematically monitor large numbers of people, and we do not process sensitive data on a large scale).
The second company you will come across: for some customers, invoices are issued by Renove Cars s.r.o., Průmyslová 357, 252 50 Vestec, IČO 24843342, registered for VAT. We pass your invoicing details to that company — it is therefore a recipient of your data, not a controller. Details are in section 4.
2. What data we process and where we get it from
We have broken this down by the situations in which you may come into contact with us. We obtain most of the data directly from you — you give it to us in a form, in an e-mail, or you tell us over the telephone.
2.1 Course booking made through the website
When you complete the booking form, we process:
- first name and surname,
- e-mail and telephone number,
- address (street, town, postcode, country),
- company details if you are booking on behalf of a business — company name, IČO (company registration number), DIČ (VAT number), registered office,
- the course date you have selected,
- the text of any note you write in the form (please note — this note is also processed by our AI assistant, see section 4),
- technical details of the form submission (date and time, IP address) — for security reasons and to evidence that the booking really did arrive,
- the status of the booking and our internal note (e.g. "confirmed", "awaiting payment").
2.2 Running of the course
During the course and in connection with it, the following arise:
- a record of attendance,
- your signature on the attendance sheet or on contractual documentation,
- assessment and feedback, if you provide it,
- a record of the certificate issued (name, certificate number, date of issue, course completed),
- consent to entry in the database of certified technicians, if you give it to us, and a record of when and how you gave it (or when you withdrew it) — see chapter 6,
- photographs and video from the course — only if you give us your consent, see section 5,
- login details for the student portal (e-mail, secure password hash, a one-time password-reset link and a record that it was sent),
- if you switch on notifications in the portal: the technical address for delivering them, assigned by your browser's service, its encryption keys and the time it was last used,
- the time of the first and most recent login to the portal and the first and most recent opening of the training-materials section. We do not measure time spent, individual clicks or the specific content read.
2.3 Invoicing and payment
- invoicing name or company name, address, IČO (company registration number), DIČ (VAT number),
- the details shown on the invoice — number, amount, date of issue and due date, variabilní symbol (the payment reference number used in Czech bank transfers),
- information about the payment received, taken from the bank statement (amount, date, payment reference, counterparty account and the payer's name as shown by the bank on the statement),
- any details of a refund or a cancellation fee.
You always pay by bank transfer on the basis of an invoice, before the course takes place. We do not use any payment gateway — you never enter a card number with us and we never see one.
2.4 Chat with the AI assistant on the website
There is a chat bubble with an AI assistant on the website. We process:
- the entire content of the conversation — everything you type into the chat,
- contact details that the assistant asks you for during the conversation (typically name, e-mail, telephone), if you provide them,
- the conversation identifier, which your browser keeps only until you close the tab and which is created only with your first message (section 7), and technical data (date, time).
⚠️ Important: the content of the chat is processed on the servers of Anthropic PBC in the USA, that is outside the European Union. We explain this in detail in section 4. Please therefore do not enter sensitive data into the chat (health information, birth number, passwords, payment card numbers).
2.5 E-mail to info@pdracademy.eu
When you write to us by e-mail, we process your e-mail address, name, subject line and the entire content of the message including attachments.
⚠️ Important: an AI assistant helps to answer e-mails delivered to info@pdracademy.eu. This means that the content of your e-mail is passed to Anthropic PBC in the USA (outside the EU). See section 4. If you do not wish this to happen, say so in your e-mail, telephone us, or use the post — we will deal with the matter without the assistant.
2.6 People interested in a course (marketing)
If you give us your consent to receive information about courses and available dates, we keep your name, e-mail, and possibly your telephone number and a note about what you are interested in. Consent is voluntary and you can withdraw it at any time — by replying to any of our e-mails, or by messaging info@pdracademy.eu.
2.7 Visiting the website
During an ordinary visit to the website, operational records (logs) are stored on the server: IP address, date and time, the address of the page visited, browser type. These serve to run and secure the website — so that we can spot an attack or an error.
Visitor statistics and ad measurement — only with your consent. On your first visit the website asks you in a cookie banner (section 7). Until you consent, the Google measurement code is not loaded at all and nothing is sent from the website to Google. If you consent, we use:
- Google Analytics (the "Visitor statistics" option) — aggregate statistics on how many people visit the website, where they come from and what interests them on it. Google thereby learns an identifier stored in a cookie, the pages visited and the time of the visit, where you came from (for example from a search engine or from our ad), the type of device and browser, the language, your approximate location (country and city, derived from the IP address) and what you do on the website — for example that you submitted a booking or clicked on the telephone number or e-mail address.
- Google Ads (the "Ad measurement" option) — so that we know how many bookings came from our Google ads. Google thereby learns an identifier stored in a cookie, the IP address, the type of browser and device, the pages visited, where you came from (for example a click on an ad) and that you submitted a booking. When you submit a booking, Google may also receive an irreversible fingerprint (a so-called hash) of your e-mail address and telephone number, and possibly of your name and address — so-called enhanced conversions, described in detail in section 4.11.
We do not send your name, e-mail address, telephone number, address or the text of the note from the booking to Google in readable form. We do not use remarketing or personalised advertising — we do not use data from the website to show you our ads elsewhere on the internet, and we expressly prohibit Google from doing so in the measurement code. The Google measurement code is not loaded in the student portal, in the administration or on the certificate verification pages.
There is no reCAPTCHA and no payment gateway on the website. Fonts are loaded from our own server and the map opens only when you click on the link.
2.8 Data obtained from someone other than you
Exceptionally, we also obtain data from elsewhere:
- from your employer, when a company books you onto a course (in which case we process your name, contact details and attendance),
- from a bank statement — the payer's name and the counterparty account number, when you send us a payment,
- from public registers (ARES, the Czech register of VAT payers) — verification of the company registration number, VAT number and registered office, so that the invoice is correct.
2.9 Automated decision-making
We do not carry out any automated decision-making or profiling that would have legal effects for you. The AI assistant helps you with information and prepares background material, but it does not decide anything on its own about your booking, the price or anything else — a human always makes that decision.
3. Why we process data and on what basis
A legal basis is the reason that, under the GDPR, allows us to work with your data. We have four:
- performance of a contract — without this data we cannot book you onto a course and provide the course to you,
- legal obligation — we must do so by law (typically tax and accounting),
- legitimate interest — we have a reasonable reason (for example, so that we can defend ourselves if a dispute arises); you may object to this,
- consent — we do it only because you have allowed us to; you can withdraw it at any time.
| Purpose (why) | Data | Legal basis | For how long |
|---|---|---|---|
| Receiving the booking, reserving a place, confirming the date | name, contact details, address, company details, course date, note | performance of a contract (Art. 6(1)(b)) | 10 years from the course |
| Running the course, attendance, communication with the participant | name, contact details, attendance, signature | performance of a contract (Art. 6(1)(b)) | 10 years from the course |
| Issuing the invoice, receiving payment, accounting, taxes | invoicing details, amount, payment from the bank statement | legal obligation (Art. 6(1)(c)) | 10 years from the end of the tax period |
| Refunds, cancellation fees, change of course date | name, contact details, payment details, date of cancellation | performance of a contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c)) | 10 years |
| Issuing and recording the certificate, verifying its authenticity | name, certificate number and date, course | legitimate interest (Art. 6(1)(f)) — to evidence that the certificate is genuine | 10 years |
| Operational SMS about your booking and course (confirmation, reminder of the date, notice about a contract) | name, telephone number, text of the message | legitimate interest (Art. 6(1)(f)) — to inform you about your own order in good time | 12 months from sending |
| Running the student portal (access to materials, certificate, photograph from the presentation and proportionate follow-up support) | e-mail, secure password hash, one-time password-reset link, record that it was sent, first and most recent login and opening of the materials section; if you switch on notifications, the technical address for delivering them | performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) — ensuring the portal works and avoiding support messages sent without context | for as long as portal access lasts, thereafter as per the course record |
| Answering enquiries — e-mail, telephone, chat with the assistant | name, contact details, content of the message or conversation | performance of a contract (Art. 6(1)(b)) where the enquiry concerns a booking; otherwise legitimate interest (Art. 6(1)(f)) — to reply to an enquirer | chat 12 months; e-mails according to their nature — business correspondence relating to a course 10 years |
| Feedback and course evaluation | evaluation, comment, name | legitimate interest (Art. 6(1)(f)) — improving our teaching | 10 years (as part of the course documentation) |
| Defending and pursuing legal claims (dispute, complaint) | depending on the situation, all documentation relating to the case | legitimate interest (Art. 6(1)(f)) | until the end of the limitation period, as a rule 10 years |
| Security of the website and system, protection against attacks and misuse | IP address, operational logs, login records | legitimate interest (Art. 6(1)(f)) | 6 to 12 months |
| Information about courses and available dates for interested people | name, e-mail, telephone | consent (Art. 6(1)(a)) | until consent is withdrawn, at most 3 years |
| Photographs and video from the course on the website and social media | image, name (if you wish) | consent (Art. 6(1)(a)) | until consent is withdrawn |
| Publication in the database of certified technicians (verification of qualification) | first name and surname, level, certificate number, month and year of issue | consent (Art. 6(1)(a)) | until consent is withdrawn or until removal from the database |
| Proof that consent to publication was given and, where applicable, withdrawn | name, e-mail, date and manner of giving or withdrawing consent | legal obligation (Art. 6(1)(c)) — the GDPR requires us to be able to demonstrate consent | for the duration of the entry in the database and 3 years afterwards |
| Unprocessed or cancelled bookings | name, contact details, course date | legitimate interest (Art. 6(1)(f)) — to evidence how the negotiations proceeded | 12 months, then anonymisation |
| Website visitor statistics (Google Analytics) | identifier in a cookie, pages visited, where you came from, device and browser, approximate location, events on the website (e.g. submitting a booking) | consent (Art. 6(1)(a)) and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications | cookies at most 180 days from your last visit; data on individual visits in Google Analytics at most 14 months |
| Measuring the effectiveness of advertising (Google Ads), including enhanced conversions | identifier in a cookie, IP address, device and browser, click on an ad, submission of a booking, irreversible fingerprint (hash) of the e-mail address and telephone number, possibly of the name and address | consent (Art. 6(1)(a)) and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications | cookies at most 90 days from your last visit; at Google according to its policies |
| Remembering your choice in the cookie banner (proof of consent) | what you allowed, the date and the version of the banner — stored only in your browser | legal obligation (Art. 6(1)(c)) — the GDPR requires us to be able to demonstrate consent (Art. 7(1)) | 6 months |
| Training videos in the student portal (YouTube) | IP address, browser and device data | performance of a contract (Art. 6(1)(b)) — the videos are part of the training materials | we store nothing; at Google according to its policies |
What happens if you do not provide the data: we need the data marked as mandatory in the booking form in order to enter into a contract with you and provide the course. Without it we unfortunately cannot register you. Consent to photographs, to marketing e-mails and to entry in the database of certified technicians, on the other hand, is entirely voluntary — not giving it has no effect on your participation in the course, on the price or on the issuing of your certificate. Consent to visitor statistics and ad measurement is voluntary too: the website, including the booking form, works exactly the same without it.
4. Who we pass data on to
We do not sell your data. We pass it only to those who help us deliver the service, to those to whom the law requires us to pass it, and to Google — for visitor statistics and ad measurement only with your consent in the cookie banner, and for the training videos in the student portal when they are displayed (section 4.11).
4.1 WEDOS Internet, a.s. — hosting
IČO 28115708, Hluboká nad Vltavou, Czech Republic.
Operates the servers on which our website, database and e-mail boxes run. It is our processor (it acts only on our instructions and does nothing with the data on its own account). The data stays in the Czech Republic.
4.2 ⭐ Anthropic PBC (USA) — AI assistant (transfer outside the EU)
We use an AI assistant built on technology from the US company Anthropic PBC. We want to be honest about exactly what goes there:
- the content of the chat on the website — everything you write to the assistant, including the contact details it asks you for,
- the text of the note from the booking form,
- the content of e-mails delivered to info@pdracademy.eu, because the assistant helps to prepare replies — including your e-mail address, name and attachments,
- the content of incoming invoices from our suppliers that we upload into the system (the assistant automatically reads the details out of them) — this concerns our suppliers, not course participants.
What "transfer outside the EU" means: your data leaves the European Union and is processed on servers in the USA. Personal data protection there works under different rules from ours and, in an extreme case, it may be more difficult to enforce your rights. That is why we are informing you about it in this much detail.
The transfer is safeguarded by standard contractual clauses approved by the European Commission (a model contract created by the EU precisely for transfers of data to countries outside the EU) within the terms and conditions of Anthropic PBC, which also include a data processing agreement. We will provide you with a copy of the clauses on request.
How you can avoid it: do not use the chat on the website — write to us by post or telephone +420 605 100 600 instead. If you are writing to us by e-mail and do not want the assistant to process it, please say so in your message — we will handle it manually.
4.3 Renove Cars s.r.o. — invoicing
IČO 24843342, Průmyslová 357, 252 50 Vestec. For some customers, invoices are issued by this company (it is registered for VAT, so it adds 21 % VAT to the price). We pass it your invoicing details and information about the course booked and the payment. It is also the company at whose address the courses take place.
4.4 Raiffeisenbank a.s. — payments
Our bank. It handles payment transactions and provides us with bank statements, which we use to match payments received against invoices.
4.5 Accountant and tax adviser
Handles our bookkeeping and tax returns. Receives your invoicing details and the invoices. Bound by a duty of confidentiality.
4.6 The provider of the mailbox of the invoice recipient
If your invoice is sent to you by e-mail, it passes through the mail server of your e-mail provider. That is a normal part of delivering a message.
4.7 Public authorities
The tax office, courts, the Czech Police, the ČOI (Czech Trade Inspection Authority), the ÚOOÚ (Czech Data Protection Authority) and similar bodies — where the law requires it of us, or where we need it in order to defend a claim.
4.8 Anyone on the internet — public verification of a certificate
This concerns only certified technicians who have given us their consent to be entered in the database of certified technicians. For them the recipient is effectively anyone on the internet — the verification page is public, so a query may be made even by someone outside the European Union. We cannot restrict that in any way; that is why we write about it this openly.
What is published is only the first name and surname, the level, the certificate number and the month and year of issue. Nothing more — no address, company registration number, telephone, e-mail or photograph. Only a specific certificate can ever be verified: its number together with the technician's surname must be entered. There is no list of technicians to browse anywhere and the database cannot be downloaded.
The legal basis is solely your consent (Art. 6(1)(a)). That consent is also what permits the data to leave the EU (Art. 49(1)(a) GDPR) — which is why standard contractual clauses, as with Anthropic, are not needed here. Entry is not a condition for issuing the certificate and you can cancel it at any time; chapter 6 describes this in detail.
4.9 BulkGate (TOPefekt s.r.o.) — sending SMS
Company ID 27772307, Šumperk, Czech Republic.
When we send you an operational SMS (confirmation of attendance, a reminder of the date, a notice that a contract is waiting in the portal), we pass this company your telephone number and the text of the message. It is our processor — it acts only on our instructions and does nothing with the data on its own. The data stays within the European Union.
We send only operational messages relating to your booking or course, never advertising. We never put anything in an SMS that a stranger should not see — no amounts, no login links, no payment details.
Do not want SMS? Write to info@pdracademy.eu and we will stop sending them. Nothing changes about e-mails — you will still receive everything important there.
4.10 What we DO NOT use
So that it is clear what does not happen here:
- ❌ no statistics or ad measurement without your consent — Google Analytics and Google Ads are loaded only if you allow them in the cookie banner (section 4.11),
- ❌ no remarketing or personalised advertising,
- ❌ no social media pixels (Facebook, Instagram and the like),
- ❌ no payment gateway — you do not enter card details with us,
- ❌ no reCAPTCHA or similar third-party verification,
- ❌ fonts are loaded from our own server and the map is just a link — it opens only when you click on it,
- ❌ we do not sell or rent your data to anyone.
4.11 Google — visitor statistics, ad measurement and videos in the portal (transfer outside the EU)
Who: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its parent company is Google LLC, Mountain View, California, USA.
When: we use visitor statistics (Google Analytics) and ad measurement (Google Ads) only if you allow them in the cookie banner — each one separately. Without consent the Google measurement code is not loaded on the website at all. YouTube videos are loaded only in the student portal (see below).
What Google receives: the data described in section 2.7. We do not send your name, e-mail address, telephone number, address or the text of the note from the booking to Google in readable form. According to Google, Google Analytics does not store the IP address — it uses it only to estimate your approximate location.
Enhanced conversions (only with the "Ad measurement" option): so that we can recognise a booking that came from an ad even if you saw the ad on a different device, we use the Google Ads "enhanced conversions" feature. When you submit a booking, the Google measurement code may take your e-mail address and telephone number (and possibly your name and address) from the form, convert them, while still in your browser, into an irreversible fingerprint (a SHA-256 hash) and send only this fingerprint to Google. Google compares it with the fingerprints of the data of users signed in to its services; if they match, it counts the booking for us as a result of the ad. The e-mail address or telephone number cannot be read from the fingerprint.
Google's role: for Google Analytics, Google processes the data on our behalf as our processor under its data processing terms. For ad measurement in Google Ads, Google also uses the data for its own purposes in accordance with its policies (for example to protect against fraud and to improve its services) — to that extent it is an independent controller. Google Analytics is linked to our Google Ads account so that we can see which ads lead to bookings.
No remarketing: ad personalisation is permanently switched off in our measurement code. Google may not use data from our website to show you our ads elsewhere on the internet.
Transfer to the USA: Google may also process the data on servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework. By Decision (EU) 2023/1795, the European Commission recognised that certified companies ensure an adequate level of protection. Google also uses standard contractual clauses approved by the European Commission for this purpose.
How to switch measurement off: via the Cookie settings link in the website footer — you can withdraw consent as easily as you gave it. Deleting cookies in your browser also helps.
Videos in the student portal (YouTube): training materials in the portal may contain a video embedded from YouTube, a Google service. We use the privacy-enhanced mode (youtube-nocookie.com). When a video is displayed on the materials page, your browser loads the player from Google's servers — Google thereby learns your IP address, browser and device data and which website the player is being loaded from. As soon as the player loads, YouTube may store its own data in your browser according to its rules. This concerns only students signed in to the portal, not the public website.
More about how Google handles data: Google Privacy Policy and How Google uses information from sites or apps that use its services.
5. Photographs and video from the course
We sometimes take photographs and film during courses. A simple rule applies:
- We use photographs and video in which you are identifiable on the website and on social media only if you give us your consent to do so.
- Consent is entirely voluntary, it is not a condition of attending the course and it has no effect on the price or on anything else.
- You can withdraw your consent at any time — simply write to info@pdracademy.eu. We will then take the photograph down from the website and from our social media profiles. Withdrawal takes effect for the future; we cannot do anything about already published posts that someone has downloaded or shared in the meantime.
- If we are photographing a group and you do not want to be in the picture, just say so at the time — we will respect that.
The photograph from the certificate presentation is a different matter. We upload that one to your student portal so that you have it available. That is part of the service we promised you (performance of the contract) — we do not publish it anywhere, only you can see it. Publishing it on the website or on social media would, again, require your consent.
6. Database of certified technicians
Anyone who obtains a certificate from us may be entered in the database of certified technicians. It has a single purpose: to let a customer, a body shop or an insurance company verify that a certificate is genuine and what level it is.
How verification works. It is not a list to browse. Anyone wishing to verify a certificate must enter the certificate number and the technician's surname together — only then do they get an answer. The database cannot be browsed or downloaded, and the page is configured so that search engines do not index it.
What is shown about you:
- first name and surname,
- certificate level (Junior, Senior, Master),
- certificate number,
- month and year of issue.
What is not shown: address or town, company registration number, telephone, e-mail, photograph, course assessment. None of that appears on the verification page and it cannot be found out there.
Entry is voluntary. We will enter you only if you give us your consent. Consent is not a condition for issuing the certificate and has no effect on the price or on anything else. If you do not give it, you will receive your certificate just the same — it simply will not be publicly verifiable.
You can withdraw your consent at any time. Just write to info@pdracademy.eu; you do not have to give any reason. We will remove the record from the database within 5 working days at the latest.
Withdrawal has no effect on the validity of the certificate. The certificate remains yours — both the paper and the record in our internal register remain valid. It simply ceases to be publicly verifiable.
Removal from the database. An entry may also end because we remove you from the database — for example if you do not take the voluntary re-examination. Even then, the certificate does not cease to exist; only the public traceability disappears.
⚠️ Both withdrawal of consent and removal take effect going forward. Whatever someone has copied or saved from the internet in the meantime is beyond our control — the same as with photographs.
We keep a record of your consent. The GDPR requires us to be able to demonstrate that consent was given. We therefore keep a record of when and how you gave your consent, and of when you withdrew it. How long we keep it is set out in chapter 8.
7. Cookies and what the website remembers
Cookies are small files that a website stores in your browser. Browser storage (localStorage and sessionStorage) works in a similar way — we list it here as well.
Cookie banner. On your first visit the website asks you in a cookie banner. It has three buttons of the same size: Accept all, Reject all and Settings, where you can allow visitor statistics and ad measurement each one separately. Nothing optional is switched on in advance, and until you choose, no Google measurement code is loaded. The website, including the booking form, works the same whether you consent or not. You can change your choice or withdraw your consent at any time via the Cookie settings link in the website footer; after withdrawal the website deletes the Google cookies on our domain, together with any entries Google may have saved in browser storage (e.g. _gcl_ls). After 6 months, or when something requiring consent is added to the website, the website will ask you again.
Essential — the website does not work without them; the law does not require consent for them:
| What the website stores | What it is for | For how long |
|---|---|---|
pdr_admin (cookie) | created when you visit the website; protects the booking form against forged requests from other websites and keeps you logged in to the administration | until the browser is closed |
pdr_portal (cookie) | to keep you logged in to the student portal | until you log out or close the browser |
site_lang (cookie) | the selected language; created when you switch the language or open a language version of the website | 1 year |
pdr_souhlas (cookie) | your choice in the cookie banner (what you allowed, when and in which version of the banner), so that the banner does not appear on every page | 6 months |
pdr_bot_session (browser storage) | the chat conversation identifier, so that the messages follow on from one another; created only with your first message | until the browser tab is closed |
pdr-theme (browser storage) | the light or dark appearance of the student portal and the administration | until you delete it |
pdr-app-nab-skryto (browser storage) | that you closed the offer to install the portal on your phone | 6 months |
| Notifications from the portal (script in the browser) | when you open the overview, the portal registers a small script in your browser that can deliver notifications; the notifications themselves are switched on only once you allow them in the portal. To deliver them, your browser uses its manufacturer's service (e.g. Google, Apple, Mozilla), through which we send only an empty signal with no content | the script until the browser or you remove it; notifications until you switch them off |
Only with your consent in the cookie banner:
| What the website stores | Who and what for | For how long |
|---|---|---|
_ga, _ga_… (cookies) | Google Analytics, "Visitor statistics" option: distinguishes visitors and visits for aggregate statistics | at most 180 days from your last visit |
_gcl_au, _gcl_aw, possibly other _gcl_… and _gac_… (cookies) | Google Ads, "Ad measurement" option: links a click on our ad with a submitted booking | at most 90 days from your last visit |
In addition, Google may use its own cookies on its own domains (for example when you are signed in to a Google account) — these are governed by its policies (links in section 4.11). The YouTube player in the student portal is also described in section 4.11.
You can delete or block cookies at any time in your browser settings. If you also block the essential cookies, it will not be possible to submit a booking from the website, to log in to the administration or to the student portal, and the chat will not remember the course of the conversation.
8. How long we keep data
We do not keep data for longer than is necessary. Once the period expires, we securely delete it or anonymise it (we remove everything from it that could identify who it relates to — only impersonal statistics remain).
| What | For how long | Why that long |
|---|---|---|
| Invoices and tax documents | 10 years from the end of the tax period | the Czech VAT Act and Accounting Act |
| Booking, contract, attendance, evaluation, signatures | 10 years | evidencing the contract and how the course proceeded, defence of claims |
| Record of certificates issued | 10 years | so that we can confirm that your certificate is genuine |
| Unprocessed and cancelled bookings | 12 months, then anonymisation | evidencing how the negotiations proceeded |
| Database of interested people (marketing) | until consent is withdrawn, at most 3 years | consent should not last for ever |
| History of conversations with the AI assistant | 12 months | following on from an earlier enquiry, quality of answers |
| Operational logs and IP addresses | 6 to 12 months | security, resolving errors and attacks |
| Visitor statistics cookies (Google Analytics) | at most 180 days from your last visit; data on individual visits in Google Analytics at most 14 months | so that repeat visits can be distinguished; if you withdraw consent, the website deletes these cookies (and similar Google entries in browser storage) immediately, and if your choice expires after 6 months, it deletes them on your next visit |
| Ad measurement cookies (Google Ads) | at most 90 days from your last visit | the period during which a booking can be attributed to a click on an ad; after consent is withdrawn or the choice expires, the website deletes them in the same way as the statistics cookies, including entries in browser storage (e.g. _gcl_ls) |
| Your choice in the cookie banner | 6 months | after that the website asks you again |
| Consent to photographs and its withdrawal | this one consent we ask for verbally during the course and keep no record of it; if you tell us you do not want a photograph, we take it down. This applies to photographs only — consent to entry in the database of certified technicians we do record, see the rows below | we only photograph a small group of people we know by name, so a separate database of photograph consents would serve no purpose |
| Entry in the public database of technicians | until consent is withdrawn or until removal from the database | the entry should last only as long as the technician wants it to |
| Proof of consent to publication and of its withdrawal | for the duration of the entry and 3 years afterwards | the GDPR requires us to be able to demonstrate that consent was given (or withdrawn) |
If a dispute or an inspection begins, we will keep the data concerned until it is finally concluded, even if that takes longer.
9. Your rights and how to exercise them
You have the following rights in relation to us:
| Right | What it means |
|---|---|
| Access | You can ask whether we process anything about you and request a copy of your data. |
| Rectification | Where something is wrong or incomplete, we will correct or complete it. |
| Erasure (the "right to be forgotten") | You can ask for deletion. However, this is not possible for data we are required by law to keep — invoices, for example. |
| Restriction of processing | You can ask us to "freeze" the data and merely store it — for example, until it is resolved whether it is accurate. |
| Portability | Data that you have given us and that we process by automated means on the basis of a contract or consent will be provided to you in a machine-readable format (or sent elsewhere). |
| Objection | You may object to processing based on legitimate interest. We will then stop the processing, unless we have compelling reasons to continue. An objection against marketing always prevails — we will stop immediately. |
| Withdrawal of consent | You can withdraw consent (photographs, marketing, entry in the database of certified technicians, visitor statistics and ad measurement on the website) at any time. Processing carried out up to that point remains lawful; we will stop going forward. We will remove the entry from the database of technicians within 5 working days at the latest; the certificate does not cease to be valid. You can switch off statistics and ad measurement yourself via the Cookie settings link in the website footer. |
| Complaint to the authority | You may turn to the supervisory authority, see below. |
How to exercise a right: write to info@pdracademy.eu, telephone +420 605 100 600, or send a letter to Invest Center s.r.o., Vojtěšská 211/6, 110 00 Praha 1. A simple message is enough; no form is needed.
Identity verification: so that we do not give your data to someone else by mistake, we may verify that it really is you — usually it is enough if you write from the e-mail address we have on your booking, or provide a detail that only the two of us know (for example an invoice number).
When we will reply: at the latest within 1 month of receiving the request. In complex cases we may extend the period by a further 2 months — we will always inform you of the extension and the reason for it. Handling the request is free of charge; for manifestly unfounded or repetitive requests we may charge a reasonable fee or refuse the request.
Complaint to the supervisory authority:
Úřad pro ochranu osobních údajů (the Czech Data Protection Authority)
Pplk. Sochora 27, 170 00 Praha 7
web: uoou.gov.cz
We would be glad if you gave us the chance to resolve the matter directly first — but you always have the right to turn to the authority, without any conditions.
10. How we protect data
We take this seriously. In general:
- The whole website and the administration run exclusively over an encrypted connection (HTTPS) — nobody can read the data between you and our server along the way.
- Only a verified user can get into the administration and the student portal; everyone sees only what they are authorised to see.
- Sensitive operational data (access passwords, keys) is stored outside the public part of the website and is not accessible from the internet.
- Documents such as invoices and certificates are stored outside publicly accessible folders — they cannot be reached simply by guessing an address.
- Only a small circle of people has access to the data, those who need it for their work, and they are bound by a duty of confidentiality.
- We run regular backups and keep records of important operations in the system.
- We update the software regularly and check the security settings.
We deliberately do not publish the specific technical details of our security — describing them would in itself be a manual for an attacker.
If a leak were nevertheless to occur: if there were a security breach with a high risk to your rights, we will notify you and the Úřad pro ochranu osobních údajů (the Czech Data Protection Authority) without undue delay, as the GDPR requires of us.
11. Changes to this policy
The system and the services develop, so we may amend this policy from time to time — for instance when a new feature is added or a supplier changes.
- The current wording is always available on this website; at the top you will find the effective date and version number.
- In the event of a material change (for example a new recipient of data, a new purpose of processing or a longer retention period) we will notify you in advance — by e-mail to the address we have for you, or by a prominent notice on the website.
- Changes never have retroactive effect: data we have already processed under an earlier wording remains processed under that wording.
- We will send you previous versions on request.
Do you have a question or a comment about this document? Write to info@pdracademy.eu or telephone +420 605 100 600. We will be happy to explain everything in plain language.