Personal Data Processing Policy
PDR Academy — training courses in PDR technology
Effective from: 13. 8. 2026
Version: 1.1
This document explains what personal data we process about you, why we do it, how long we keep it and what rights you have. We have tried to write it in plain language. If anything is unclear, please get in touch — you will find our contact details right in the first section.
1. Who we are and how to contact us
The controller of your personal data (that is, the party that decides why and how your data is handled) is:
Invest Center s.r.o.
Vojtěšská 211/6, 110 00 Praha 1, Czech Republic
IČO (company registration number): 03787184
not registered for VAT
Invest Center s.r.o. operates this website, the entire booking and administration system and the training courses themselves under the PDR Academy brand. "PDR Academy" is a trading name, not a separate company.
Contact for anything concerning personal data:
| info@pdracademy.eu | |
| Telephone | +420 605 100 600 |
| Address | Invest Center s.r.o., Vojtěšská 211/6, 110 00 Praha 1 |
| Course venue | Průmyslová 357, 252 50 Vestec, Praha-západ |
A contact person for personal data protection is available at the details above. We have not appointed a data protection officer (a "DPO") — the law does not require us to, because we do not meet the conditions of Article 37 of the GDPR (we are not a public authority, we do not systematically monitor large numbers of people, and we do not process sensitive data on a large scale).
The second company you will come across: for some customers, invoices are issued by Renove Cars s.r.o., Průmyslová 357, 252 50 Vestec, IČO 24843342, registered for VAT. We pass your invoicing details to that company — it is therefore a recipient of your data, not a controller. Details are in section 4.
2. What data we process and where we get it from
We have broken this down by the situations in which you may come into contact with us. We obtain most of the data directly from you — you give it to us in a form, in an e-mail, or you tell us over the telephone.
2.1 Course booking made through the website
When you complete the booking form, we process:
- first name and surname,
- e-mail and telephone number,
- address (street, town, postcode, country),
- company details if you are booking on behalf of a business — company name, IČO (company registration number), DIČ (VAT number), registered office,
- the course date you have selected,
- the text of any note you write in the form (please note — this note is also processed by our AI assistant, see section 4),
- technical details of the form submission (date and time, IP address) — for security reasons and to evidence that the booking really did arrive,
- the status of the booking and our internal note (e.g. "confirmed", "awaiting payment").
2.2 Running of the course
During the course and in connection with it, the following arise:
- a record of attendance,
- your signature on the attendance sheet or on contractual documentation,
- assessment and feedback, if you provide it,
- a record of the certificate issued (name, certificate number, date of issue, course completed),
- consent to entry in the database of certified technicians, if you give it to us, and a record of when and how you gave it (or when you withdrew it) — see chapter 6,
- photographs and video from the course — only if you give us your consent, see section 5,
- login details for the student portal (e-mail, secure password hash, a one-time password-reset link and a record that it was sent),
- the time of the first and most recent login to the portal and the first and most recent opening of the training-materials section. We do not measure time spent, individual clicks or the specific content read.
2.3 Invoicing and payment
- invoicing name or company name, address, IČO (company registration number), DIČ (VAT number),
- the details shown on the invoice — number, amount, date of issue and due date, variabilní symbol (the payment reference number used in Czech bank transfers),
- information about the payment received, taken from the bank statement (amount, date, payment reference, counterparty account and the payer's name as shown by the bank on the statement),
- any details of a refund or a cancellation fee.
You always pay by bank transfer on the basis of an invoice, before the course takes place. We do not use any payment gateway — you never enter a card number with us and we never see one.
2.4 Chat with the AI assistant on the website
There is a chat bubble with an AI assistant on the website. We process:
- the entire content of the conversation — everything you type into the chat,
- contact details that the assistant asks you for during the conversation (typically name, e-mail, telephone), if you provide them,
- the conversation identifier stored in your browser and technical data (date, time).
⚠️ Important: the content of the chat is processed on the servers of Anthropic PBC in the USA, that is outside the European Union. We explain this in detail in section 4. Please therefore do not enter sensitive data into the chat (health information, birth number, passwords, payment card numbers).
2.5 E-mail to info@pdracademy.eu
When you write to us by e-mail, we process your e-mail address, name, subject line and the entire content of the message including attachments.
⚠️ Important: an AI assistant helps to answer e-mails delivered to info@pdracademy.eu. This means that the content of your e-mail is passed to Anthropic PBC in the USA (outside the EU). See section 4. If you do not wish this to happen, say so in your e-mail, telephone us, or use the post — we will deal with the matter without the assistant.
2.6 People interested in a course (marketing)
If you give us your consent to receive information about courses and available dates, we keep your name, e-mail, and possibly your telephone number and a note about what you are interested in. Consent is voluntary and you can withdraw it at any time — with a single click in every e-mail, or by messaging info@pdracademy.eu.
2.7 Visiting the website
During an ordinary visit to the website, operational records (logs) are stored on the server: IP address, date and time, the address of the page visited, browser type. These serve to run and secure the website — so that we can spot an attack or an error.
What is NOT on the website: no analytics (neither Google Analytics nor any other), no advertising or tracking pixels, no reCAPTCHA. Fonts and the map are loaded from our own server, so nothing about your visit goes to any third party.
2.8 Data obtained from someone other than you
Exceptionally, we also obtain data from elsewhere:
- from your employer, when a company books you onto a course (in which case we process your name, contact details and attendance),
- from a bank statement — the payer's name and the counterparty account number, when you send us a payment,
- from public registers (ARES, the Czech register of VAT payers) — verification of the company registration number, VAT number and registered office, so that the invoice is correct.
2.9 Automated decision-making
We do not carry out any automated decision-making or profiling that would have legal effects for you. The AI assistant helps you with information and prepares background material, but it does not decide anything on its own about your booking, the price or anything else — a human always makes that decision.
3. Why we process data and on what basis
A legal basis is the reason that, under the GDPR, allows us to work with your data. We have four:
- performance of a contract — without this data we cannot book you onto a course and provide the course to you,
- legal obligation — we must do so by law (typically tax and accounting),
- legitimate interest — we have a reasonable reason (for example, so that we can defend ourselves if a dispute arises); you may object to this,
- consent — we do it only because you have allowed us to; you can withdraw it at any time.
| Purpose (why) | Data | Legal basis | For how long |
|---|---|---|---|
| Receiving the booking, reserving a place, confirming the date | name, contact details, address, company details, course date, note | performance of a contract (Art. 6(1)(b)) | 10 years from the course |
| Running the course, attendance, communication with the participant | name, contact details, attendance, signature | performance of a contract (Art. 6(1)(b)) | 10 years from the course |
| Issuing the invoice, receiving payment, accounting, taxes | invoicing details, amount, payment from the bank statement | legal obligation (Art. 6(1)(c)) | 10 years from the end of the tax period |
| Refunds, cancellation fees, change of course date | name, contact details, payment details, date of cancellation | performance of a contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c)) | 10 years |
| Issuing and recording the certificate, verifying its authenticity | name, certificate number and date, course | legitimate interest (Art. 6(1)(f)) — to evidence that the certificate is genuine | 10 years |
| Operational SMS about your booking and course (confirmation, reminder of the date, notice about a contract) | name, telephone number, text of the message | legitimate interest (Art. 6(1)(f)) — to inform you about your own order in good time | 12 months from sending |
| Running the student portal (access to materials, certificate, photograph from the presentation and proportionate follow-up support) | e-mail, secure password hash, one-time password-reset link, record that it was sent, first and most recent login and opening of the materials section | performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) — ensuring the portal works and avoiding support messages sent without context | for as long as portal access lasts, thereafter as per the course record |
| Answering enquiries — e-mail, telephone, chat with the assistant | name, contact details, content of the message or conversation | performance of a contract (Art. 6(1)(b)) where the enquiry concerns a booking; otherwise legitimate interest (Art. 6(1)(f)) — to reply to an enquirer | chat 12 months; e-mails according to their nature — business correspondence relating to a course 10 years |
| Feedback and course evaluation | evaluation, comment, name | legitimate interest (Art. 6(1)(f)) — improving our teaching | 10 years (as part of the course documentation) |
| Defending and pursuing legal claims (dispute, complaint) | depending on the situation, all documentation relating to the case | legitimate interest (Art. 6(1)(f)) | until the end of the limitation period, as a rule 10 years |
| Security of the website and system, protection against attacks and misuse | IP address, operational logs, login records | legitimate interest (Art. 6(1)(f)) | 6 to 12 months |
| Information about courses and available dates for interested people | name, e-mail, telephone | consent (Art. 6(1)(a)) | until consent is withdrawn, at most 3 years |
| Photographs and video from the course on the website and social media | image, name (if you wish) | consent (Art. 6(1)(a)) | until consent is withdrawn |
| Publication in the database of certified technicians (verification of qualification) | first name and surname, level, certificate number, month and year of issue | consent (Art. 6(1)(a)) | until consent is withdrawn or until removal from the database |
| Proof that consent to publication was given and, where applicable, withdrawn | name, e-mail, date and manner of giving or withdrawing consent | legal obligation (Art. 6(1)(c)) — the GDPR requires us to be able to demonstrate consent | for the duration of the entry in the database and 3 years afterwards |
| Unprocessed or cancelled bookings | name, contact details, course date | legitimate interest (Art. 6(1)(f)) — to evidence how the negotiations proceeded | 12 months, then anonymisation |
What happens if you do not provide the data: we need the data marked as mandatory in the booking form in order to enter into a contract with you and provide the course. Without it we unfortunately cannot register you. Consent to photographs, to marketing e-mails and to entry in the database of certified technicians, on the other hand, is entirely voluntary — not giving it has no effect on your participation in the course, on the price or on the issuing of your certificate.
4. Who we pass data on to
We do not sell your data and we do not pass it to anyone for advertising purposes. We pass it only to those who help us deliver the service, or to those to whom the law requires us to pass it.
4.1 WEDOS Internet, a.s. — hosting
IČO 28115708, Hluboká nad Vltavou, Czech Republic.
Operates the servers on which our website, database and e-mail boxes run. It is our processor (it acts only on our instructions and does nothing with the data on its own account). The data stays in the Czech Republic.
4.2 ⭐ Anthropic PBC (USA) — AI assistant (transfer outside the EU)
We use an AI assistant built on technology from the US company Anthropic PBC. We want to be honest about exactly what goes there:
- the content of the chat on the website — everything you write to the assistant, including the contact details it asks you for,
- the text of the note from the booking form,
- the content of e-mails delivered to info@pdracademy.eu, because the assistant helps to prepare replies — including your e-mail address, name and attachments,
- the content of incoming invoices from our suppliers that we upload into the system (the assistant automatically reads the details out of them) — this concerns our suppliers, not course participants.
What "transfer outside the EU" means: your data leaves the European Union and is processed on servers in the USA. Personal data protection there works under different rules from ours and, in an extreme case, it may be more difficult to enforce your rights. That is why we are informing you about it in this much detail.
The transfer is safeguarded by standard contractual clauses approved by the European Commission (a model contract created by the EU precisely for transfers of data to countries outside the EU) within the terms and conditions of Anthropic PBC, which also include a data processing agreement. We will provide you with a copy of the clauses on request.
How you can avoid it: do not use the chat on the website — write to us by post or telephone +420 605 100 600 instead. If you are writing to us by e-mail and do not want the assistant to process it, please say so in your message — we will handle it manually.
4.3 Renove Cars s.r.o. — invoicing
IČO 24843342, Průmyslová 357, 252 50 Vestec. For some customers, invoices are issued by this company (it is registered for VAT, so it adds 21 % VAT to the price). We pass it your invoicing details and information about the course booked and the payment. It is also the company at whose address the courses take place.
4.4 Raiffeisenbank a.s. — payments
Our bank. It handles payment transactions and provides us with bank statements, which we use to match payments received against invoices.
4.5 Accountant and tax adviser
Handles our bookkeeping and tax returns. Receives your invoicing details and the invoices. Bound by a duty of confidentiality.
4.6 The provider of the mailbox of the invoice recipient
If your invoice is sent to you by e-mail, it passes through the mail server of your e-mail provider. That is a normal part of delivering a message.
4.7 Public authorities
The tax office, courts, the Czech Police, the ČOI (Czech Trade Inspection Authority), the ÚOOÚ (Czech Data Protection Authority) and similar bodies — where the law requires it of us, or where we need it in order to defend a claim.
4.8 Anyone on the internet — public verification of a certificate
This concerns only certified technicians who have given us their consent to be entered in the database of certified technicians. For them the recipient is effectively anyone on the internet — the verification page is public, so a query may be made even by someone outside the European Union. We cannot restrict that in any way; that is why we write about it this openly.
What is published is only the first name and surname, the level, the certificate number and the month and year of issue. Nothing more — no address, company registration number, telephone, e-mail or photograph. Only a specific certificate can ever be verified: its number together with the technician's surname must be entered. There is no list of technicians to browse anywhere and the database cannot be downloaded.
The legal basis is solely your consent (Art. 6(1)(a)). That consent is also what permits the data to leave the EU (Art. 49(1)(a) GDPR) — which is why standard contractual clauses, as with Anthropic, are not needed here. Entry is not a condition for issuing the certificate and you can cancel it at any time; chapter 6 describes this in detail.
4.9 BulkGate (TOPefekt s.r.o.) — sending SMS
Company ID 27772307, Šumperk, Czech Republic.
When we send you an operational SMS (confirmation of attendance, a reminder of the
date, a notice that a contract is waiting in the portal), we pass this company
your telephone number and the text of the message. It is our processor —
it acts only on our instructions and does nothing with the data on its own.
The data stays within the European Union.
We send only operational messages relating to your booking or course, never
advertising. We never put anything in an SMS that a stranger should not see —
no amounts, no login links, no payment details.
Do not want SMS? Write to info@pdracademy.eu and we will stop sending them.
Nothing changes about e-mails — you will still receive everything important there.
4.10 What we DO NOT use
So that it is clear what does not happen here:
- ❌ no traffic analytics (neither Google Analytics nor any other),
- ❌ no advertising or tracking pixels (Facebook, Google Ads and the like),
- ❌ no payment gateway — you do not enter card details with us,
- ❌ no reCAPTCHA or similar third-party verification,
- ❌ fonts and the map are loaded from our own server, so visiting the website sends nothing to Google,
- ❌ we do not sell or rent your data to anyone.
5. Photographs and video from the course
We sometimes take photographs and film during courses. A simple rule applies:
- We use photographs and video in which you are identifiable on the website and on social media only if you give us your consent to do so.
- Consent is entirely voluntary, it is not a condition of attending the course and it has no effect on the price or on anything else.
- You can withdraw your consent at any time — simply write to info@pdracademy.eu. We will then take the photograph down from the website and from our social media profiles. Withdrawal takes effect for the future; we cannot do anything about already published posts that someone has downloaded or shared in the meantime.
- If we are photographing a group and you do not want to be in the picture, just say so at the time — we will respect that.
The photograph from the certificate presentation is a different matter. We upload that one to your student portal so that you have it available. That is part of the service we promised you (performance of the contract) — we do not publish it anywhere, only you can see it. Publishing it on the website or on social media would, again, require your consent.
6. Database of certified technicians
Anyone who obtains a certificate from us may be entered in the database of certified technicians. It has a single purpose: to let a customer, a body shop or an insurance company verify that a certificate is genuine and what level it is.
How verification works. It is not a list to browse. Anyone wishing to verify a certificate must enter the certificate number and the technician's surname together — only then do they get an answer. The database cannot be browsed or downloaded, and the page is configured so that search engines do not index it.
What is shown about you:
- first name and surname,
- certificate level (Junior, Senior, Master),
- certificate number,
- month and year of issue.
What is not shown: address or town, company registration number, telephone, e-mail, photograph, course assessment. None of that appears on the verification page and it cannot be found out there.
Entry is voluntary. We will enter you only if you give us your consent. Consent is not a condition for issuing the certificate and has no effect on the price or on anything else. If you do not give it, you will receive your certificate just the same — it simply will not be publicly verifiable.
You can withdraw your consent at any time. Just write to info@pdracademy.eu; you do not have to give any reason. We will remove the record from the database within 5 working days at the latest.
Withdrawal has no effect on the validity of the certificate. The certificate remains yours — both the paper and the record in our internal register remain valid. It simply ceases to be publicly verifiable.
Removal from the database. An entry may also end because we remove you from the database — for example if you do not take the voluntary re-examination. Even then, the certificate does not cease to exist; only the public traceability disappears.
⚠️ Both withdrawal of consent and removal take effect going forward. Whatever someone has copied or saved from the internet in the meantime is beyond our control — the same as with photographs.
We keep a record of your consent. The GDPR requires us to be able to demonstrate that consent was given. We therefore keep a record of when and how you gave your consent, and of when you withdrew it. How long we keep it is set out in chapter 8.
7. Cookies and what the website remembers
Cookies are small files that a website stores in your browser.
We use only technically necessary cookies, without which the website would not work:
| What the website stores | What it is for | For how long |
|---|---|---|
| Login session — administration | to keep you logged in to the administration | until you log out / close the browser |
| Login session — student portal | to keep you logged in to the portal | until you log out / close the browser |
| Selected language | so that the website is displayed in the language you have chosen | 1 year |
| Chat conversation identifier | so that messages in the chat follow on from one another instead of always starting again | until the browser is closed |
That is why we do not ask you about cookies. The law requires consent only for cookies that are not technically necessary — typically tracking and advertising cookies. We do not use those, so there is nothing to consent to and we do not bother you with a pop-up banner.
You can delete or block cookies at any time in your browser settings. If you block them, it will not be possible to log in to the administration or to the student portal, and the chat will not remember the course of the conversation.
8. How long we keep data
We do not keep data for longer than is necessary. Once the period expires, we securely delete it or anonymise it (we remove everything from it that could identify who it relates to — only impersonal statistics remain).
| What | For how long | Why that long |
|---|---|---|
| Invoices and tax documents | 10 years from the end of the tax period | the Czech VAT Act and Accounting Act |
| Booking, contract, attendance, evaluation, signatures | 10 years | evidencing the contract and how the course proceeded, defence of claims |
| Record of certificates issued | 10 years | so that we can confirm that your certificate is genuine |
| Unprocessed and cancelled bookings | 12 months, then anonymisation | evidencing how the negotiations proceeded |
| Database of interested people (marketing) | until consent is withdrawn, at most 3 years | consent should not last for ever |
| History of conversations with the AI assistant | 12 months | following on from an earlier enquiry, quality of answers |
| Operational logs and IP addresses | 6 to 12 months | security, resolving errors and attacks |
| Consent to photographs and its withdrawal | this one consent we ask for verbally during the course and keep no record of it; if you tell us you do not want a photograph, we take it down. This applies to photographs only — consent to entry in the database of certified technicians we do record, see the rows below | we only photograph a small group of people we know by name, so a separate database of photograph consents would serve no purpose |
| Entry in the public database of technicians | until consent is withdrawn or until removal from the database | the entry should last only as long as the technician wants it to |
| Proof of consent to publication and of its withdrawal | for the duration of the entry and 3 years afterwards | the GDPR requires us to be able to demonstrate that consent was given (or withdrawn) |
If a dispute or an inspection begins, we will keep the data concerned until it is finally concluded, even if that takes longer.
9. Your rights and how to exercise them
You have the following rights in relation to us:
| Right | What it means |
|---|---|
| Access | You can ask whether we process anything about you and request a copy of your data. |
| Rectification | Where something is wrong or incomplete, we will correct or complete it. |
| Erasure (the "right to be forgotten") | You can ask for deletion. However, this is not possible for data we are required by law to keep — invoices, for example. |
| Restriction of processing | You can ask us to "freeze" the data and merely store it — for example, until it is resolved whether it is accurate. |
| Portability | Data that you have given us and that we process by automated means on the basis of a contract or consent will be provided to you in a machine-readable format (or sent elsewhere). |
| Objection | You may object to processing based on legitimate interest. We will then stop the processing, unless we have compelling reasons to continue. An objection against marketing always prevails — we will stop immediately. |
| Withdrawal of consent | You can withdraw consent (photographs, marketing, entry in the database of certified technicians) at any time. Processing carried out up to that point remains lawful; we will stop going forward. We will remove the entry from the database of technicians within 5 working days at the latest; the certificate does not cease to be valid. |
| Complaint to the authority | You may turn to the supervisory authority, see below. |
How to exercise a right: write to info@pdracademy.eu, telephone +420 605 100 600, or send a letter to Invest Center s.r.o., Vojtěšská 211/6, 110 00 Praha 1. A simple message is enough; no form is needed.
Identity verification: so that we do not give your data to someone else by mistake, we may verify that it really is you — usually it is enough if you write from the e-mail address we have on your booking, or provide a detail that only the two of us know (for example an invoice number).
When we will reply: at the latest within 1 month of receiving the request. In complex cases we may extend the period by a further 2 months — we will always inform you of the extension and the reason for it. Handling the request is free of charge; for manifestly unfounded or repetitive requests we may charge a reasonable fee or refuse the request.
Complaint to the supervisory authority:
Úřad pro ochranu osobních údajů (the Czech Data Protection Authority)
Pplk. Sochora 27, 170 00 Praha 7
web: uoou.gov.cz
We would be glad if you gave us the chance to resolve the matter directly first — but you always have the right to turn to the authority, without any conditions.
10. How we protect data
We take this seriously. In general:
- The whole website and the administration run exclusively over an encrypted connection (HTTPS) — nobody can read the data between you and our server along the way.
- Only a verified user can get into the administration and the student portal; everyone sees only what they are authorised to see.
- Sensitive operational data (access passwords, keys) is stored outside the public part of the website and is not accessible from the internet.
- Documents such as invoices and certificates are stored outside publicly accessible folders — they cannot be reached simply by guessing an address.
- Only a small circle of people has access to the data, those who need it for their work, and they are bound by a duty of confidentiality.
- We run regular backups and keep records of important operations in the system.
- We update the software regularly and check the security settings.
We deliberately do not publish the specific technical details of our security — describing them would in itself be a manual for an attacker.
If a leak were nevertheless to occur: if there were a security breach with a high risk to your rights, we will notify you and the Úřad pro ochranu osobních údajů (the Czech Data Protection Authority) without undue delay, as the GDPR requires of us.
11. Changes to this policy
The system and the services develop, so we may amend this policy from time to time — for instance when a new feature is added or a supplier changes.
- The current wording is always available on this website; at the top you will find the effective date and version number.
- In the event of a material change (for example a new recipient of data, a new purpose of processing or a longer retention period) we will notify you in advance — by e-mail to the address we have for you, or by a prominent notice on the website.
- Changes never have retroactive effect: data we have already processed under an earlier wording remains processed under that wording.
- We will send you previous versions on request.
Do you have a question or a comment about this document? Write to info@pdracademy.eu or telephone +420 605 100 600. We will be happy to explain everything in plain language.