Privacy Policy

Effective date: 2026-02-18

1. Data Controller / Contact

The data controller for personal data processed in connection with the Platform is:
Legal entity name: AFINA s.r.o.
Registered address: Kaprova 42/14, 110 00 Praha, Czechia
Company registration number: 25056557
VAT number (if applicable): CZ25056557
Data protection / GDPR contact:
General support:

2. Categories of personal data

• Account data (e.g., name, email address, role, organization details).
• Profile data (e.g., services offered, countries, public listing information).
• Application and response data submitted by users.
• Technical data (e.g., log data, approximate location derived from IP, device/browser info).

3. Purposes of processing

• Providing the Platform functionality (registration, authentication, dashboards).
• Enabling Applicants and Providers to communicate about Applications.
• Sending service messages (verification, password reset, application notifications).
• Security, fraud prevention, and troubleshooting.
• Compliance with legal obligations.

4. Legal bases (EU/EEA)

Depending on context, we process personal data based on one or more of: (i) performance of a contract, (ii) legitimate interests, (iii) consent (where applicable), and (iv) compliance with legal obligations.

5. B2B Provider outreach — lawful basis and data practices

The Platform sends email notifications to organisations and professionals that appear to offer services relevant to Applications submitted by Applicants (e.g. conformity assessment, certification, laboratory testing, regulatory representation, consulting services in the EU).

Lawful basis: Legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest is to facilitate B2B matching between Applicants seeking EU compliance services and Providers capable of delivering those services. We have conducted a balancing assessment and concluded that this interest is not overridden by Provider rights and freedoms, given that: (i) recipients are businesses or professionals, not private individuals; (ii) the communications are directly relevant to the professional activities of the recipient organisation; and (iii) each communication includes an opt-out mechanism.

Data sources: Provider contact data is obtained from one or more of the following sources: publicly accessible business registries and directories (e.g. NANDO database for Notified Bodies, national accreditation body registries, public company registers); provider-submitted profiles on the Platform; business directories and professional association lists; and data submitted directly by providers during registration or outreach responses.

What data is used: Organisation name, contact email address, and professional service category.

Right to object / unsubscribe: Recipients may opt out at any time by clicking the unsubscribe link included in each notification email. Upon opting out, the recipient is added to a suppression list and will not receive further outreach emails from the Platform. To exercise your right to object under Article 21 GDPR, contact: .

Suppression list: Organisations and individuals who opt out are recorded on a suppression list. We retain suppression records indefinitely to ensure that opt-out requests are honoured in all future communications.

Retention (B2B outreach data): Contact data used solely for B2B outreach is retained for as long as the organisation appears to be active and offering relevant services, and for a maximum of 3 years from last contact, unless the individual opts out earlier, at which point contact is suppressed immediately.

6. Recipients and sharing

• Other users: information you publish or share may be visible to other users depending on your settings and the Platform workflow.
• Applicants → Providers: application details are shared with providers who receive the application. Attachments (uploaded documents) are shared only with subscribed providers who have platform access. Non‑subscribed providers may receive application details by email without attachments; documents can be provided by the applicant upon request.
• AI features: if you use AI "check application" functionality, we may send the application data (and attachment metadata, not the files themselves) to an AI processing provider to generate a summary, readiness score, and recommendations. Do not upload secrets.
• Service providers: hosting, email delivery, and analytics providers acting on our instructions.
• Authorities: where required by law.

7. Data retention

We retain personal data only as long as necessary for the purposes described above, unless a longer retention period is required by law. High-level retention periods by category:

• Account data: Retained for the duration of the account, plus 2 years after account closure for legal and dispute resolution purposes.
• Application and response data: Retained for 5 years from the date of submission (required to support warranty, regulatory, and dispute resolution obligations).
• Technical / log data: Retained for up to 12 months for security and troubleshooting purposes.
• B2B outreach data: See Section 5 above.
• GDPR deletion requests: Records of deletion requests are retained for 5 years to demonstrate compliance with applicable data protection law.

8. Security

We implement appropriate technical and organizational measures to protect personal data. However, no system is completely secure.

9. Your rights

Depending on your location, you may have rights such as access, rectification, deletion, restriction, objection, portability, and withdrawal of consent. To exercise rights, contact us at the address above.

10. Cookies and similar technologies

The Platform uses the following storage technologies:

• Authentication cookie (httpOnly): A session refresh token is stored in a secure, httpOnly cookie. This is strictly necessary for authentication and cannot be disabled without losing login functionality. No consent is required.
• localStorage: The Platform stores your access token, language preference, and UI state in browser localStorage. This data stays on your device and is not transmitted to third parties.
• Analytics / tracking cookies: The Platform does not currently use any third-party analytics, advertising, or tracking tools. No consent banner is required at this time.
• Third-party fonts: The Platform loads fonts from Google Fonts (fonts.googleapis.com), which transmits your IP address to Google servers in the EEA. This is used solely for page rendering. If you wish to avoid this transfer, you may block fonts.googleapis.com in your browser or use a content blocker.

You can control cookies and localStorage through your browser settings. Clearing strictly necessary storage will log you out of the Platform.

11. Supervisory authority

If you are located in the EU/EEA and believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority in your country of residence. The lead supervisory authority for the Platform operator is the data protection authority in Czech Data Protection Authority (ÚOOÚ).

12. Changes to this policy

We may update this policy from time to time. The "Effective date" above indicates when the latest version became effective.

© European Compliance Platform (ECP). All rights reserved.