At a glance
- Public business details and private enquiries are handled separately.
- Our own statistics require consent and retain records for up to 90 days.
- Write to us for access, correction, deletion or an objection.
Who is responsible for your data
The controller is Whowhere.online s.r.o., IČO 19638434, Tylova 749/38, Jižní Předměstí, 301 00 Plzeň, Česká republika. Contact for questions and rights requests: info@whowhere.online. This policy covers the portal, business accounts, forms and associated communication.
Data and purposes
| Data | Purpose | GDPR basis |
|---|---|---|
| Name, email, protected sign-in details, roles and authority | Accounts, team access and business representation | Contract or pre-contract steps, Art. 6(1)(b); security — legitimate interests, Art. 6(1)(f) |
| Business particulars, plans, invoices and payment confirmation | Placement and accounting | Contract and legal obligation, Art. 6(1)(b), (c) |
| Contacts, descriptions, photos, jobs, events and public material | Publishing and updating the directory | Contract with a representative or legitimate interests in a useful directory, Art. 6(1)(b), (f) |
| Enquiries, evidence, contacts, source URL, status and case notes | Replies, corrections, moderation and protecting rights | Legitimate interests or legal obligation, Art. 6(1)(f), (c); contractual requests — Art. 6(1)(b) |
| IP addresses, server logs, technical details and protective hashes | Security, spam prevention and diagnostics | Legitimate interests, Art. 6(1)(f) |
| Statistics and analytics identifiers | Understanding use and improving the service | Consent, Art. 6(1)(a), within the tools described below |
Forms identify mandatory fields. Without information needed for an account, contract or reply, we cannot perform that action. Acknowledging this policy is not consent to advertising. Do not send passwords, card details or unnecessary sensitive information.
Sources and public information
We receive data from you, authorised representatives, readers and public sources, including official organisation websites, registers and announcements. Public profiles may use professional contacts, addresses, names and activity details. A publicly accessible source does not remove your rights.
Visitors and search engines can see profiles and listings; enquiries and evidence are not published automatically. If someone else added your details, you may ask for the source, correction or restriction, or object to publication. We assess the legal basis and balance of interests in each case.
Our statistics and saved places
With your explicit consent to statistics, WhoWhere.online stores public page views, site language, city, search terms, result counts, result selections, approximate active reading time and scroll depth in its own database. We use this information to improve search, the directory and our guides. You can change your choice in the cookie settings; withdrawing consent stops further collection.
This measurement does not create persistent cookies, localStorage entries or visitor profiles. Random identifiers stay in the memory of the open page to prevent double counting; they do not connect your visits across pages. The analytics table does not store IP addresses, account identifiers, contact form contents, full URLs with query parameters or screen recordings. Searches containing email addresses, links, phone-like numbers or long messages are excluded. Please do not enter personal data in search: automatic filtering cannot detect all such information.
Only portal administrators can access the reports. Data stays in the website database with its hosting provider, is retained for up to 90 days and is removed by daily scheduled cleanup. If the scheduler is temporarily unavailable, deletion resumes when it recovers. Our own measurement does not send search terms to Google Analytics; the existing Google Analytics service is described separately. For data requests, use the controller contact in our privacy policy.
With the same consent, we count clicks on phone, website, directions, messenger, email and external booking links in business cards and profiles. We store only the public business ID, action type, language, time and a random event key to prevent duplicates. Business representatives see only aggregated counts for their own profiles; a click does not confirm an enquiry or booking. Signed-in visits are excluded. These records use the same scheduled cleanup and retention of up to 90 days.
At your request, “My places” saves up to 100 places and lists in this browser’s localStorage. This functional storage is separate from analytics. It does not sync between devices. Remove places in your list or clear all entries in the browser’s site data settings. When you open a list, the server receives place IDs to check whether their public pages are available. QR materials are generated in your browser without an external generator.
Who may receive data
Authorised staff and hosting, email and technical support providers have access as needed for their tasks. Business representatives see only permitted profiles and aggregate figures. Authorities and professional advisers may receive data where there is a proper legal basis.
Google Analytics (Google Ireland Limited and participating Google companies) processes visit statistics according to consent settings. See our cookie policy and Google’s privacy policy. When a map approaches the visible part of a page or you open it, the browser loads Leaflet from unpkg.com and OpenStreetMap tiles from tile.openstreetmap.de. Those servers receive a technical request including the IP address. External websites, directions, messengers and booking services have their own rules. Fonts are hosted locally.
Google and other providers may process data outside the EEA. Transfers require a GDPR basis: a valid adequacy decision covering the recipient, or standard contractual clauses and any necessary supplementary measures. You can request information about recipients and applicable safeguards at info@whowhere.online.
How long we keep data
- Our own statistics and contact clicks: up to 90 days, with daily scheduled cleanup; after a scheduler outage, cleanup resumes when it recovers.
- Spam quarantine: 30 days with scheduled cleanup. Form rate counters use 15-minute and 24-hour windows.
- Accounts and profiles: while services are provided; afterwards only data needed for outstanding commitments, statutory accounting or protecting claims.
- Enquiries, evidence and correspondence: until the case is resolved; further retention depends on a dispute, limitation period or legal obligation. Closing a case is not automatic deletion; continued need is reviewed.
- Invoices: for applicable accounting and tax periods, which vary by document.
- Cookies and localStorage: specific periods appear in our storage register. Logs and backups depend on security and recovery needs and the provider’s cycles.
Once the purpose ends, data is deleted or anonymised unless retention is legally required. On request, we explain the period or criterion for a particular category of your data.
Your rights and response times
Subject to GDPR conditions, you can access and obtain a copy of data, correct it, request deletion or restriction, object to legitimate-interest processing and, where applicable, obtain data for portability. You can withdraw consent at any time without affecting the lawfulness of earlier processing.
Write to info@whowhere.online identifying the data and action requested. We respond without undue delay, normally within one month. Complex requests may legally take up to two additional months; we explain the extension within the first month. If there are reasonable doubts, we may request proportionate identity verification.
You can complain to Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, or another competent supervisory authority.
Security, decisions and changes
We use access restrictions, form protection, file checks and private enquiry storage. Automated tools may filter spam; disputed decisions can be referred to a person.
Paid card ordering is not an automated decision producing legal or similarly significant effects on an individual. Public reviews are not yet active. Material processing changes are communicated appropriately; the current revision date appears on this page.
Founding businesses
To deliver the founders program we process the registration number, selected profile, reservation, payment confirmation and accepted terms version. An audit log supports duplicate prevention and dispute handling. The legal basis is contract performance, and legitimate interests for verification and protecting rights. Only the participant number, public name and profile link are published in keeping with the public nature of the program. The lifetime discount register is retained while that entitlement exists; payment records follow the retention periods above. Data is limited to what is necessary. Statutory access, correction, objection and erasure requests are assessed individually; the absence of an account toggle does not restrict those rights.
Need help?
Write to us — we will help with your question.
WhoWhere.online · info@whowhere.online · https://www.whowhere.online