1. Controller of personal data
The Walio service is operated by walio digital s.r.o., Company ID (IČO) 29893984, with its registered office at Dlouhá 3403/2b, Moravská Ostrava, 702 00 Ostrava, registered with the Regional Court in Ostrava, file no. C 104900 (“Walio”, “we” or the “controller”).
Contact for personal data protection matters: podpora [at] walio.cz
Processing takes place in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
2. Our dual role
As a controller, we process data of website visitors and prospective clients who contact us, and data of our clients (businesses).
As a processor, we process the personal data of our clients’ End Customers (participants in loyalty programmes). The controller of these data is the relevant business (our client); Walio processes them solely on its instructions on the basis of a data processing agreement under Art. 28 GDPR.
3. What data we process and why
Contact forms (home page and Contact page)
When you fill in a form, we process your first name and surname, e-mail address and the content of your message. The purpose is to answer your enquiry and to establish business cooperation; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We keep the data for no longer than 2 years from the last contact.
Forms in our Facebook and Instagram ads
When you fill in a form in our ad on Facebook or Instagram, we process your first name and surname, telephone, e-mail, the name and type of your business and information about your current loyalty programme. We use them only to contact you and introduce Walio, as you requested; the legal basis is our legitimate interest in handling your request and establishing business cooperation (Art. 6(1)(f) GDPR). We keep the data for no longer than 2 years from the last contact.
The form runs on the platform of Meta Platforms Ireland Ltd., which passes the submitted data on to us. Meta processes data about your use of Facebook and Instagram as an independent controller under its own privacy policy.
Clients (businesses)
For clients, we process identification, contact, billing and login data for the purpose of performing the contract (Art. 6(1)(b) GDPR) and complying with legal obligations, in particular accounting and tax obligations (Art. 6(1)(c) GDPR).
Customers of businesses (loyalty programme)
Customers who add a digital loyalty card provide data (name and e-mail, and where applicable telephone and date of birth, if collected by the business), and data on their activity and card identifiers for delivery to Apple Wallet or Google Wallet are generated. The controller of these data is the relevant business; Walio acts as a processor.
Marketing communications
We send newsletters and commercial communications only on the basis of separate consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time and is not a condition for using the service.
We do not process special categories of personal data (Art. 9 GDPR).
4. Who we share data with
We do not sell personal data. We make them available only to providers of necessary services, who process them on our instructions and under a data processing agreement (Art. 28 GDPR):
- Supabase – database, authentication and storage,
- Vercel – hosting of the application and website,
- Resend – sending e-mails,
- Sentry – error monitoring,
- Apple Inc. – Apple Wallet, Google LLC – Google Wallet and business search (Google Places),
- Anthropic PBC – AI-assisted loyalty programme proposal in the card builder (business data only, not End Customer data),
- Stripe – payment processing, Fakturoid – invoicing,
- Dotykačka ČR s.r.o. – optional integration with a point-of-sale system,
- Umami Software, Inc. – cookieless website traffic measurement (see section 8),
- Cloudflare, Inc. – encrypted database backups (R2 storage in the EU).
Outside this list, we share data with Meta Platforms Ireland Ltd., only from the marketing pixel (Meta Pixel) for conversion measurement and remarketing, only on the basis of your consent (see section 8), and from forms in our Facebook and Instagram ads (see section 3). Meta also processes these data for its own purposes as a controller under its own privacy policy.
We disclose data to public authorities only on the basis of the law or a court decision.
5. Transfers to third countries
Some processors and other recipients (in particular Apple, Google, Anthropic, Meta, Stripe, Resend, Sentry and Umami) may process data outside the European Economic Area (in particular in the USA). The transfer is safeguarded on the basis of an adequacy decision of the European Commission (Art. 45 GDPR – the EU‑U.S. Data Privacy Framework) or standard contractual clauses (Art. 46 GDPR).
6. Retention period
- Client data – for the duration of the contract,
- Accounting and billing data – for the period laid down by accounting and tax legislation (the Czech Accounting Act and Tax Code), no longer than 10 years,
- Loyalty programme customer data – for the duration of the contract + max. 30 days after termination,
- Website and ad-form enquiries – max. 2 years from the last contact,
- Logs and operational data – 90 days,
- Encrypted database backups – 30 days; data erased from the database disappear from the backups no later than after this period,
- Marketing cookies (Meta Pixel) – for the validity period of the cookie, no longer than 90 days; consent until withdrawn,
- Marketing consent – until withdrawn.
7. Your rights
As a data subject, you have the right:
- of access to your personal data (Art. 15),
- to rectification of inaccurate or incomplete data (Art. 16),
- to erasure (the “right to be forgotten”, Art. 17),
- to restriction of processing (Art. 18) and to data portability (Art. 20),
- to object to processing based on legitimate interest (Art. 21),
- to withdraw consent to processing at any time (without affecting the lawfulness of processing before withdrawal).
Please send your request by e-mail to podpora [at] walio.cz ; we will respond within one month at the latest. If you are an End Customer of a loyalty programme, please exercise your rights with the relevant business (the data controller) – Walio, as a processor, will assist it.
8. Cookies and analytics
By default, the walio.cz website uses only strictly necessary storage and traffic measurement by Vercel Web Analytics and Umami, which work without cookies, do not store IP addresses and do not identify individual visitors. They collect only anonymous aggregate data: the address and title of the page viewed, where the visit came from, browser language, device type, browser and operating system, screen size, country (derived from the IP address, which is not stored) and clicks on registration, e-mail or telephone and form submissions (without their content). These tools do not require consent.
Marketing cookies (Meta Pixel). Only on the basis of your explicit
consent (Art. 6(1)(a) GDPR) do we load the Meta Pixel of Meta Platforms Ireland Ltd.,
which stores the _fbp and _fbc cookies and is used for conversion measurement and remarketing
in Meta’s advertising systems (Facebook, Instagram). We use the pixel on the walio.cz website and in the public
card builder and registration in the application (app.walio.cz/vytvorit and app.walio.cz/register),
where it also measures completed registrations. We do not use the Meta Pixel or any other marketing cookies in the client portal,
on loyalty card pages or on other pages for businesses’ customers. Without your
consent, neither the pixel nor these cookies are loaded.
You give consent by clicking “I agree” in the cookie banner; if you choose “Decline”, no
marketing cookies are used. We remember your decision in the strictly necessary walio-consent cookie
(valid for 1 year), shared between walio.cz and app.walio.cz, so that both parts of the service do not ask you separately.
You can withdraw your consent at any time, just as easily as you gave it: in the footer of any page
of the website, or below the content of the card builder and registration, click Cookie settings and choose
“Decline”. This deletes the _fbp and _fbc cookies and the pixel will no longer load.
Alternatively, you can contact us at podpora [at] walio.cz .
9. Security
All communication is encrypted using HTTPS (TLS), passwords are stored only in hashed form and access to data is controlled on a need‑to‑know basis. Data are stored with providers in the EU/EEA, or with appropriate safeguards as described in section 5.
10. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority – the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
11. Changes to this document
This document may be updated. The current version is always available on this page together with its effective date.