Privacy Policy
Effective 14 October 2026
Controller and contact
The controller is Ocelot Development s.r.o., IČO 02039273, Roháčova 145/14, 130 00 Praha 3, Czech Republic, registered with the Municipal Court in Prague, Section C, File 214907. The managing director is Matěj Havlín. For privacy matters, contact [email protected].
Our role
Ocelot builds and operates software for business clients. Depending on the service, we act as a controller for data used to manage our own business relationship, or as a processor on a client's behalf. For example, we may handle enquiries and leads that a client receives through its Facebook, Instagram or WhatsApp accounts, SMS, web chat, phone or email. In those cases, the client decides why and how the personal data is processed, and we follow the client's documented instructions.
Personal data we process
Depending on the service and the request, this may include contact details, messages and their contents, photos a person sends, appointment details, and call recordings where recording has been announced. We process only data needed to handle the request and provide the relevant service.
Meta Platform data
When we process data received through Facebook, Instagram or WhatsApp for a business client, we use it only to answer the person and handle their request for that client. We do not sell this data or use it to build advertising profiles. We delete it when requested by the client or the person, subject to applicable law and the client's instructions.
Purposes and legal bases
We process data to take steps at a person's request before entering a contract, perform a contract, or provide services to a business client. Where required, we rely on consent. We may also process limited data on the basis of our legitimate interests in protecting and securing our systems, preventing misuse, and maintaining service logs.
Retention
When acting as a processor, we retain personal data according to the client's instructions and delete or return it when the service ends or deletion is requested, unless the law requires otherwise. Call recordings are kept for no more than 90 days. Technical logs are minimised and kept only as long as needed for security and operation.
Service providers and transfers
To provide our services, we use providers in general categories such as EU cloud hosting, messaging and telephony, and AI processing. They process data under appropriate data-processing agreements and only for the relevant service. Where personal data is transferred outside the European Economic Area, we use appropriate safeguards, including Standard Contractual Clauses where applicable.
Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure. Access is limited to what is needed to operate and support the service.
Your rights and complaints
Subject to applicable law, you may request access, rectification, erasure or restriction of processing, object to processing, or request data portability. If we process your data for a client, we may refer your request to that client as controller and assist them in responding. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ), www.uoou.cz. Contact us at [email protected].
Effective date
This Privacy Policy is effective from 14 October 2026.