TASKEO · LEGAL INFORMATION

Privacy policy

How Taskeo handles data about visitors, customers, application users and people named in projects and related documents.

Document version: 2 October 2026

1. Operator and its roles

Taskeo is operated by Michal Hrbek, a sole trader registered in the trade register, registration number 04247353, with its registered office at Kamenná 115, Zlatníky, 252 41 Zlatníky-Hodkovice. For personal data matters, contact us at info@taskeo.cz.

We are the controller of data relating to orders, customer accounts, subscriptions, service billing, security and support. For the content of projects, tasks, work records, customers, invoices, wiki, comments and attachments, we generally act as a processor for the customer who determines the purpose of processing. The terms of this processing are set out in section 6.

2. Data and purposes of processing

• identification and billing data: name, company, registration number, VAT ID and address;
• contact details: email and phone;
• account data: workspace, roles, permissions, settings, logins and security events;
• orders, plan, subscription, payments, service invoices and support communications;
• technical data: IP address, request time, browser information, diagnostic and audit records;
• customer-provided content: customers, projects, tasks, deadlines, work records, comments, wiki, attachments, price lists and issued invoices;
• integration settings and credentials or tokens needed to connect integrations to the extent chosen by the customer.

The public order form does not accept payment card details. We obtain data from you, from your workspace administrator and through your use of the service; we may verify identification details in public registers.

Orders, accounts and service provision: performance of a contract and steps at your request before entering into it under Article 6(1)(b) GDPR. For the customer's employees and contact persons, the basis is the legitimate interest in maintaining a contractual relationship with their organisation under point (f).

Billing and accounting: compliance with legal obligations under Article 6(1)(c) GDPR.

Security, abuse prevention and protection of rights: the legitimate interest in secure operation and the defence of legal claims under Article 6(1)(f) GDPR.

Service communications: performance of a contract and the legitimate interest in informing you about service operation. Offers of similar services are sent to existing customers only within the limits of section 7 of Act No. 480/2004 Coll., with a free opt-out. Other marketing or optional cookies are used only on the basis of separate voluntary consent.

We need identification and contact details to conclude and perform the contract; an order cannot be processed without the necessary data. Marketing consent is not a condition of service.

3. Where data is stored and who has access

Taskeo runs on servers in the Czech Republic owned and managed directly by Michal Hrbek, registration number 04247353. Only authorised persons have access to data to the extent necessary. Data for payments, accounting and protection of rights may be provided as needed to the payment method provider, accountants or legal advisers; we provide it to public authorities when required by law. This does not authorise these recipients to access workspace contents.

The customer chooses optional integration providers. We transfer data to them according to the customer's settings and instructions. Transfers outside the European Economic Area require GDPR safeguards, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Information about transfers carried out by Taskeo and a copy of the safeguards are available on request.

4. Retention periods

• customer account and contract data for the duration of the contract and generally for 3 years after its termination to protect legal claims, only to the extent necessary;
• accounting and tax documents for the period required by law;
• security and operational logs for no more than 90 days, unless a specific record is needed to handle an incident; short-term order form protection counters for no more than 24 hours;
• enquiries that do not result in a contract for no more than 12 months from the last discussion, and unverified orders for no more than 30 days;
• consent-based marketing until consent is withdrawn, for no more than 3 years from consent unless renewed;
• customer-provided data for the duration of service provision; after termination, we delete it unless further retention is required by law.

Data needed for an ongoing dispute or compliance with a legal obligation may be retained longer until the relevant obligation or proceedings end. Server backups are retained for 14 days and are used solely to restore the entire service after a technical failure. Customers cannot access them, and individual files, records or workspaces cannot be restored from them at a customer's request. Backup data disappears when overwritten, no later than the end of this period.

5. Security

We protect data through technical and organisational measures appropriate to the risk under Article 32 GDPR, particularly access control, encrypted transmission, separation of customer workspaces, audit records and backups. Access by authorised persons is limited to the necessary scope, and they are bound by confidentiality. We regularly evaluate the effectiveness of these measures.

6. Processing customer data under Article 28 GDPR

This section constitutes a personal data processing agreement between the customer as controller and Michal Hrbek as processor and forms part of the service contract. If the customer acts as a processor, they must have the necessary authorisation from their controller; Taskeo then acts as a subprocessor. An individual data processing agreement takes precedence.

Subject matter, purpose and duration: operation of a system for managing projects, tasks, work and invoicing, its maintenance, security and support for the duration of the contract and subsequent technical deletion of data. Processing includes receipt, recording, organisation, storage, retrieval, display, access by authorised users, transfer to selected integrations, backup and deletion.

People and data: workspace users, workers, customers and their contact persons, suppliers and other people named in project documentation. Processing covers identification and contact details, job roles, assigned tasks, work records, comments, attachments, billing details and related operational metadata. The customer determines the scope. The service is not normally intended for storing special categories of data under Article 9 GDPR, conviction data under Article 10 GDPR, third-party passwords or payment card details.

Customer instructions and obligations: documented instructions consist of the contract, service settings and authorised customer requests. The customer determines processing purposes and lawful bases, fulfils information duties towards affected persons, sets permissions and retention periods, and is responsible for the lawfulness of their instructions. Taskeo will not use customer data contents for its own marketing or to train its own models.

Taskeo processes data only on documented instructions, including instructions for transfers to third countries. If processing is required by law, it informs the customer in advance unless prohibited by law. It will flag an instruction that conflicts with data protection rules and may decline to carry it out until clarified.

Authorised persons must be bound by confidentiality and have access only to the extent necessary. Taskeo assists the customer with data subject requests and duties under Articles 32 to 36 GDPR. It notifies the customer of a personal data breach without undue delay after becoming aware of it and progressively provides available information about the incident and measures taken.

Taskeo provides information needed to demonstrate compliance and permits reasonable audits while protecting other customers' data. After processing ends, at the customer's choice, it returns the data and deletes its copies, or erases it, unless retention is required by law. The parties agree on the technical method, format and any cost of individually preparing data according to the scope of the request; this does not affect the Provider's statutory obligations as processor.

Subprocessors: the customer grants general written authorisation to engage potential subprocessors. The Provider supplies their list, identities, roles and processing locations before engagement. Taskeo gives at least 30 days' notice of adding or replacing a processor. The customer may object during this period on data protection grounds. Taskeo imposes corresponding obligations on subprocessors and remains responsible to the customer for their performance.

7. Your rights

Depending on the circumstances, you have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests and withdrawal of consent. Withdrawal does not affect the lawfulness of earlier processing.

Send your request to info@taskeo.cz. We may reasonably verify your identity. We respond without undue delay, no later than one month; in complex cases this period may be extended by a further two months. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection.

8. Website and automated decision-making

Taskeo does not carry out automated individual decision-making with legal or similarly significant effects. The order form uses browser local storage to prevent duplicate orders. It stores a random identifier and a fingerprint of entered details, not form contents. Technical cookies support the operation and security of forms. The marketing website does not use Google Analytics, a Google Ads tracking tag or Facebook Pixel.

Website analytics

We use our own analytics without analytics cookies to evaluate website traffic and usage and to improve the website. We use the data solely for our own needs; we do not sell it or provide it to third parties for their own purposes. We do not send form contents, email addresses or customer identification details to analytics.

9. Changes to this policy

We may update this policy when the service, suppliers or legal requirements change. The current version is always published on this page, and customers are informed of significant changes appropriately.