Privacy Policy
Version 1.0 – effective from 1 November 2026
This Privacy Policy explains how we process personal data when you visit the online shop at shop.tagra.app (the "Shop"), place an order, use a customer account, activate or renew a TAGRA licence, or contact us. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Czech Act No. 110/2019 Coll., on the processing of personal data.
1. Controller
The controller of your personal data is:
- Truck Data Technology, s.r.o.
- Registered office: U trati 886/52, 100 00 Prague 10, Czech Republic
- Company ID (IČO): 27381269, VAT ID: CZ27381269
- Registered in the Commercial Register kept by the Municipal Court in Prague, file C 115238
- E-mail for privacy matters: obchod@tdt.cz
- Phone: +420 739 005 345 (Monday–Friday, 8:00–16:00 CET)
("we", "us"). We have not appointed a Data Protection Officer (DPO), because the GDPR does not require us to. Please send any questions about personal data to the e-mail address above.
2. Whose data and what data we process
We process data about consumers, sole traders and contact persons of business customers (for example the employee who places the order, or the person named for delivery or invoicing).
- Identification and contact data: name and surname, e-mail address, phone number (if you provide it), billing and delivery address.
- Business data (business customers): company name, company ID, VAT ID, the result of the VAT ID check in the EU VIES system, the name and position of the contact person.
- Order and contract data: products ordered, prices, VAT treatment, order history, invoices, payment status, delivery status, communication about the order, complaints and withdrawals, and recorded consents given in the order (for example the consent to immediate delivery of a licence).
- Licence data: licence number/key, edition, activation date, licence period, renewals and payments of the annual licence fee, and the technical data that the TAGRA program sends to us during activation and renewal to verify the licence.
- Payment data: payment amount, payment method, transaction identifier, bank account number (for bank transfers and refunds). We do not receive or store full payment card details.
- Customer account data: login e-mail, password (stored only in hashed form), account settings.
- Technical data: IP address, browser and device information, cookie identifiers, and information about how you use the Shop (see Article 10).
Source of data. We obtain most data directly from you. If a business customer gives us data about its employees or other persons (for example a contact person for delivery), we obtain that data from the business customer. The business customer should inform these persons about this Privacy Policy. We obtain the result of the VAT ID check from the EU VIES system.
Data in the TAGRA program. This Policy does not cover data that customers process in the TAGRA program about their own drivers and vehicles (for example driver card and tachograph data). The program is installed and run by the customer, who is the controller of that data. Please do not send us driver or tachograph data in support requests unless we ask for it.
3. Purposes, legal bases and retention
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Processing orders, concluding and performing the contract (delivery of goods and licences, payments, communication about the order) | Consumers and sole traders: performance of a contract and steps before entering into it – Art. 6(1)(b). Contact persons of business customers: our legitimate interest in concluding and performing the contract with the business customer – Art. 6(1)(f) | For the duration of the contract, then for the purpose of legal claims (below) |
| Licence management: activation, checking licence validity, renewal and payment of the annual licence fee, protection against unauthorised use of the program | Art. 6(1)(b) (consumers and sole traders); Art. 6(1)(f) – legitimate interest in performing the contract with the business customer and protecting our copyright | For the duration of the licence, then for the purpose of legal claims (below) |
| Issuing and archiving invoices and accounting records; VAT obligations (OSS, intra-Community supply, reverse charge, VIES check) | Legal obligation – Art. 6(1)(c) (Czech Accounting Act No. 563/1991 Coll., VAT Act No. 235/2004 Coll., EU VAT rules) | Up to 10 years from the end of the tax period in which the transaction took place |
| Handling withdrawals and complaints (legal guarantee and warranty) | Consumers: legal obligation – Art. 6(1)(c) (Civil Code, Consumer Protection Act). Business customers: performance of a contract – Art. 6(1)(b), or legitimate interest – Art. 6(1)(f) | For the duration of the legal guarantee/warranty, then for the purpose of legal claims (below) |
| Establishing, exercising and defending legal claims | Legitimate interest in protecting our rights – Art. 6(1)(f) | 4 years after the end of the contract, licence or guarantee period (3-year limitation period plus 1 year for claims to be delivered); longer for the duration of any proceedings |
| Customer account | Art. 6(1)(b) | Until the account is deleted; inactive accounts are deleted after 3 years |
| Answering enquiries sent by e-mail or the contact form | Legitimate interest in answering enquiries – Art. 6(1)(f); steps before a contract – Art. 6(1)(b) | 1 year after the enquiry was handled |
| Service messages about the licence (e.g. a reminder that the licence period is ending, important security updates, a change of the annual licence fee) | Art. 6(1)(b); legitimate interest in informing customers about their licence – Art. 6(1)(f) | For the duration of the licence |
| E-mail offers of our own similar products and services to existing customers | Legitimate interest in direct marketing – Art. 6(1)(f), together with Section 7(3) of Czech Act No. 480/2004 Coll. (implementing Art. 13(2) of Directive 2002/58/EC). You are informed of this when you place the order and can opt out then and in every message, free of charge | Until you object, at most 3 years after your last order |
| Newsletter for non-customers (if you subscribe) | Consent – Art. 6(1)(a) | Until you withdraw consent |
| Security of the Shop, preventing fraud and misuse; essential cookies | Legitimate interest in the security of the Shop – Art. 6(1)(f) | Logs for up to 12 months |
| Analytics and marketing cookies | Consent – Art. 6(1)(a) | See Article 10 |
Providing the data needed for the contract is a contractual requirement. Without it we cannot accept and fulfil your order. Providing the data needed for invoices and VAT is a legal requirement.
Where we rely on legitimate interest, the specific interest is stated in the table above. We have balanced these interests against your rights, and you can ask us for more information on this balancing test.
Licence activation. When the TAGRA program is activated or renewed, it reads and sends us only the data strictly necessary to verify and provide the licence you have bought (see Article 2). We do not use this data for marketing or analytics.
4. Recipients
We share personal data only to the extent necessary, with:
Processors (they process data on our behalf and on our instructions, under a data processing agreement as required by Article 28 GDPR):
- Shoptet a.s., Company ID 28935675, Dvořeckého 628/8, 169 00 Prague 6, Czech Republic – operator of the e-commerce platform on which the Shop runs.
- Accounting and tax services – providers of accounting and tax services, where we use them.
- E-mail and IT service providers – providers of e-mail hosting and IT services that we use to run our business.
Independent controllers (they process data for their own purposes and under their own responsibility):
- Our bank, Fio banka, a.s. – receipt of payments by bank transfer and refunds.
- Payment gateway – if card payment is offered in the checkout, the operator of the payment gateway and the payment institution behind it, for executing card payments, preventing fraud and meeting anti-money-laundering obligations.
- Carriers – delivery of goods by a parcel carrier selected by us; the carrier is named in the shipping confirmation. They receive your name, delivery address and, where needed for delivery, phone number and e-mail.
- Legal advisers, auditors, courts and public authorities (for example tax authorities), where we are required by law to share data or need to do so to protect our rights.
Analytics and advertising providers – only with your consent, and only if such tools are active in the Shop (the current list is shown in the cookie settings). Where we use the Meta Pixel or similar tools, we and the provider are joint controllers (Art. 26 GDPR) for the collection of data in the Shop and its transmission to the provider. We have an arrangement with the provider on this (for Meta: the Controller Addendum, www.facebook.com/legal/controller_addendum). Further processing is the sole responsibility of the provider.
We do not sell personal data.
5. Transfers outside the EU/EEA
We primarily process personal data within the EU/EEA. Some service providers (for example Google or Meta) may transfer data to the United States or other third countries. In that case the transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (where the recipient is certified), or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards used.
6. Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. The automatic check of a VAT ID in the VIES system determines only the VAT treatment of the order. If the result is negative, we will contact you or apply VAT.
7. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17), unless we need the data to meet a legal obligation or to establish, exercise or defend legal claims;
- restriction of processing (Art. 18);
- data portability (Art. 20) for data processed on the basis of a contract or consent and by automated means;
- object (Art. 21) to processing based on legitimate interest. You can object to direct marketing at any time, and we will then stop processing your data for that purpose;
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (for cookies, through the "Edit cookie settings" link in the footer of the Shop);
- lodge a complaint with a supervisory authority (Art. 77).
To exercise your rights, write to obchod@tdt.cz. We reply without undue delay and within one month at the latest. In complex cases this period can be extended by two further months, and we will tell you if it is. We may ask you to confirm your identity. Exercising your rights is free of charge.
8. Supervisory authority
The supervisory authority competent for us is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. You can also lodge a complaint with the supervisory authority in the EU Member State where you live or work, or where the alleged infringement took place.
9. Security
We protect personal data with appropriate technical and organisational measures. These include encrypted connections (HTTPS), access control and restricting access to authorised persons only.
10. Cookies
The Shop uses cookies and similar technologies.
- Essential cookies are needed for the Shop to work (for example the shopping cart, login, security and storing your cookie preferences). We use them without your consent, under Article 5(3) of Directive 2002/58/EC (implemented in Czech law by Section 89(3) of Act No. 127/2005 Coll.).
- Analytics cookies help us understand how the Shop is used. We use them only with your consent.
- Marketing cookies are used to show relevant advertising and measure its effectiveness. We use them only with your consent.
When you first visit the Shop, a cookie banner lets you accept all cookies, reject non-essential cookies, or choose individual categories. Rejecting is as easy as accepting. Analytics and marketing tools are activated only after you consent. You can change or withdraw your consent at any time through the "Edit cookie settings" link in the footer of the Shop, where you also find the cookie categories used.
11. Changes to this Privacy Policy
We may update this Privacy Policy, for example when the law or the services we use change. The current version is always published in the Shop. We will inform you of any material change in an appropriate way.
This Privacy Policy takes effect on 1 November 2026.
