Privacy policy

1. Data controller

The controller of personal data is:

We have not appointed a data protection officer, as we are not required to. For any data protection matter, write to contact@webspen.com.

2. What we process

If you only visit this website, we process:

• nothing that identifies you. Our traffic analytics are cookieless and do not track you across sites.

If you hold an account, we process:

• your email address and password, held only as a cryptographic hash;
• the files you upload and the schedules you build from them (your Content);
• records of what your broadcasts did — which item started and finished when, reconnections, edits you made;
• billing records: how many streams you subscribe to, invoices, and the payment identifiers Stripe returns to us. We never receive your full card number;
• technical logs generated by operating the service, including IP addresses, kept for security and fault diagnosis.

Your Content may itself contain personal data if you put it there. We do not inspect, index or analyse it; we store it and broadcast it on your instruction.

3. Why we process it, and on what basis

• To provide the service you have asked for — performance of a contract, Art. 6(1)(b) GDPR.
• To take payment and keep accounts — performance of a contract and compliance with a legal obligation, Art. 6(1)(b) and (c) GDPR.
• To keep the service secure and working, and to investigate abuse — legitimate interest, Art. 6(1)(f) GDPR.
• To answer your enquiry — steps at your request prior to entering a contract, Art. 6(1)(b) GDPR.

We do not use your data for profiling or automated decision-making, we do not use it for advertising, and we do not sell it or pass it to anyone for marketing purposes.

4. Who else is involved

We use a small number of processors to run the service. Each acts on our instructions under a data processing agreement:

• Cloudflare, Inc. — hosting of this website, DNS, and cookieless traffic analytics.
• Stripe, Inc. — payment processing and invoicing. Stripe acts as an independent controller for its own fraud-prevention purposes; see Stripe's own privacy policy.
• Infrastructure providers — the hosting, object storage, database and email delivery providers that run the service. A current list is available on request from contact@webspen.com.

Some processors may process data outside the European Economic Area. Where they do, transfers are governed by the Standard Contractual Clauses approved by the European Commission.

When you broadcast, your Content is transmitted to YouTube on your instruction. YouTube is not our processor — it is a separate controller, and its handling of that material is governed by Google's own terms and privacy policy.

5. Cookies

This website sets no cookies. There is no advertising or tracking on it, and our analytics work without cookies and without cross-site tracking. That is why you are not being asked to consent to anything — there is nothing to consent to.

The signed-in application sets a session cookie that is strictly necessary to keep you logged in. It is not used for tracking.

6. How long we keep it

• Your Content — for as long as your account is open, and for 30 days after it closes, after which it is deleted.
• Broadcast records — 12 months, so you can look back over a past season of a channel.
• Technical logs — 90 days.
• Invoices and accounting records — for the periods required by Czech accounting and tax legislation.
• Enquiries — 3 years from our last communication with you, then deleted.

7. Your rights

In relation to your personal data, you have the right to:

• access the data we hold about you,
• have inaccurate or incomplete data corrected,
• erasure (the "right to be forgotten"),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest.

Exercise any of these by emailing contact@webspen.com. We respond within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, https://uoou.gov.cz.

8. Changes to this policy

We may update this policy if the way the service works changes. The current version is always available at this address and carries its last-updated date at the top.