Privacy Policy

1. Controller and contact

Controller: Direct Software s.r.o., Company ID 22017640, registered office at Zámostní 1155/27, Slezská Ostrava, 710 00 Ostrava, Czech Republic.

For data protection matters, contact the controller via the contact form on the Contact page (/contact), topic "Personal data".

2. Data we process

Identification and contact data (first name, surname, e-mail, phone, company details).

Account and membership data (membership tier, credits, Direct Club link, referrer, referral code).

Verification data: result, status and validity date of verification. Photos of identity documents and selfies are processed by Stripe; the controller does not store them. For companies, the commercial register extract and the list of members of the management.

Payment data: information about payments made. Payment card details are processed exclusively by Stripe.

Content of contact form messages, course applications and partner applications.

Technical data necessary for operating the system (login sessions, selected language, security records).

3. Purposes and legal bases

Account, membership and service provision – performance of a contract (Art. 6(1)(b) GDPR).

Identity and company verification, fraud prevention and system security – legitimate interest and performance of a contract (Art. 6(1)(b) and (f)).

Accounting and tax – compliance with a legal obligation (Art. 6(1)(c)).

Newsletter and marketing communications – consent (Art. 6(1)(a)), which may be withdrawn at any time.

Handling enquiries and complaints – legitimate interest (Art. 6(1)(f)).

4. Recipients and processors

Stripe Payments Europe, Ltd. (payments and identity verification), the provider of cloud infrastructure and database, MailerLite (newsletter), Direct Club (account linking and referral structure), YVY.LIFE and Make (publishing catalogue posts; these contain no users' personal data).

Some processors may transfer data outside the EU/EEA; such transfers are based on an adequacy decision or standard contractual clauses.

5. Retention period

Account data for the duration of the account and then for no more than 3 years for possible claims.

Accounting documents for 10 years under the Czech VAT and Accounting Acts.

Newsletter data until consent is withdrawn.

Contact form messages for no more than 3 years after they are handled.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object and to withdraw consent.

You have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority of your EU member state.

7. Automated decision-making

The result of identity verification is assessed by Stripe Identity. You may contest a rejection and request human review via the contact form.

8. Data protection officer and changes

Details of the data protection officer will be added.

This policy is effective from 25 October 2026. Registered users will be informed of material changes. This policy is issued in Czech, English and Polish. The binding version is the Czech one; the English version is an informative translation.