Platím prstem Privacy Policy

1. Controller

The controller is Siberlogy s.r.o., Company ID 21294461, Olešnice 104, 517 36, Czech Republic.

Data questions: info@sibpay.cz or podpora@sibpay.cz.

2. What data and why

• E-mail and password: signing in, e-mail codes, notices. The e-mail is stored encrypted, the password only as a hash (bcrypt). When you sign in with Google, we take only your e-mail and account identifier from Google.
• Top-ups, payments, balance and receipts: running the wallet and accounting. Also the merchant where the wallet works.
• Bank accounts you top up from: crediting top-ups and refunding your balance. The account number is stored encrypted; the app shows only the last four digits.
• Phones: make and model, a random installation ID, a notification token. For the Devices list, notifications and protection against misuse.
• Terminal proximity: over Bluetooth your phone reports which terminal it is near, so the terminal finds your fingerprint faster. Kept for 10 minutes, no history, no coordinates.
• Technical data about how you use the app: which screens and buttons you use and for how long, the steps of top-ups, pairing and payments and how long they took, error codes, sessions, app and Android version, phone model, language and network type (Wi-Fi, mobile data). Linked to a random installation ID and to your wallet account number, never to your e-mail. Never your PIN, password, codes, QR code contents, account numbers or exact amounts (only a range). Used to improve the app. 13 months.
• Crash reports: a technical record and roughly the last 30 steps in the app, no e-mail, PIN, password or account numbers. 90 days.

We do not collect your name, address, phone number, contacts or photos. We do not sell data or use it for advertising. The merchant where you pay has no access to your fingerprints.

3. Fingerprints

A fingerprint is special category personal data (GDPR Art. 9). We process it only with your explicit consent, which you give with a separate checkbox (section 7 of the terms). Your fingerprint is voluntary.

Only the merchant's terminal captures it. The template goes encrypted to our server for matching. The image is discarded once the template is computed; only the research copy is kept, encrypted and with no link to your account.

So that payments work without internet, your phone may carry your fingerprint template encrypted with the terminal network key and pass it to the terminal over Bluetooth. Neither your phone nor the app can read it.

Fingerprints are stored encrypted and separately from your e-mail. They never go into logs.

We process fingerprints for recognition at the terminal, and copies without your name for research that improves recognition.

You can withdraw fingerprint consent. We then unlink your fingerprints from your account and research consent ends too. Copies with no link to you (no account, name, place or exact time) may be used to improve recognition until their period ends.

4. Legal basis

• Contract: account, top-ups, payments, refunds of your balance.
• Explicit consent (GDPR Art. 9(2)(a)): fingerprints for recognition and research. You give it with a separate checkbox and can withdraw it in the app at any time.
• Legal obligation: accounting and tax.
• Legitimate interest: security, fraud prevention, fixing errors and improving the app based on how it is used.

5. How long

• Account, e-mail, phones, bank accounts: until the account is deleted.
• Fingerprints: until you withdraw consent, delete the finger or the account, or 12 months without paying with that finger. Account inactive for 24 months: we delete the fingerprints.
• Records of fingerprint payments (without the image): 12 months.
• Fingerprint copies for research: 6 months.
• Payment and top-up records: as long as accounting and tax law requires.
• Terminal proximity: 10 minutes. Technical app usage data: 13 months. Crash reports: 90 days.

6. Who processes data with us

Server and database providers, Google Firebase (notifications and crash reports) and the bank that handles top-ups and refunds. They process data only on our instructions.

Google may process data outside the EU, under the EU standard contractual clauses.

7. Security

Connections are always encrypted. Sensitive data is also encrypted in the database, each kind with its own key. The app is locked with a PIN, blocks screenshots and does not run on a modified phone.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can withdraw fingerprint consent at any time.

Write to info@sibpay.cz or podpora@sibpay.cz. We reply within a month.

You can complain to the Czech Office for Personal Data Protection (uoou.gov.cz).

9. Deleting your account

Delete your account in the app (Settings, Delete account), or by e-mail from your account address to info@sibpay.cz. If your wallet has a balance, we return it first.