Strimeta Global Privacy Notice

Product: Strimeta
Operator / Provider: Jakub Marcinka, trading under jmarcinka.cz
IČO: 21474672
Business address: Na Kopci 1210/10, 460 14 Liberec XIV-Ruprechtice, Czech Republic
Contact: jmarcinka@email.cz
Website: https://jmarcinka.cz
Version: 1.0
Effective date: 9 September 2026

Status. This is Strimeta's operational legal documentation prepared for launch. Mandatory law prevails over contractual text. Because international privacy, tax, consumer and platform rules change, the regional launch gates and vendor list must be re-checked before entering a new market or materially changing the product.

This Notice explains Strimeta's processing when Strimeta determines the purposes and means of processing. Community personal data processed only on a Customer's instructions is governed primarily by the DPA and the Customer's own privacy notice.

1. Controller and privacy contact

Controller: Jakub Marcinka, trading under jmarcinka.cz, IČO 21474672, Czech Republic.
Privacy contact: jmarcinka@email.cz.
For Singapore, the same contact is designated as the public Data Protection Officer contact unless a replacement is published.

2. Personal data we process as controller

Depending on use, we process:

• account and identity data: name, business email, organisation, role, account identifiers;
• authentication/security data: password hash or external-login identifier, MFA state, login time, IP address, user agent, session and security events;
• billing data: billing identity/address, tax identifiers, invoice data, payment amount/currency/date/reference, payer reference where supplied by the bank and invoice match status;
• support/business communications and records of requests;
• configuration/integration metadata;
• consent, marketing and privacy-rights records;
• service telemetry and aggregated/de-identified usage statistics.

Strimeta does not process payment-card numbers or CVV data in the current bank-transfer billing model.

3. Customer/community data

When a Customer connects a community, Strimeta may process on the Customer's behalf platform/community IDs, member/user IDs, usernames/display names when technically necessary, roles/channels, event timestamps, activity counters, reactions and moderation-event metadata, integration configuration and derived aggregates. Message content is not persistently stored by default.

For this data, the Customer is normally the controller and Strimeta is its processor/service provider/data intermediary. Privacy requests concerning community data may therefore be referred to the relevant Customer.

4. Purposes and legal bases

Where EU/EEA or UK law applies, Strimeta relies on:

• contract / steps before contract for account creation, authentication, service delivery, support and billing;
• legal obligation for accounting, tax, sanctions and legally required records;
• legitimate interests for service security, fraud/abuse prevention, diagnostics, capacity planning, business administration and legal claims, balanced against individual rights;
• consent where required for optional marketing, non-essential tracking or other optional processing.

Other jurisdictions use the closest lawful basis or consent/notice mechanism required by their law. Strimeta does not rely on consent where the processing is genuinely necessary to perform the requested B2B service unless local law specifically requires it.

5. Data sources

We receive data directly from account users and Customers; from connected platforms under Customer authorisation; from Fio banka transaction feeds for payment reconciliation; from service/security logs; and from vendors that provide hosting, email or security services.

6. Recipients and vendors

Personal data may be disclosed to vetted vendors for hosting, transactional email, business mailbox service, security/operations and professional advice. The live vendor/subprocessor list identifies current roles and locations. Fio banka acts as a banking provider/independent controller for its banking activity; Strimeta imports only payment data needed for reconciliation.

7. International transfers

Strimeta's default production architecture is EU/EEA-centred. If data is transferred to a country requiring a transfer safeguard, Strimeta applies the mechanism required by the relevant law, such as adequacy, EU SCCs plus a transfer assessment, the UK IDTA/Addendum plus the UK data protection test, or contractual/comparable-protection mechanisms required by Australia, New Zealand, Japan, South Korea or Singapore.

8. Retention

We keep personal data only while necessary for the stated purpose, contractual operations, security, dispute handling or mandatory recordkeeping. Detailed default periods are in the Data Retention and Deletion Policy. Active Customer Data is deleted on termination after the exit window; residual encrypted backup copies expire by controlled rotation and are not used for normal operations.

9. Individual rights

Depending on location and law, rights may include access/knowledge, correction, deletion, restriction, objection, portability, withdrawal of consent, opt-out of sale/sharing/targeted advertising/profiling, appeal, and complaint to a regulator. Requests can be sent to jmarcinka@email.cz. We verify identity proportionately and will not discriminate against a person for exercising a statutory privacy right.

Strimeta does not sell personal information and does not share it for cross-context behavioural advertising. It does not use Customer/community data for targeted advertising.

10. Automated processing and profiling

Strimeta is designed for community-level and cohort-level operational analytics. Strimeta does not make solely automated decisions producing legal or similarly significant effects about community members and does not build prohibited individual Discord profiles or relationship graphs. Features that could materially alter this position are subject to the AI/Automated Analytics launch gate and a fresh privacy assessment.

11. Children and sensitive data

Strimeta accounts are intended for adults acting in a business/professional capacity. The Service is not directed to children. Customers must not intentionally configure Strimeta to collect children's or sensitive/special-category data unless the processing is lawful, necessary, documented and approved for that feature. South Korean data relating to children under 14 requires guardian-consent handling where applicable.

12. Security

Strimeta uses risk-based safeguards including least privilege, privileged-access MFA, encryption in transit, encryption of backups, secrets management, structured logging, vulnerability management, monitoring, backups, restore testing and incident response. See the Security and TOMs document.

13. Email communications

Human support/business email uses Seznam.cz infrastructure. Transactional/service messages are sent through Brevo. Marketing email is separated from transactional email and requires the lawful permission described in the Electronic Communications Policy. Open/click tracking is disabled by default unless a lawful configuration and notice/consent are implemented.

14. Complaints and regional information

The applicable Regional Privacy Supplement identifies local regulator contacts, transfer rules, mandatory rights and special procedures. Individuals may always contact Strimeta first at the privacy contact above.

15. Changes

We update this Notice when processing, vendors or law materially changes. The current version and effective date will be published with the Notice.