Effective from 20 July 2026 · v3
1.1 For the Operator's own platform operations (account administration, security, fraud prevention, analytics, invoicing Creators, and fulfilling legal obligations including DAC7), the data controller is ANAX HOLDING, s.r.o., Company ID (IČO) 108 76 197, with its registered seat at Příkop 843/4, Zábrdovice, 602 00 Brno, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, file no. C 123363 ("we", the "Operator"). Contact for data protection matters: hello@creatorbox.cz. 1.2 When a Creator (Tvůrce) sells their Products through the Platform, the Creator (as seller) is the controller of their Buyers' data, and we act as the Creator's processor under a data processing agreement (creatorbox.cz/dpa). For our own purposes under point 1.1 (in particular security, fraud prevention, and legal obligations) we are an independent controller in respect of the same data. 1.3 Payments are processed by Stripe Payments Europe, Ltd. as an independent controller under its own policies.
2.1 When you make a purchase we process: your name, email, order details (product, price, time), a record of your consent to the digital content being made available (time granted), technical data (IP address, browser), and payment status (you enter payment details directly with Stripe; we never see or store card numbers). 2.2 For sale-related purposes (delivery, complaints, communication), the controller of this data is the Creator you are purchasing from - shown at checkout and in your order confirmation; you should exercise your data rights with them first. We process the same data as the Creator's processor, and additionally, as an independent controller, only for the operation and security of the Platform, fraud prevention, and compliance with legal obligations. 2.3 We use your email to deliver purchased content and for transactional messages; for marketing only with your consent or, for similar products, under the lawful basis of legitimate interest (with the option to unsubscribe at any time from every message).
3.1 We process: registration and profile data (name/business name, handle, email, password hash), billing information, your seller-status declaration (business/non-business), Company ID (IČO)/VAT ID, date of birth for natural persons, a bank account identifier for payouts, a summary of transactions and revenue, and technical data. 3.2 DAC7 reporting: as a reporting platform operator under Act No. 373/2022 Coll., we report sellers' identification data and their income earned through the Platform to the tax authority annually (by 31 January); we will provide you with a copy of the reported data. The legal basis is compliance with a legal obligation.
Account administration and platform operation - legal basis: Art. 6(1)(b) GDPR (performance of a contract) - retention: for the duration of the account plus a 30-day export window. Processing of a Creator's sales (where we act as processor) - legal basis: the data processing agreement (DPA) - retention: as instructed by the Creator, for no longer than the duration of the account. Invoicing and accounting/tax documents - legal basis: Art. 6(1)(c) GDPR (legal obligation) - retention: 10 years (Accounting Act, VAT Act). DAC7 reporting - legal basis: Art. 6(1)(c) GDPR (legal obligation) - retention: for the period set by Act No. 373/2022 Coll. Security, logs, and fraud prevention - legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the Platform and its users) - retention: 90 days (audit log, per the DPA, Annex 2). Traffic analytics - legal basis: Art. 6(1)(a) GDPR (consent, cookies) - retention: per the cookie table in the Cookie Policy. Marketing communications - legal basis: consent, or legitimate interest for our own similar products - retention: until consent is withdrawn / an objection is raised. Record of consent to digital content being made available before the withdrawal period expires - legal basis: Art. 6(1)(c) and (f) GDPR (evidencing compliance with a legal obligation) - retention: for the duration of any claims arising from the purchase.
5.1 We share data only with vendors necessary for operating the Platform, always under a data processing agreement. Specifically: Stripe Payments Europe Limited (Ireland) - payment processing; Hetzner Online GmbH (Germany) - application and database hosting; Cloudflare, Inc. (USA) - file storage (Cloudflare R2), CDN, and network protection; Mailgun Technologies, Inc. (USA, EU region) - sending transactional and marketing emails. 5.2 The current and complete list of processors is publicly available at creatorbox.cz/zpracovavame; any changes are announced under the DPA (at least 30 days in advance, with a right to object). 5.3 AI features. Creatorbox does not currently use any artificial intelligence provider to process the personal data of Creators or Buyers. If an optional AI feature is added to the Service, we will name the specific provider on the Processors page at least 30 days before activation, together with a commitment that neither the Creator's nor the Buyers' data will be used to train its models (Art. 13 of the Terms, Art. 9 of the DPA). 5.4 We share data with the Creator from whom a Buyer purchases (name, email, and data necessary for performance), and with public authorities where required by law (in particular the tax authority under DAC7). We do not sell data to third parties. 5.5 Google. Where you have given consent to analytics cookies (see the Cookie Policy), we share technical visit data with Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as part of Google Analytics 4 and Google Tag Manager. In this respect Google acts as an independent controller, and processing occurs only once consent has been granted (Consent Mode v2); Google is therefore not our processor under Art. 28 GDPR and is not listed in the List of Processors (which is limited to processors of Buyers' personal data - see creatorbox.cz/zpracovavame).
6.1 Primary processing takes place within the European Union / EEA: Hetzner (Germany) and Stripe Payments Europe (Ireland). 6.2 Cloudflare, Inc. and Mailgun Technologies, Inc. are US companies; Cloudflare processes data in the EU region (R2 file storage, EU) and Mailgun in the EU region (Frankfurt). For both, any transfer to the US (e.g. for infrastructure administration purposes) is safeguarded by the European Commission's Standard Contractual Clauses (SCCs) under Decision 2021/914, or, where applicable, certification under the EU-US Data Privacy Framework. 6.3 We do not currently use any AI provider, so no transfer of data outside the EEA occurs for that purpose (see Art. 5.3). A copy of the relevant SCCs is available on request: hello@creatorbox.cz. 6.4 Data transferred to Google Ireland Limited may be further processed by its affiliate Google LLC (USA); this transfer is safeguarded by Google's certification under the EU-US Data Privacy Framework. This transfer occurs only for visitors who have consented to analytics cookies (see Art. 5.5 and the Cookie Policy).
7.1 We do not carry out automated decision-making with legal or similarly significant effects. Automated fraud-prevention features may temporarily restrict account functions; any such restriction can always be reviewed by a human (hello@creatorbox.cz).
8.1 You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object (including to direct marketing at any time), and to withdraw consent. We handle requests within one month (this period may be extended by a further two months for complex requests; we will inform you if so). Where we act as a Creator's processor, we will forward your request to the Creator and assist with handling it. 8.2 You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz - though we would appreciate the chance to resolve it with you directly first.
9.1 Encryption in transit (TLS 1.2+) and encryption at rest (AES-256), least-privilege access control, data segregation, access monitoring and logging with a 90-day log retention period, and regular backups. 9.2 We notify the supervisory authority and affected individuals of security breaches within statutory deadlines; Creators affected by processed content are notified within 48 hours of discovery (Art. 15.5 of the Terms, Art. 6 of the DPA).
10.1 We may update this policy; the date of the last change is shown in the header, and we notify you of material changes by email or in the app at least 15 days in advance.