Effective from 10 October 2026 · v4
1.1 For the Operator's own platform operations (account administration, security, fraud prevention, analytics, invoicing Creators, and fulfilling legal obligations including DAC7), the data controller is ANAX HOLDING, s.r.o., Company ID (IČO) 108 76 197, with its registered seat at Příkop 843/4, Zábrdovice, 602 00 Brno, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, file no. C 123363 ("we", the "Operator"). Contact for data protection matters: hello@creatorbox.cz. 1.2 When a Creator (Tvůrce) sells their Products through the Platform, the Creator (as seller) is the controller of their Buyers' data, and we act as the Creator's processor under a data processing agreement (creatorbox.cz/dpa). For our own purposes under point 1.1 (in particular security, fraud prevention, and legal obligations) we are an independent controller in respect of the same data. 1.3 Payments are processed by Stripe Payments Europe, Ltd. as an independent controller under its own policies.
2.1 When you make a purchase we process: your name, email, order details (product, price, time), a record of your consent to the digital content being made available (time granted), technical data (IP address, browser), and payment status (you enter payment details directly with Stripe; we never see or store card numbers). 2.2 For sale-related purposes (delivery, complaints, communication), the controller of this data is the Creator you are purchasing from - shown at checkout and in your order confirmation; you should exercise your data rights with them first. We process the same data as the Creator's processor, and additionally, as an independent controller, only for the operation and security of the Platform, fraud prevention, and compliance with legal obligations. 2.3 We use your email to deliver purchased content and for transactional messages; for marketing only with your consent or, for similar products, under the lawful basis of legitimate interest (with the option to unsubscribe at any time from every message). 2.4 Consent to marketing messages (for example a newsletter) may only be given by persons aged 15 or older. Younger persons may give it only with a parent's or legal guardian's consent. A Creator account is for persons aged 18 or older only.
3.1 We process: registration and profile data (name/business name, handle, email, password hash), billing information, your seller-status declaration (business/non-business), Company ID (IČO)/VAT ID, date of birth for natural persons, a bank account identifier for payouts, a summary of transactions and revenue, and technical data. 3.2 DAC7 reporting: as a reporting platform operator under Act No. 373/2022 Coll., we report sellers' identification data and their income earned through the Platform to the tax authority annually (by 31 January); we will provide you with a copy of the reported data. The legal basis is compliance with a legal obligation.
Account administration and platform operation - legal basis: Art. 6(1)(b) GDPR (performance of a contract) - retention: for the duration of the account. When an account is deleted we erase the data immediately, except what we must keep (see section 10). Processing of a Creator's sales (where we act as processor) - legal basis: the data processing agreement (DPA) - retention: as instructed by the Creator, for no longer than the duration of the account. Invoicing and accounting/tax documents - legal basis: Art. 6(1)(c) GDPR (legal obligation) - retention: for the period required by law, up to 10 years (Act No. 563/1991 Coll., Section 31). DAC7 reporting - legal basis: Art. 6(1)(c) GDPR (legal obligation) - retention: for the period required by law, up to 10 years (Act No. 164/2013 Coll., Section 14zze; reporting under Act No. 373/2022 Coll.). Security, logs, and fraud prevention - legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the Platform and its users) - retention: 90 days (audit log, per the DPA, Annex 2). Traffic analytics - legal basis: Art. 6(1)(a) GDPR (consent, cookies) - retention: per the cookie table in the Cookie Policy. Marketing communications - legal basis: consent, or legitimate interest for our own similar products - retention: until consent is withdrawn / an objection is raised. Record of consent to digital content being made available before the withdrawal period expires - legal basis: Art. 6(1)(c) and (f) GDPR (evidencing compliance with a legal obligation) - retention: for the duration of any claims arising from the purchase. Account deletion record - legal basis: Art. 6(1)(f) GDPR together with Art. 17(3)(e) GDPR (proving that we handled the request) - retention: up to 10 years from the deletion.
5.1 We share data only with vendors necessary for operating the Platform, always under a data processing agreement. Specifically: Stripe Payments Europe Limited (Ireland) - payment processing; Hetzner Online GmbH (Germany) - application and database hosting; Cloudflare, Inc. (USA) - file storage (Cloudflare R2), CDN, and network protection; Mailgun Technologies, Inc. (USA, EU region) - sending transactional and marketing emails. 5.2 The current and complete list of processors is publicly available at creatorbox.cz/zpracovavame; any changes are announced under the DPA (at least 30 days in advance, with a right to object). 5.3 AI features. Creatorbox does not currently use any artificial intelligence provider to process the personal data of Creators or Buyers. If an optional AI feature is added to the Service, we will name the specific provider on the Processors page at least 30 days before activation, together with a commitment that neither the Creator's nor the Buyers' data will be used to train its models (Art. 13 of the Terms, Art. 9 of the DPA). 5.4 We share data with the Creator from whom a Buyer purchases (name, email, and data necessary for performance), and with public authorities where required by law (in particular the tax authority under DAC7). We do not sell data to third parties. 5.5 Google. Where you have given consent to analytics cookies (see the Cookie Policy), we share technical visit data with Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as part of Google Analytics 4 and Google Tag Manager. In this respect Google acts as an independent controller, and processing occurs only once consent has been granted (Consent Mode v2); Google is therefore not our processor under Art. 28 GDPR and is not listed in the List of Processors (which is limited to processors of Buyers' personal data - see creatorbox.cz/zpracovavame).
6.1 Primary processing takes place within the European Union / EEA: Hetzner (Germany) and Stripe Payments Europe (Ireland). 6.2 Cloudflare, Inc. and Mailgun Technologies, Inc. are US companies; Cloudflare processes data in the EU region (R2 file storage, EU) and Mailgun in the EU region (Frankfurt). For both, any transfer to the US (e.g. for infrastructure administration purposes) is safeguarded by the European Commission's Standard Contractual Clauses (SCCs) under Decision 2021/914, or, where applicable, certification under the EU-US Data Privacy Framework. 6.3 We do not currently use any AI provider, so no transfer of data outside the EEA occurs for that purpose (see Art. 5.3). A copy of the relevant SCCs is available on request: hello@creatorbox.cz. 6.4 Data transferred to Google Ireland Limited may be further processed by its affiliate Google LLC (USA); this transfer is safeguarded by Google's certification under the EU-US Data Privacy Framework. This transfer occurs only for visitors who have consented to analytics cookies (see Art. 5.5 and the Cookie Policy).
7.1 We do not carry out automated decision-making with legal or similarly significant effects. Automated fraud-prevention features may temporarily restrict account functions; any such restriction can always be reviewed by a human (hello@creatorbox.cz).
8.1 You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object (including to direct marketing at any time), and to withdraw consent. We handle requests within one month (this period may be extended by a further two months for complex requests; we will inform you if so). Where we act as a Creator's processor, we will forward your request to the Creator and assist with handling it. 8.2 You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz - though we would appreciate the chance to resolve it with you directly first.
9.1 Encryption in transit (TLS 1.2+) and encryption at rest (AES-256), least-privilege access control, data segregation, access monitoring and logging with a 90-day log retention period, and regular backups. 9.2 We notify the supervisory authority and affected individuals of security breaches within statutory deadlines; Creators affected by processed content are notified within 48 hours of discovery (Art. 15.5 of the Terms, Art. 6 of the DPA).
10.1 We delete an account immediately when you ask for it in the account settings. Before you delete, you can download your data: Creators on the Standard plan or higher find links to export their orders and customers (CSV) in the deletion dialog itself. Once deleted, the data cannot be restored. You can also ask by email at hello@creatorbox.cz and we will handle the request within the legal deadline. 10.2 On deletion we erase your profile and contact details, sign-in details, content, messages, settings and uploaded files, cancel subscriptions, and remove your account and customer record at Stripe. Files of products that Buyers have already paid for are kept only for as long as those Buyers can still download them. 10.3 For Creators with completed sales we must keep part of the data for the period required by law, up to 10 years (counted from the end of the calendar year of the deletion): a) seller details for DAC7 and the amounts and dates of their transactions (Act No. 164/2013 Coll., Section 14zze), b) accounting documents for Platform fees (Act No. 563/1991 Coll., Section 31), c) records of facilitated sales: order number, value, date and the Buyer's country (Act No. 235/2004 Coll., Section 100b, where it applies to us). Buyers' orders stay as the seller's records, with no link to the deleted account. 10.4 Deletion record. To be able to prove that we handled the request, we keep a minimal record: the request number, an internal account identifier, a hash of the email (a keyed HMAC, not the email itself), the account type, the channel, times, the steps taken and the categories kept. It contains no name and no readable email. Legal basis: Art. 6(1)(f) GDPR together with Art. 17(3)(e) GDPR. Retention: up to 10 years from the deletion. We email you a deletion confirmation (PDF). 10.5 Backups. We keep encrypted backups that we use for nothing except disaster recovery. After such a recovery we perform the deletion again. 10.6 Stripe. Stripe keeps some data, for example identity verification, as an independent controller under its own legal obligations and policies (stripe.com/privacy).
11.1 We may update this policy; the date of the last change is shown in the header, and we notify you of material changes by email or in the app at least 15 days in advance.