Privacy Policy

Effective from: August 10, 2026

I. Basic Information about the Controller

Controller of personal data: FixIt.app s.r.o. Company ID (IČO): 23725681 Registered office: Choratická 2734/6, Záběhlice, 141 00 Prague 4, Czech Republic Email: legal@fixit.app Phone: +420 702 140 894

Legal basis: This Policy complies with:

• Regulation (EU) 2016/679 (GDPR)
• Act No. 110/2019 Coll., on Personal Data Processing
• Act No. 127/2005 Coll., on Electronic Communications

Personal data contact: legal@fixit.app.

Supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Address: Pplk. Sochora 27, 170 00 Prague 7 Website: uoou.cz Email: posta@uoou.cz

II. Introduction

FixIt.app s.r.o. ("FixIt", "we", or "our") respects your privacy and is committed to protecting your personal data. FixIt operates an online platform that connects service providers with customers and, for selected smaller MARKETPLACE QUICK jobs, also secures fulfilment through its own workers employed on a DPP/DPČ basis.

Dual role: For a QUICK job on the employment rail, FixIt is the worker's employer and the service supplier. For QUICK on the IČO rail and for REALTIME, SCHEDULED and MARKETPLACE PRO, FixIt is an intermediary and the named independent provider supplies the service. Employment data processing is described in the separate Cooperation Terms and Personal Data Protection for Workers.

A complete list of processors and recipients of data can be found on the Data Processors page.

III. What Personal Data We Process

A. Data of providers and partners

Scope of data:

• Identification data: name, surname, date of birth
• Contact data: email, phone number, address
• Business data: Company ID (IČO), VAT ID (DIČ), business authorization details
• Data from identity verification via Bank iD (bank identity)
• Profile photo
• Information about the services provided, ratings, reviews
• Payment account identifiers at the payment provider (Stripe) and capability flags
• Transaction and payment data

Legal basis:

• Article 6(1)(b) GDPR - contract performance
• Article 6(1)(c) GDPR - compliance with legal obligations
• Article 6(1)(f) GDPR - legitimate interest (security, fraud prevention, service improvement)

B. Customer data

Scope of data:

• Identification data: name, surname
• Contact data: email, phone number
• The address of the place of performance, including any supplementary information (e.g., entrance code, access notes) - this data is passed on to the assigned provider/worker
• The job description and photos of the problem that you upload
• Data on orders, communication, and ratings
• Payment data processed by the payment gateway (Stripe)

Legal basis:

• Article 6(1)(b) GDPR - contract performance
• Article 6(1)(a) GDPR - consent (marketing)
• Article 6(1)(f) GDPR - legitimate interest (security, platform functionality)

C. Location data

We use current location to find and assign jobs. When tracking an assigned job, we also store the worker's location history: coordinates, time, accuracy and related movement data. This supports arrival detection, the progress of work and dispute handling. Completion produces a simplified route and time-on-site record, accessible to authorized platform staff. The simplified route is a permanent part of the job record, and the exact coordinates at the moment of arrival and departure also remain in the job's event log; for workers on DPP/DPČ we derive the start and end of work in the working-time records under Section 96 of the Czech Labour Code from it (a measured arrival and departure takes precedence over a manually entered status change). Turning location sharing off stops new device updates but does not itself erase records already stored.

Legal basis: Article 6(1)(b) GDPR (contract performance) and (f) (service functionality). For marketplace jobs, the location shown to the counterparty is coarsened (both parties see an approximate locality, not the exact address, until the job is accepted).

D. Communication and attachments

Chat messages between users are retained. Attachments are stored in non-public storage, made accessible via temporary signed links, and undergo antivirus scanning.

Legal basis: Article 6(1)(b) and (f) GDPR.

E. Push notifications and device data

To send notifications to the app, we process push tokens and basic device data. Notification delivery is provided by the Expo service (see Data Processors).

F. Website visitor data

Scope of data:

• IP address
• browser and device information
• traffic data (Umami Analytics - a self-hosted installation)
• URLs of visited pages, referrer

Legal basis: Article 6(1)(f) GDPR - legitimate interest (security, analytics, service improvement).

G. Public inquiry form (web leads)

If you submit an inquiry via the public form on the website, we process your email, a description of the problem, your city, any photos, and the IP address of the submission. The form is protected against bots by the Cloudflare Turnstile service. Cloudflare's Turnstile Privacy Addendum applies to this verification. Unclaimed inquiries are automatically deleted after a set period.

Legal basis: Article 6(1)(b) and (f) GDPR.

H. Worker data (DPP/DPČ)

For workers in an employment relationship, we process broader categories of data (among others, the birth number, payroll data, and reports to the ČSSZ and the tax office). This data and its legal basis are described in the separate document Cooperation Terms and Personal Data Protection for Workers.

I. Data of competition and promo campaign participants

As part of competitions and promotional campaigns, we process identification and contact data, participation data (points, referral codes), and technical data (IP address, access logs). Details are contained in the separate document Competition Personal Data Processing Policy.

IV. Processing of Content by Artificial Intelligence (AI)

We use AI to process jobs, create content and provide the Fixáček assistant for customers, workers and visitors who are not signed in. We process the text and images you submit to the feature, conversation history and context needed to handle your request (such as the related job or app screen). Depending on the feature, requests are processed by:

• Anthropic - language models for conversation and analysis, and recognition of the content of uploaded photos and documents (photos of the problem, receipts, company profile materials),
• OpenAI - language models for conversation and text analysis,
• Google - Gemini models for generating images (logos, banners, listing illustrations) from a text prompt; your photos are not passed to Google.

Our Eve AI service routes requests; some requests use OpenRouter. We therefore also send content to providers outside the EU/EEA, particularly in the United States. Conversations with the assistant should not be assumed to remain only on FixIt's servers. Recipients and transfer terms are described in the processors and recipients overview.

Legal basis: Article 6(1)(b) GDPR (processing and handling of the job) and (f) (improvement and automation of services).

V. Purposes of Personal Data Processing

We process your personal data for the following purposes:

1. Platform operation - connecting providers and customers, dispatching jobs
2. Contract performance - processing orders, communication, account management
3. Payment transactions - processing payments via Stripe
4. Employment and tax obligations - for workers on DPP/DPČ (wages, ČSSZ, tax office)
5. Legal obligations - tax documents, accounting, archiving
6. Security and fraud prevention - protecting the platform and users
7. Marketing - sending commercial communications (only with consent)
8. Service improvement - traffic analysis, automation, UX optimization

VI. Fraud Prevention and Security

To protect the platform and users against fraud and misuse, we process technical and security data, in particular device characteristics, network identifiers (e.g., IP address), access logs, and signals for risk assessment. Based on this data, we may restrict or block risky conduct.

Legal basis: Article 6(1)(f) GDPR - legitimate interest (security, fraud prevention).

VII. Processors and Data Transfers

A. Processors of personal data

In accordance with Article 28 GDPR, we use a number of processors (hosting, payments, identity verification, AI analysis, notifications, email, analytics, error monitoring, etc.). A complete and up-to-date list of processors and recipients - including the purpose, location, and any transfer outside the EU - can be found on a separate page:

→ Data Processors (subprocessors)

The linked page identifies the services, data processed and locations. Overseas providers deliver sign-in, AI, SMS and notifications, among other functions; this data does not remain exclusively in the EU/EEA.

B. Transfer of personal data to other parties

The personal data of providers/workers is made available to customers when a profile is displayed and a job is accepted (name, contact, ratings).

The personal data of customers is passed on to the assigned provider/worker after a job is accepted (name, contact, job address including any access data).

For workers on DPP/DPČ, we pass on the legally required data to the Czech Social Security Administration (ČSSZ), the Financial Administration (tax authority) and the worker's health insurance company (employer's bulk notification and the monthly statement of insurance premium payments) - details in the Cooperation Terms for Workers.

We do not pass on your data to third parties for their own marketing purposes without your consent.

VIII. Personal Data Retention Period

Statutory archiving applies to necessary records, not automatically to the entire account. When handling erasure requests, we also assess related records and explain which data we retain and why.

IX. Your Rights as a Data Subject

Under the GDPR, you have the following rights. We also state how we actually exercise these rights today:

A. Right of access (Article 15 GDPR)

You have the right to confirmation of whether we process your data and to access it. You can download part of your data (profile, addresses, location, membership) directly in the app via the export function; we will provide the remaining data upon request within the deadline set out below.

B. Right to rectification (Article 16 GDPR)

You have the right to request the correction of inaccurate data or the completion of incomplete data.

C. Right to erasure - the "right to be forgotten" (Article 17 GDPR)

You can submit a request in account settings or at legal@fixit.app. If no ongoing job, payment, employment relationship or other blocker prevents it, the system, after a 14-day grace period during which you can cancel the request, deactivates the account, deletes addresses, contacts, push tokens and sign-in identities, and pseudonymizes the remaining record (name, e‑mail and phone are replaced with placeholder values). Data we must retain by law (in particular workers' payroll and identification records, signature and verification audit trails, and the date of birth on employment records) stays linked to this pseudonymized record for the statutory period. Other requests go to manual review. Data needed for statutory duties or specific legal claims is retained separately from ordinary account use; deleting an account therefore does not immediately erase every document.

D. Right to restriction of processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your data.

E. Right to data portability (Article 20 GDPR)

You have the right to receive the data you provided to us in a structured, commonly used, and machine-readable format (to the extent supported by the export function; the remainder upon request).

F. Right to object (Article 21 GDPR)

You have the right to object at any time to the processing, in particular for direct marketing purposes.

G. Right to withdraw consent (Article 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw it at any time. Consent granted during verification via Bank iD can be withdrawn; after withdrawal, the relevant identity snapshot is invalidated (see Art. XI).

H. Right to lodge a complaint

You have the right to lodge a complaint with the Office for Personal Data Protection.

How to exercise your rights: Contact legal@fixit.app. We will handle your request without undue delay and within one month. If the law permits an extension due to the complexity or number of requests, we will explain the reason and the new deadline within the first month.

X. Analytics and Visitor Tracking

To understand website usage, we use our own analytics solution Umami:

• no analytics cookie on your device,
• data is aggregated and stored on servers in the EU,
• no data sharing with third parties for their own purposes,
• geographic location only at country level.

Umami itself does not store any analytics cookie on your device. The website does, however, set these first-party cookies: fixit_locale (chosen language, 1 year), __Host-fixit_session (sign-in, HttpOnly, for the duration of the session) and, when you arrive from a campaign, fixit_attr (source and campaign without personal data, 90 days), which is attached to events in Umami. We do not use third-party cookies.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR).

We use a self-hosted Sentry installation to investigate errors. Error reports can contain an account identifier, email address, technical device data and error context. On an error, the report may also include a short recording of the screen before the error (Session Replay); text and form inputs are masked in it, and the recording is created only on an error, never continuously. Disabling automatic collection of some data does not make every report anonymous. Access is used to diagnose and fix errors.

For in-app search, we record search events for signed-in customers: when a search returns results or you tap a suggestion, we store the search phrase (lowercased, at most 60 characters; phrases containing @ or five or more digits are not stored), an approximate area (a cell of roughly 5 km, never exact coordinates), the event type and time, and a pseudonymous identifier (a keyed HMAC hash of the account identifier; the account identifier itself is not stored). We use this to show "Popular nearby" and to rank search suggestions. A phrase is shown to others only once at least 5 different people have searched for it in that area within 30 days; offensive words are filtered out. The legal basis is our legitimate interest in improving search (Article 6(1)(f) GDPR).

XI. Identity Verification via Bank iD

To verify identity, we use the Bank iD service (bank identity). From Bank iD, we obtain the identification data needed for verification and, in the case of workers, also further data necessary for the employment relationship (in detail in the Cooperation Terms for Workers).

Withdrawal of consent / revocation: You can withdraw the consent granted in Bank iD. Upon revocation, the relevant identity verification snapshot held by us is invalidated, and this fact is recorded in the audit trail.

XII. Personal Data Security

We have implemented technical and organizational measures:

• Encryption: SSL/TLS in transit; sensitive data (e.g., birth numbers, IBANs) is also encrypted at rest (AES-256-GCM),
• Access rights: limited access only for authorized persons,
• Backups: regular automatic backups,
• Monitoring: monitoring of security threats,
• Minimization: sensitive identifiers are masked in overviews.

XIII. Changes to This Policy

We may update this Policy. We will inform you of significant changes via email or a notification on the platform.

XIV. Contact

For personal data protection inquiries:

• Email: legal@fixit.app
• Email: info@fixit.app
• Phone: +420 702 140 894

Office for Personal Data Protection:

• Website: www.uoou.cz
• Email: posta@uoou.cz
• Phone: +420 234 665 111

Last updated: September 25, 2026