GDPR and your rights

Controller

Walker & Volf s.r.o.
Registered office: Vysokovská 2009/28, 193 00 Praha 9 – Horní Počernice, Czech Republic
Company ID (IČO): 02880296, VAT: CZ02880296
Registered with the Municipal Court in Prague, file C 224798
Postal address: Podnikatelská 539, 190 11 Praha 9 – Běchovice, Czech Republic
E-mail: admin@cornerlog.app

We have not appointed a data protection officer; the law does not require one for the processing we do. Please send any question or request about your personal data to the e-mail address above.

What we process, why, and on what legal basis

• Rides in the app. Location, motion sensor data, settings and your rider name stay on your phone. We do not receive them, so we do not process them as a controller.
• A ride shared by link. The encrypted ride file, the unencrypted ride score if you chose to show it in the link preview, the time of upload and a one-way hash of your IP address and the day (upload limit). Purpose: to provide the shared link you asked for and to protect the service from abuse. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR) and, for the upload limit, our legitimate interest in preventing abuse (Art. 6(1)(f)). We cannot read the ride itself: the key is only in your link.
• Contact form and e-mail to admin@cornerlog.app. Your message, your e-mail address if you give one, the subject, the time and the language of the viewer, our reply, and a one-way hash of your IP address and the day (spam limit). Purpose: to read and answer your message. Legal basis: our legitimate interest in answering the people who write to us (Art. 6(1)(f)); where your message is about a purchase or a problem with the app, also taking steps at your request (Art. 6(1)(b)).
• Server access. Cloudflare processes the IP address and the technical details of every request to deliver the website and protect it from attacks. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f)). We keep no access logs with IP addresses ourselves; we only see aggregated visit counts.
• CornerLog Plus purchases. Google sells CornerLog Plus through Google Play and processes your payment and account as a separate controller under its own privacy policy. We only receive the order details Google makes available to developers, and use them to handle refunds and support and for our accounting. Legal basis: performance of the contract (Art. 6(1)(b)) and our legal obligations in accounting and tax (Art. 6(1)(c)).

Giving us personal data is voluntary. The e-mail address in the contact form is optional; without it we just cannot reply. We do not use automated decision-making or profiling, we send no newsletters and we use no advertising, analytics or tracking cookies.

How long we keep it

• A shared ride: 30 days after the upload, or until you cancel the sharing.
• A message to us: 30 days after you send it or, if we reply, 30 days after our last reply. Copies of our replies stay in our e-mail mailbox until we delete them, at most for as long as we need them to deal with your request.
• The IP hash counters for upload and spam limits: 30 days.
• Order and accounting records: for the periods set by Czech accounting and tax law (usually up to 10 years).

Who else handles the data

• Cloudflare, Inc. (USA) hosts this website, stores shared rides and messages (Cloudflare R2) and routes e-mail to admin@cornerlog.app. It processes the data for us as our processor under its Data Processing Addendum.
• Google LLC (USA) runs Gmail, the e-mail service we use to send our replies; replies, your address and occasionally an incoming e-mail pass through it. Google provides this service under its own terms and privacy policy. Google also sells CornerLog Plus through Google Play as a separate controller.
• OpenStreetMap (map tiles) and Open-Meteo (ride weather, only if you turn it on) are contacted directly by your browser when you use the Ride Web Analyzer. We send them nothing; they see your IP address and the requested map area or rounded location under their own policies (see the privacy policy).

We do not sell personal data and do not give it to anyone else, unless the law requires it (for example a court or a public authority).

Transfers outside the EU

Cloudflare and Google are based in the USA, so data may be processed there. Both companies are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision; Cloudflare's Data Processing Addendum also includes the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you have the right to:

• get confirmation whether we process your personal data, and a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17), for example a message you sent us or a shared ride;
• have the processing restricted (Art. 18);
• receive data you gave us in a common machine-readable format (Art. 20);
• object at any time to processing based on our legitimate interest (Art. 21).

Write to admin@cornerlog.app, if possible from the address you used to contact us, so that we can tell the data is yours. We answer within one month and free of charge. A shared ride you can also delete yourself with "Stop sharing" in the browser you shared it from, and your rides in the app with the History screen or by uninstalling the app.

Complaints

If you think we process your personal data unlawfully, you can lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. We would be glad if you told us first, so that we can put it right.

We publish changes of this page here.