How we handle your data
Prague, 21 October 2026 · version 4 · English translation of the Czech policy; in case of doubt the Czech text applies
As the operator of the website sekundant.cz and the Sekundant service, we, AI SummerLab s.r.o., registered office Kaprova 42/14, 110 00 Prague 1 – Staré Město, company ID 21371784, registered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 400983 (“we” or “the controller”), process personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“the Regulation”).
Below you will find which data we work with, why and for how long, who may have access to it and what rights you have. The scope of processing depends on what you do with us, so the information is split by situation (several may apply at once):
- you visit the website sekundant.cz,
- you write to us or call us,
- you sign up for access to the service,
- you use the Sekundant service,
- you ask us to submit a mortgage application.
The Sekundant service is not intended for persons under 18.
Your rights
Under the Regulation you have the right
- to ask which personal data we process and to access it,
- to have it corrected or completed, or to request restriction of processing,
- to request its erasure,
- to have your data transferred to another controller,
- to object to processing based on legitimate interest,
- to withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal,
- to an effective judicial remedy if you consider that your rights under the Regulation have been infringed.
In some cases we may not be able to comply, for example when we must keep data by law; we will always explain why. You can exercise your rights at info@sekundant.cz or in writing at the registered office of AI SummerLab s.r.o., Kaprova 42/14, 110 00 Prague 1. We reply within one month at the latest.
1. You visit sekundant.cz
a) What data we process. Technical data about the request (IP address, browser type, time) in the hosting provider’s operational logs. When fonts load from Google Fonts, Google receives your IP address. Then data about how the page is used: until you respond to the cookie bar, we measure page views, clicks, scrolling and a recording of how you move through the page (clicks, scrolling, movement on the page), and the browser may store a session identifier for it; after you decline, we measure only page views, clicks and scrolling without a persistent identifier and delete the stored items; with consent we additionally store an identifier in the browser. Text you type does not enter the measurement. We also remember your cookie choice.
b) Why and on what basis. Operating and securing the website and anonymous measurement are our legitimate interest (Article 6(1)(f) of the Regulation). More detailed measurement after your decision is based only on consent (Article 6(1)(a) of the Regulation), which you give in the bar for 1 year and can change or withdraw at any time in the cookie settings; until you decide, measurement runs in full scope on the basis of our legitimate interest and you can decline it at any time. The website works fully without consent.
c) Who has access. Vercel Inc. (USA) – hosting; PostHog Inc. – the measurement tool, storing data on servers in the EU (Frankfurt); Google LLC – fonts. These suppliers process data for us as processors.
d) For how long. Operational logs up to 30 days, measurement data up to 12 months, your cookie choice 1 year.
Cookies and browser storage:
- sk-consent-v1 (localStorage) – your cookie choice, essential, 1 year;
- ph_…_posthog (cookie and localStorage) – PostHog, recognising a returning visit and measurement, until your decision or with consent (deleted when you decline), 1 year;
- ph_…_window_id (sessionStorage) – PostHog, telling windows apart during measurement, until your decision or with consent, until the window closes.
2. You write to us or call us
a) What data we process. Your name, the address or number you contact us from, and the content of the communication.
b) Why and on what basis. To reply to you and discuss the service: our legitimate interest in communicating with prospects and customers (Article 6(1)(f) of the Regulation) and steps prior to entering into a contract at your request (Article 6(1)(b) of the Regulation).
c) Who has access. ACTIVE 24, s.r.o. – receiving and storing e-mail (mailbox provider); the mortgage specialist working with us, if the query concerns a mortgage.
d) For how long. While the query is being handled and then up to 3 years in case of a dispute.
3. You sign up for access to the service
a) What data we process. E-mail, name, phone number and the details you give in the form.
b) Why and on what basis. Sekundant is in beta and we grant access gradually. We need the data to invite you and agree the next steps; these are steps prior to entering into a contract at your request (Article 6(1)(b) of the Regulation).
c) Who has access. Brevo (Sendinblue SAS, France) – sending e-mails; Vercel Inc. – hosting.
d) For how long. Until your request is handled, at most 12 months from the last contact.
4. You use the Sekundant service
a) What data we process.
- identification and contact details (name and surname, e-mail, phone) and your account login details,
- data about the financial situation of you and your household: income, spending and liabilities, bank account transactions usually for the last 12 months, which we obtain only with your explicit consent through a licensed account information service provider (Kontomatik); we never see your online banking credentials,
- documents you upload yourself (for example a tax return or an income certificate),
- details of your plan (the property, price, own funds, timing),
- the content of your communication with Sekundant and with the mortgage specialist,
- data we derive from this: the calculation, the assessment under each bank’s rules and the plan of steps.
b) Why and on what basis.
- Performance of the contract for the provision of the service (Article 6(1)(b) of the Regulation): calculation, assessment, plan, communication and human review. Without this data we cannot provide the service.
- Your consent (Article 6(1)(a) of the Regulation) to connecting your bank account. Consent is voluntary; you can disconnect the account in the app at any time, although some outputs may then be unavailable.
- Compliance with legal obligations (Article 6(1)(c) of the Regulation): the obligations of a consumer credit intermediary under Act No. 257/2016 Coll., customer identification and due diligence under Act No. 253/2008 Coll., and accounting.
- Our legitimate interest (Article 6(1)(f) of the Regulation) in securing the service, defending legal claims and improving the service through internal statistics kept without a direct link to you.
Artificial intelligence and decisions. Part of the processing is done by a language model run through the Azure OpenAI service. It is operated for us as a processor by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We pass it only the data needed for the given task; it processes the data only for us, does not use it to train models, does not store responses and may keep inputs for at most 30 days for abuse monitoring. A mortgage specialist checks the outputs before they are handed over. Sekundant does not decide whether credit is granted; the bank decides, and our outputs are a basis for your decision.
c) Who has access.
- the mortgage specialist working with us – checking outputs and communicating with you,
- Kontomatik – a licensed account information service provider that, with your consent, reads data from your bank and processes it as an independent controller under its own policy,
- Microsoft Ireland Operations Limited – the Azure OpenAI service (language model),
- Vercel Inc. – hosting; PostHog Inc. – measuring use of the app (servers in the EU); Brevo (Sendinblue SAS) – e-mails,
- accounting, legal and IT advisers to the extent necessary, and public authorities where the law requires it.
d) For how long. For as long as your account exists. After it is closed we delete the data within 30 days, except for records we must keep under the Consumer Credit Act and the anti-money-laundering act, and data needed to defend legal claims for the limitation period; if proceedings start, the period is extended for their duration.
5. You ask us to submit a mortgage application
a) What data we process. The data needed for the application with the bank you chose: identification and contact details, data on your financial situation, on the property, and documents.
b) Why and on what basis. Performance of the contract at your request (Article 6(1)(b) of the Regulation) and compliance with the legal obligations of a consumer credit intermediary (Article 6(1)(c) of the Regulation). We intermediate consumer credit as a tied agent registered with the Czech National Bank; the represented party is the independent intermediary Broker Trust, a.s., ID 26439719.
c) Who has access. Broker Trust, a.s. and the bank you chose, which process the data further as independent controllers and provide you with their own information; the mortgage specialist working with us.
d) For how long. For the duration of the intermediation and then for the period set by the Consumer Credit Act and the limitation periods for claims arising from the intermediation.
Transfers outside the EU
We store data in the EU. Where a supplier is based outside the European Economic Area or has part of its infrastructure there (for example Vercel Inc. or Google LLC), we ensure appropriate safeguards: standard contractual clauses approved by the European Commission or a Commission adequacy decision.
Security
We transfer data encrypted, only authorised persons have access to it, and the app environment is separate from the website. Your online banking credentials never pass through us.
Changes to this policy
We may update this policy. The current version is always available here; we inform users of the service about material changes by e-mail or in the app.