Privacy policy

The personal-data controller is Základní škola Unhošť with its seat at nám. T. G. Masaryka 58, 273 51 Unhošť. We process data needed to run the SaaS platform: user identifiers (given name, family name, student ID), contact details of system administrators, and technical logs of API access.

That data is used only to provide the contracted service, keep the system secure and meet the school’s legal duties. Student identifiers are linked to credit accounts and ID-card records only to the extent needed to run payment records and asset management.

The main legal bases are performance of the contract with your institution and a legitimate interest in securing school infrastructure. Credit-system transaction data is processed for payment records and accounting rules. Those credits remain internal records, not a regulated payment service.

We do not use your personal data for marketing and we do not sell it to third parties for their own commercial use. Data is used only to run contracted UnhostCampus services: credit management, identity-card records and school-asset tracking through the API.

Personal data is stored in secured data centres in the European Union that meet high physical and digital security standards. Only vetted system-administration staff can access data, and only as needed for their work.

Data may be handed to public authorities only on a legal request or where needed to protect our rights under the law. Before any transfer we check the legal basis, and school leadership records every such case.

Technical safeguards include encryption in transit and at rest, regular security patches and monitoring of API access. All traffic between your ERP and UnhostCampus uses secured connections authenticated with API keys.

We keep data only as long as needed for the purpose it was collected, or for statutory archival periods. After the licence ends and obligations are settled, data in our systems is anonymised or deleted unless the law requires further retention.

We regularly review stored data and remove records the platform no longer needs. Credit-system transaction records follow Czech accounting and tax archival periods, so they may be kept longer than the active licence.

Technical logs of API access are kept only as long as needed to detect security incidents and then deleted automatically. Concrete periods are defined in operational documentation and may differ by record type.

As a user you have the right to access your personal data, to rectification, erasure (the right to be forgotten) or restriction of processing. You may also object to processing based on legitimate interest, or complain to the Office for Personal Data Protection if you believe your rights were breached.

We may update this privacy policy so it tracks changes in our services or in the law. We will tell users and contracting partners about material changes by email or a notice in the platform administration.

We recommend checking this page so you stay informed about how we protect privacy in the UnhostCampus ecosystem. The last-updated date is always in the header of this document.

Minor edits that do not change the scope of processing or your rights may be made without a separate notice. For large changes that affect how we handle your personal data, we will communicate clearly and with enough lead time before they take effect.