Privacy Policy
1. Controller and contact
The controller of personal data processed by VELMAU in connection with product support, enquiries, complaints and its own sales records is Martin Pustka, trading as VELMAU, a sole trader registered in the Trade Licensing Register of the Czech Republic.
Registered business address: Sokolska 464/29, 120 00 Prague, Czech Republic. Business identification number (IČO): 75294699.
Telephone: +420 728 971 337.
For enquiries about personal data or to exercise your data protection rights in relation to VELMAU’s processing, contact [email protected]. For questions about a purchase, please include your order reference, if available.
Purchases are completed through Lemon Squeezy, which acts as the merchant of record. Its processing of personal data is explained in section 4.
2. Information received
To provide product support and handle enquiries and complaints, we process information provided directly by you or made available to us through Lemon Squeezy in connection with your purchase. Depending on the information provided, this may include your name, contact details, order references, purchase details and related messages.
Our internal sales analysis records are limited to the order reference, the product purchased and the amount paid, including its currency. These records do not include your name, email address, postal address or customer account ID. We also compile aggregated sales statistics by period, product and, where available, country.
These limited internal records are separate from the purchase information held by Lemon Squeezy and any information you provide when contacting us for support.
3. Purposes and legal bases
Personal data is used to provide the product licence and related customer support where necessary to perform our contract with you or take steps at your request before a purchase, under Article 6(1)(b) GDPR. Data required for statutory records is processed to meet legal obligations under Article 6(1)(c).
The limited internal sales records are used to analyse sales by period, product and country. The legitimate interest pursued under Article 6(1)(f) is to understand sales patterns and manage the business. This processing must be limited to what is necessary and must not override your rights and interests. You may object as explained below.
Your information is not used by VELMAU to send marketing messages or target advertising.
4. Lemon Squeezy, hosting and other recipients
Purchases are completed through Lemon Squeezy, which acts as the merchant of record and handles the purchase transaction, including payment, applicable transaction taxes, receipts and refund processing.
Lemon Squeezy processes personal data for its own transaction-related purposes under its own Privacy Policy. For that processing, it acts as a separate controller. It may make purchase and customer information available to VELMAU so that we can provide the product and related support.
Where necessary to resolve an order-related enquiry, complaint or refund request, we may share the relevant order reference, contact details and correspondence with Lemon Squeezy.
The limited internal sales records described above are stored in a system hosted by Railway Corporation. Railway processes these records on our behalf under a data processing agreement. Within VELMAU, access to this internal system is limited to the business operator.
Information may also be disclosed where required by law.
This policy covers processing for which VELMAU is responsible. Requests concerning Lemon Squeezy’s independent processing should be directed to Lemon Squeezy using the contact details in its Privacy Policy.
5. Storage and international transfers
VELMAU’s internal sales analysis system uses storage in Amsterdam, the Netherlands. Railway’s services may also involve processing outside the European Economic Area, including in the United States. Such transfers require a valid legal mechanism. Where applicable, the European Commission’s standard contractual clauses provide the safeguards.
Contact [email protected] for information about the safeguards applicable to data processed by VELMAU and how to obtain a copy.
The storage and international transfer arrangements for information processed independently by Lemon Squeezy are described in its Privacy Policy. The Amsterdam storage location stated above applies to VELMAU’s internal system, not to all information processed during a purchase.
6. Retention
Personal data processed by VELMAU is kept only for as long as necessary for the purposes described above. Where legislation requires particular records to be retained, those records are kept for the applicable statutory period. Internal sales analysis does not extend that period.
Information that is no longer needed and is not subject to a retention obligation is deleted or irreversibly anonymised.
Lemon Squeezy determines the retention periods for information it processes independently, as explained in its Privacy Policy.
7. Your rights
Subject to the conditions of the GDPR, you may request access, correction, erasure or restriction of processing. You may also request an export of your personal data in a structured, commonly used, machine-readable format. The statutory right to data portability applies where the relevant legal conditions are met.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests, including the internal sales analysis described above.
Erasure is not unconditional: records that must be kept by law cannot be deleted while that obligation applies. A request will be assessed and any limits explained. A response will be provided without undue delay, normally within one month; any permitted extension will be explained within that period.
For information processed by VELMAU, contact [email protected]. For information processed independently by Lemon Squeezy, please contact Lemon Squeezy using the details in its Privacy Policy.
You may lodge a complaint with a competent data protection supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. Contact details are available in the European Data Protection Board’s directory of authorities. The Czech authority is the Office for Personal Data Protection.
Further information about your rights is available from the European Commission.