Privacy

TAMly is an informal group. The data controller – who decides why and how data is processed and is accountable for it – is:

• Viet Up, z.s., a registered association under Czech law
• Company ID (IČO): 06877729
• Registered office: Vocelova 602/3, Vinohrady (Praha 2), 120 00 Praha
• Data box: w6i2gq2
• Responsible person: MgA. Bao Nhi Do
• Email: [email protected]

For any question about personal data, write to [email protected].

We process only what each feature genuinely needs. For each purpose we state the legal basis under Article 6 GDPR.

• Browsing the website: technical data (IP address, browser type, time and address of the request) in the server’s operational logs and at Cloudflare. Purpose: security, protection against attacks and troubleshooting. Basis: legitimate interest.
• An email you send us: your address and the message. Purpose: to reply to you. Basis: legitimate interest, or negotiating a collaboration.
• Platform feedback: ratings, a message and an optional contact (email, Facebook or Instagram). The website keeps it in the TAMly administration, which only the team can access, and lets the team know in its chat – without what you wrote or your contact. Purpose: improving the platform, sending you the calendar or arranging a meeting. We delete the contact once it has served that purpose, and all feedback after 12 months at the latest. Basis: your consent.
• An optional email for the map, the cards or news: your email address and whether you want news. Purpose: confirmation and sending the information you asked for. Basis: your consent.
• Contributions to the interactive map and answers to the cards: the text and an optional nickname. Card answers contain no name or contact. Purpose: publication after moderation. Basis: your consent.
• Sharing a story, when the form is open: the story text, confirmation that you are 18+, the choice of anonymity or a short signature, and a private email. Purpose: moderation, translation and publication with your confirmation. Basis: your consent.
• Event registration: takes place in external forms (e.g. Google Forms). Their provider processes the data under its own terms; the event page always states where the link leads.

Please do not write anything in public contributions that could identify you or other people. If it happens, a moderator removes it before publication.

Contributions and stories about mental health may contain health data, which the GDPR treats as a special category (Article 9). We process such data only with your explicit consent. Nothing is assessed or diagnosed automatically – a person decides about every contribution.

Only designated team members have access, and only to the extent their role needs (moderation, editing, administration). We do not sell data or use it for advertising or profiling.

We use these processors, who handle data for us under contract:

• a server and encrypted-backup provider in the EU,
• Cloudflare (secure delivery of the website and protection against attacks),
• an email service provider for sending confirmation emails,
• Google (a sheet of confirmed contacts for sending news, and the team chat that hears about new feedback without any personal data).

Cloudflare and Google may process data outside the EU. Such transfers are protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

YouTube and Spotify players load only after you click. Only then does their provider process data under its own terms.

• An unconfirmed email is deleted within 7 days.
• A confirmed email is kept until you withdraw consent (via the link in every email or by writing to [email protected]).
• An unverified story is deleted within 24 hours, a rejected or withdrawn one within 30 days and an unresolved one within 90 days.
• Published contributions and stories stay public until you withdraw them; active stories are reviewed every year.
• Platform feedback is deleted after 12 months at the latest.
• Encrypted backups are overwritten after 30 days.
• A minimal content-free record of actions taken is deleted after 12 months at the latest.

Emails and story texts are stored encrypted, with the key kept separately from the database. The editorial admin is reachable only through a protected gateway with multi-factor authentication. Backups are encrypted and stored in the EU. When restoring from a backup we re-apply every earlier erasure request.

You have the right to:

• know what data we process about you and receive a copy,
• ask us to correct inaccurate data,
• ask us to erase data,
• ask us to restrict processing,
• receive data in a machine-readable format (portability),
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of earlier processing.

Just write to [email protected]. We reply within one month at the latest. To avoid giving data to someone else, we may ask you to confirm that the address is yours.

If you believe we are not handling your data properly, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. We would appreciate hearing from you first – we will try to put things right.