1.1. Daniel Novak and Veronika Cernohorska, Drtinova 6, Praha 5, Czech Republic, , hereby provides information about the way and scope of processing personal information, including the rights relating to the processing of personal data (the Principles).

1.2. Protection of privacy and personal data processing is a priority for the Controller, and the processing of personal data is considered as strictly confidential, and personal data are treated in compliance with the valid legal regulations in the area of personal data protection, in particular with the General Data Protection Regulation EU 2016/679.

1.3. Services provided by the Controller through the Controller’s Website http://my-diabetic.com/ (the Website) and the mobile application MyDiabetic (the Application) may only function on condition we process your personal data in accordance with the below specifications. For more details about the services provided by the Controller, see the Website or the Application. 

2.1. The Controller particularly processes the following personal data:
a) identification data, which mainly refer to the username and the password;
b) contact data, which refer to the personal data that make it possible for the Controller to contact the Users, particularly the email address;
c) account settings, which refer to the data in the User’s user account;
d) entered content, which mainly refers management of diabetes mellitus such as the relation between food, insulin and physical activity , counting carb units of food, age of users.
e) data about the user behaviour within the Website and the Application, including records of the activity of the Application (information about using the Application by the User, logins), which can also include records of the User’s activity, the way of movement around the Website, shifting the screen, and also data about the device from which the User browses the Website, such as the IP address and the position derived from it, identification of the device, its technical parameters, such as the operating system, its version, the screen resolution, the used web browser and its version, and also data acquired from the cookies and similar technologies for device identification; and
f) derived data, which refer to the User’s personal data derived from the account settings.

Processing of the personal data of the Website visitors and the Application Users
3.1. Data about the behaviour on the Website and data acquired through the Application are processed by the Controller based on their legitimate interest for the purpose of:
a) acquiring information on the basis of which the Controller will be able to improve the Website and the Application in the future; the Controller’s legitimate interest here refers to the improvements of the provided services;
b) creation of statistics and overviews, particularly monitoring of the number of the Website visits and, as the case may be, measurement of the advertising effectiveness; the Controller’s legitimate interest here refers to measurement of the Website effectiveness and, as the case may be, the cost of advertising; for this purpose, the Controller can acquire some other derived data from the Website visitors’ behaviour and use them for this purpose;
c) testing new functions and applications before launching, particularly for the purpose of preventing problems with the functionality of such new things in actual operation, which might worsen the experience with the use of the Website and the Application; the Controller’s legitimate interest here refers to the trouble-free functionality of the provided services; and
d) prevention of hacking into the Website and the Application and threatening their functionality and security of the processed data; the Controller’s legitimate interest here refers to the trouble-free functionality of the provided services and the data security.
In the event of registration

3.2. If a user account is created in the Application, the Controller processes the User’s name and contact data, the settings data, and the entered content on the basis of a Contract with the data subjects to be able to keep and administer the user account and provide the relating functionality. The legal basis for the processing of personal data is established by creation of the user account (registration). Some information in the content entered into the Application is administered by the Controller in compliance with the given consent.

3.3. If a user account is created, the Controller processes the User’s identification and contact data, the account settings data, and also any derived data also on the basis of the Controller’s legitimate interest for the purpose of:
a) acquiring information based on which the Controller will be able to improve the provided services in the future; the Controller’s legitimate interest here refers to the improvements of the provided services; and
b) providing tailored offers and personalized advertising; the Controller’s legitimate interest here refers to the effective promotion of products and services.

3.4. Unless rejected by the User during the process of registration or later on, the Controller processes identification and contact data, account settings data, behavioural data, and derived data for the purpose of sending commercial communications, particularly by email, text message or any other electronic means, or by mail; the Controller’s legitimate interest here refers to the effective promotion of products and services.

3.5. If an account is created, the Controller processes the account settings data for the purpose of testing new functions and applications before they are launched; the Controller’s legitimate interest here refers to the trouble-free functionality of the provided services.

3.6. The User may refuse to give consent or withdraw their consent given earlier. Such a withdrawal of consent shall not affect the legitimacy of any processing of the personal data before the withdrawal. See more about the way of application of the rights by data subjects in Article 8 of the Principles.

Fulfilment of the legal obligations by the Controller
3.7. The Controller also processes the User’s identification and contact data for the purpose of fulfilment of the legal obligations, particularly the obligations within the meaning of the accounting and tax legislation. Fulfilment of legal obligations also refers to provision of data and information to the law enforcement authorities or to the other public authorities in compliance with the applicable legal regulations. 

4.1. Personal data are only accessible to the authorized personnel of the Controller, or to individual personal data processors and controllers, but only to the extent as it is necessary for fulfilment of the respective processing purposes. This cooperation aims to provide only the Users of the Controller’s services with the best possible and most relevant services. The above services mainly include verification, system hosting and maintenance, email services, management of payment transactions, checking of the address for service and the email address, and the Website traffic analysis.

4.2. The personal data acquired this way may only be used by the service providers on condition the legal conditions are met, mainly including those based on an agreement on provision of personal data or an agreement on the processing of personal data entered into by and between such Recipients and the Controller.

4.3. The Controller shall provide more detailed information or the current list of Recipients upon request.

4.4. The Controller shall not disclose personal data to any Recipients outside the territory of the European Union or the European Economic Area. 

5.1. In their presentation, the Controller uses, within the processes of enhancement of the quality of Website services, personalization of the offer, collecting anonymous data, and for the purpose of analytics, so-called cookies. Setting of the cookies is fully under control of the User. In the browser settings, the User can set everything according to their wishes, i.e. they can delete, block, or choose the option of saving Cookies only with the User’s consent in separate cases.

5.2. Consent can be given through a check box included in the so-caller cookie bar. Cookies can also be rejected or use of only some of them can be set by the User subsequently in the settings of the web browser. However, if the User rejects the cookies, or in the browser settings all cookies (including the essential cookies) are turned off, the User may not be able to obtain access to the Website, or to some of its parts.

5.3. For further information about our cookies and their current list, see particularly the Tools for Developers in your web browser. 

6.1. The Controller has taken the relevant technical and organizational personal data protection measures, both against their accidental or illegal destruction, loss, alteration, unauthorized use, access or sharing, especially where the processing includes network data transfer, and against any other forms of illegal processing or another misuse. Any Personal Data Recipient shall process personal data exclusively in compliance with the Controller’s instructions and shall be bound to observe strict security procedures when dealing with personal data