Privacy
Privacy policy
Effective from: 17 September 2026
The data controller is Dominik Brablec, Business ID 24047929, registered office at Milady Horákové 110/44, 602 00 Brno, Česká republika, email dominik@turbotesty.cz (the “Provider”). This policy explains what data we process, why it is needed, who receives it and what rights you have.
We do not use advertising pixels, newsletters or cross-site profiling tools. The only non-essential cookie is the visit source cookie described in section 5, and we store it only with your consent.
1. Data we process
- Account and sign-in data: email, internal user ID, account creation date and basic data supplied by the chosen sign-in provider if Google sign-in is used.
- Study data: licence category, answers, attempts, test results, completed lessons, XP, levels, achievements, exam date, daily goal and activity.
- Purchase and access data: Stripe session ID, amount, access expiry, activation-code use and the record of immediate-supply consent.
- Communications: emails, complaints, deletion requests and related information needed to answer them.
- Technical data: essential session identifiers, security and operational logs, error information and basic device or browser data inherent in web traffic.
- Guarantee evidence: name, exam date and result contained in documents voluntarily sent to verify eligibility.
- Visit source: only with consent – the link you arrived through (for example a partner driving school code), the landing page and the time of the first visit; on registration it is linked to your account.
2. Purposes and legal bases
- Providing the account, study features, progress and Full Access – performance of a contract and pre-contractual steps.
- Payments, access activation, accounting and tax records – performance of a contract and legal obligations.
- Support, complaints, withdrawal and the additional-year guarantee – contract performance, legal obligations and legitimate interests in verifying claims.
- Security, abuse prevention, diagnostics and legal claims – legitimate interests in operating a secure and reliable service.
- Language, theme and local preferences – service functionality and legitimate interests in remembering user choices.
- Storing the visit source cookie – your consent. Linking the source to your account and evaluating which driving schools and channels bring customers – legitimate interest in measuring the effectiveness of partnerships.
Consent is not used where processing is required for a contract or legal obligation. The separate consent before payment concerns immediate supply and withdrawal. Consent to the visit source cookie is voluntary, and declining it does not limit use of the service.
3. Recipients and suppliers
Suppliers act on our instructions or as independent controllers for their own statutory purposes. Some operate outside the EEA; transfers are protected by applicable safeguards such as adequacy decisions or standard contractual clauses.
- Supabase – database, authentication and user-data storage.
- Vercel – hosting and delivery of the web application.
- Stripe – secure payment processing and payment-fraud prevention.
- Google – only when Google sign-in is chosen.
- Public authorities, accounting or legal advisers where required by law or necessary to protect legal claims.
4. Retention
- Account and study data are kept while the account exists. Following an approved deletion request, they are deleted or anonymised without undue delay unless retention is legally required.
- Orders, payments, accounting and tax records are retained for the period required by law, generally up to 10 years.
- Complaints, withdrawal requests and customer communications are kept while handled and then for up to 3 years to protect legal claims unless a longer period is required.
- Guarantee documents are deleted no later than 30 days after the decision. A record that the guarantee was used is kept through the extension and for up to 3 further years.
- Anonymous study sessions are kept no longer than the related identifier remains valid or until assigned to an account; the browser identifier lasts at most 1 year.
- Security and technical logs are kept only as long as needed for diagnostics, security and incident response under supplier retention settings.
6. Your rights
Exercise your rights or request account deletion at dominik@turbotesty.cz. We may reasonably verify identity before acting. We respond without undue delay, normally within one month.
- Access your personal data and obtain a copy.
- Correct inaccurate or incomplete data.
- Request erasure or restriction where statutory conditions are met.
- Receive contract-based data in a structured format and, where applicable, transmit it to another controller.
- Object to processing based on legitimate interests.
- Lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
7. Required data and automated decisions
Data marked as required is needed to create an account, save progress, complete a purchase or handle a request. Without it, the relevant feature may not be available.
We do not use automated decision-making with legal or similarly significant effects. Level, progress and readiness calculations are educational and motivational only.
8. Changes to this policy
This policy is effective from 19 August 2026. Material changes will be published here and, where appropriate, communicated in the application.