Privacy policy

Controller and contact

The controller is Jiří Tregner, company registration number 01826298, with registered address Pod hájovnou 524, Nebušice, 164 00 Praha 6, Czech Republic. Send questions and requests about personal data to info@djcard.cz.

Account and public presentation

For registration, we process your DJ name, email address and a securely derived password hash. We do not store your password in readable form. We need these details to create and operate your account. Your sign-in email is not itself made public.

The content of published profiles, press kits, posts and the forum is public to the extent allowed by the service settings. You voluntarily publish your booking email, phone number, photos, references and links. The Scene is accessible to signed-in members.

Sign in with Google

If you choose Google sign-in, Google provides your verified email and a persistent Google account identifier for secure sign-in. We request only the basic openid, email and profile scopes; we do not gain access to Gmail, Drive or other account content. You choose the name shown publicly on DJcard yourself.

We store the link between your Google identifier and your DJcard account. We do not retain Google access or refresh tokens. Signing in or linking accounts does not constitute consent to email newsletters. Google processes sign-in data under its privacy policy (policies.google.com/privacy). You can unlink Google in settings after verifying your password; the link also ends when your account is deleted.

Sign in with Facebook

If you choose Facebook, we process a persistent Facebook account identifier and the available email address for registration and sign-in. We request only public_profile and email. We do not have access to messages, posts or page management. You choose your public DJ name yourself. You verify your email separately in your account.

We do not retain the Facebook access token. The identifier is linked to your DJcard account; we do not automatically match accounts by email. Signing in does not constitute consent to email newsletters. Facebook processes sign-in under Meta policies (facebook.com/privacy/policy). Unlinking and data deletion are described at djcard.cz/facebook-data.

Purposes and legal bases

We provide your account and requested features to perform the service agreement. Abuse prevention, security and basic technical operation are based on our legitimate interest in a safe and functioning service. Optional traffic measurement is based on consent. External players load directly.

Google Analytics 4

With your consent, we measure traffic using Google Analytics 4, provided by Google Ireland Limited. The service processes technical visit information and cookies to distinguish visits. Data may also be processed outside the European Economic Area under the provider’s data protection terms. You can withdraw consent in Cookie settings. We do not send form content or your sign-in email.

PRO analytics

We record analytics only after optional statistics are enabled in the cookie banner. Refusing does not affect use of the website or media playback. Analytics show aggregate visits and clicks. To limit duplicates, we use an identifier derived from the connection, profile, event type and time period. We do not store the original IP address in this table. This is pseudonymisation, not a guarantee of complete anonymity. Individual events are retained for up to 90 days; the settings overview shows 30 days.

Hosting and external services

We operate the website and its storage through OpenAI’s Sites platform using Cloudflare infrastructure. These technical services may process data needed for hosting, security and content delivery. Illustrative images may load from Unsplash.

When a particular player is displayed, you also connect to YouTube/Google, Spotify, SoundCloud or Mixcloud. These services process data under their own policies and may also process it outside the European Economic Area. You open external links separately.

Account recovery

We use one-time verification links for password recovery and changes to your sign-in email. We store only their hashes and limited validity. System messages for password recovery, email changes and email verification are delivered through Resend. We provide Resend with the recipient address and the content of the relevant service message for delivery.

Operational measurement and backups

After analytics are enabled, we also measure loading speed and responsiveness of public pages. We store aggregate values for groups of URLs, without form content, sign-in email or complete personal page URLs. These aggregates are retained for up to 90 days.

To secure the service, we record aggregate counts of technical errors and security policy violation reports. Database backups are encrypted and retained for up to 30 days; files have private backup copies. Deleted data may remain in a protected backup until this period expires and is not used in normal operation.

Registration emails and newsletters

We need your email for your account and service messages. The portal administrator has access to the account list and exports. During registration, you can separately and voluntarily consent to DJcard news and offers. The option is not preselected; we store its state, date and text version. You can withdraw consent at any time in Account and security. Existing registrations are not automatically treated as marketing consent.

Retention

We retain account data and the content you save while your account is operating, or longer to the extent necessary to resolve disputes and meet legal obligations. You can delete an email-and-password account in Studio under Account and security. This removes the profile, your content and files; if storage fails, files remain queued for deletion by the administrator. You can request further erasure by contacting us by email. A sign-in session lasts no more than 30 days. Your analytics choice is stored in the djove_preferences cookie for 180 days.

Your rights

You may request access, rectification, erasure, restriction of processing or portability in the cases provided for by the GDPR. You may object to processing based on legitimate interests. You have the right to complain to the Czech Office for Personal Data Protection at uoou.gov.cz. We handle requests within statutory deadlines and may reasonably verify the requester’s identity.

Payments and further information

The payment gateway and the purchase of personal domains are not yet available. Before activation, we will add the specific providers, billing details and applicable retention periods. The final contractual arrangements with providers and any international transfers require legal review.