Privacy Policy
This is an English translation provided for convenience. The legally binding version is the Czech original; in case of any discrepancy, the Czech version prevails.
Data controller: Digital D&A s.r.o. | Company ID: 23691271 • Seat: Školská 660/3, Nové Město, 110 00 Prague • DPO / data protection contact: support@awentail.com • Web: awentail.com • Effective from: 14 March 2026
1. Who we are and how to contact us
The controller of personal data processed via the Awentail platform is Digital D&A s.r.o., Company ID: 23691271, with its seat at Školská 660/3, Nové Město, 110 00 Prague (the “we” or “Operator”).
The Awentail platform is a cloud SaaS application available at awentail.com and app.awentail.com, enabling customers (Users) to create and operate AI assistants on their websites.
For personal data protection matters, contact us at: support@awentail.com
2. Who this Policy applies to
This Privacy Policy (the “Policy”) applies to the processing of personal data of three groups of people:
| Group | Description |
|---|---|
| Platform Users | Businesses and individuals who register an account on Awentail and create AI assistants (Awentail’s customers). |
| Visitors of Users’ websites | People who communicate with an AI assistant deployed on an Awentail customer’s website. In relation to them, Awentail is a processor, not a controller. |
| Visitors of awentail.com | People who visit our website without creating an account. |
If you are a visitor of a website on which an Awentail AI assistant is deployed, your personal data is primarily processed by the operator of that website (the controller). Direct any questions about the protection of your data to the controller — i.e. the company operating that website.
3. What personal data we process
3.1 Data of Platform Users (Awentail customers)
When registering and using the Platform, we process:
- Identification data: first and last name or company name.
- Contact data: e-mail address and, where applicable, phone number.
- Login data: hashed password (never in readable form).
- Billing and payment data: billing address, Company ID/VAT ID; payment card numbers are not stored by us — they are processed by a third-party payment gateway.
- Operational and technical data: IP address, browser type, login records, account settings, records of activity in the Platform.
- Knowledge Base content: documents and web pages uploaded by the User to train the AI assistant. The User represents that they are entitled to upload and process all personal data entered into the Platform and that its processing via the Platform complies with applicable law. The Operator bears no liability for the content of data uploaded by the User.
3.2 Data processed as a processor (AI assistant conversations)
If an Awentail customer deploys an AI assistant on their website, Awentail, acting as a processor, processes the following categories of data of that website’s visitors on the customer’s behalf:
- Conversation content: the text of messages between the visitor and the AI assistant.
- Contact data captured in the conversation: e-mail and phone if the visitor provides them voluntarily.
- Technical data: conversation time, session identifier, device information.
The Awentail customer (controller) is responsible for the lawfulness of processing this data. Awentail processes it solely on the customer’s instructions and under a Data Processing Agreement (DPA). Awentail is not liable for the content of conversations between website visitors and the AI assistant, or for the way the customer configures or uses the AI assistant.
3.3 Data of awentail.com visitors
- Technical data: IP address, browser and device type, pages visited, duration of visit.
- Cookies and analytics data — see Art. 10 of this Policy.
4. Legal bases for processing
We always process personal data on one of the following legal grounds under Art. 6 GDPR:
| Purpose of processing | Legal basis | GDPR Art. |
|---|---|---|
| Account registration and provision of the Platform | Performance of a contract | Art. 6(1)(b) |
| Invoicing and tax obligations | Legal obligation | Art. 6(1)(c) |
| Technical security, fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Sending product news to existing customers | Legitimate interest | Art. 6(1)(f) |
| Marketing communication with new contacts | Consent | Art. 6(1)(a) |
5. The purposes for which we process personal data
5.1 Platform operation and performance of the contract
- Creating and managing the User account.
- Providing and technically supporting the Platform.
- Communicating with the customer on Service matters.
- Processing payments and issuing invoices.
5.2 Security and operational monitoring
- Detecting and preventing fraudulent or abusive behaviour.
- Protecting the integrity of the Platform (security logs, login records).
- Diagnosing technical issues.
5.3 Improving the Platform
- Analytics of anonymised and aggregated user behaviour for the purpose of developing new features.
- A/B testing and measuring Platform performance.
Awentail does not use Users’ personal data or their Knowledge Base content to train shared AI models without express consent.
5.4 Marketing communication
- Sending news about the Platform, new features or promotions — to existing customers on the basis of legitimate interest, and to new contacts on the basis of consent.
- You can unsubscribe from news at any time by clicking the link in the e-mail or sending a request to support@awentail.com.
6. To whom we disclose personal data
We do not share personal data with third parties for their own marketing purposes. We share data only to the extent necessary with the following categories of recipients:
| Recipient / category | Purpose | Basis for disclosure |
|---|---|---|
| Cloud infrastructure providers (EEA, encrypted storage) | Hosting the Platform and databases | Processing agreement |
| AI model providers (current list at awentail.com/subprocessors) | Generating AI assistant responses | Processing agreement, DPA |
| Payment gateway (third party) | Card payment processing | Performance of a contract |
| Analytics tool providers (anonymised data) | Web analytics for awentail.com | Legitimate interest / consent |
| E-mail tool providers | Transactional e-mails, customer support | Processing agreement |
| Public authorities | Only on the basis of a legal obligation | Legal obligation |
7. Transfer of personal data outside the EEA
Users’ data is primarily processed on servers located in the European Economic Area (EEA).
When using third-party AI models, conversation content and queries may be transferred outside the EEA. These transfers are secured by appropriate safeguards under Art. 46 GDPR — Standard Contractual Clauses (SCC) approved by the European Commission, or another transfer mechanism under Art. 46 GDPR valid at the time of transfer. The Operator may change AI model or infrastructure providers at any time, provided the new providers meet corresponding personal data protection standards.
The current list of sub-processors is publicly available at awentail.com/subprocessors and is updated on an ongoing basis. We inform customers of a planned engagement of a new sub-processor in accordance with the terms of the DPA.
8. How long we retain personal data
| Data category | Retention period | Reason |
|---|---|---|
| User account data | For the term of the contract + 3 years | Legitimate interest, enforcement of claims |
| Billing data | 10 years from issuing the document | Legal obligation (Accounting Act) |
| AI assistant conversation records | Per the customer’s settings as controller | DPA, customer’s instructions as controller |
| Knowledge Base content | For the active account + 14 days | Performance of the contract, then automatic deletion |
| Security logs | 12 months | Security audit, fraud prevention |
9. Your personal data protection rights
As a data subject, you have the following rights under GDPR, which you can exercise by sending a request to support@awentail.com:
Right of access (Art. 15 GDPR) — You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of it together with information about the processing.
Right to rectification (Art. 16 GDPR) — You have the right to request correction of inaccurate personal data or completion of incomplete data.
Right to erasure (Art. 17 GDPR) — You have the right to request erasure of your personal data where the purpose of processing has ceased, you withdraw consent or you object and there are no other legal grounds for retention.
Right to restriction of processing (Art. 18 GDPR) — You have the right to request restriction of processing in the cases set out by GDPR (e.g. while an objection is being resolved).
Right to data portability (Art. 20 GDPR) — You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.
Right to object (Art. 21 GDPR) — You have the right to object to processing based on legitimate interest, including profiling and direct marketing.
Right to withdraw consent — Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority — in the Czech Republic this is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
We respond to requests without undue delay, no later than within 30 days, to the extent set out by applicable law. In justified cases the period may be extended by a further 60 days, of which we will inform you. The Operator is entitled to verify the requester’s identity before processing a request.
10. Cookies and tracking technologies
The awentail.com website and the app.awentail.com application use cookies and similar technologies. We distinguish three categories:
- Necessary cookies — technically required for the website and login to function. They cannot be refused.
- Analytics cookies — anonymised measurement of traffic and behaviour on the website (e.g. Google Analytics or a similar tool). Stored only with your consent.
- Marketing cookies — advertising personalisation and remarketing. Stored only with your consent.
You can withdraw or change your consent to optional cookies at any time via the cookie settings available at awentail.com or in your browser settings.
The AI assistant Widget deployed on Awentail customers’ websites may store session cookies. The customer, as the website operator, is responsible for informing visitors about these cookies and for meeting all information obligations. Awentail does not provide legal advice on cookie implementation or the customer’s information obligations towards its visitors.
11. How we protect your personal data
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction:
- Encryption of all data transfers via TLS (Transport Layer Security).
- Encryption of data at rest.
- Data isolation at User account level — one customer’s data is not accessible to other customers.
- Employee access control on a least-privilege (need-to-know) basis.
- Regular security audits and penetration testing.
- Data backups with geographic redundancy within the EEA, or other appropriate measures corresponding to the state of the art and security standards.
In the event of a security incident affecting your personal data, we act in accordance with our GDPR obligations — we notify the relevant supervisory authority within the period under Art. 33 GDPR and the affected data subjects in the cases and manner set out by Art. 34 GDPR.
12. Awentail as a processor — relationship with customers
If you are an Awentail customer and deploy an AI assistant on your website, you are the controller of your visitors’ personal data. Awentail acts as a processor under Art. 28 GDPR.
As a processor, we undertake to:
- process personal data only on your instructions and to the extent necessary to provide the Platform;
- not process data for our own business purposes beyond providing the Service;
- ensure that personnel are bound by confidentiality obligations;
- adopt the technical and organisational measures described in Art. 11 of this Policy;
- engage sub-processors only with your general or specific authorisation and under equivalent conditions;
- assist you in meeting your obligations towards data subjects (access, erasure, etc.);
- delete or return data after the Service ends, at your choice.
We conclude a Data Processing Agreement (DPA) as standard as part of the contractual relationship. A separate DPA is available on request at support@awentail.com. Awentail processes personal data solely to the extent necessary to provide the Service and is not liable for a customer’s instructions that conflict with applicable law.
13. Protection of children and minors
The Awentail platform is not intended for persons under 16 years of age. We do not knowingly collect the personal data of children. If we find that we have received a child’s personal data without verifiable parental consent, we will delete that data without undue delay.
Awentail customers whose websites may be visited by minors are responsible for taking appropriate measures to protect children when deploying an AI assistant.
14. Automated decision-making and profiling
Awentail does not use Users’ personal data for automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR.
The AI assistant may generate automated responses based on the content of a conversation. This does not constitute automated decision-making within the meaning of GDPR, as the final decision always remains with the visitor or with the Awentail customer as the operator. Awentail is not liable for any decisions made on the basis of the AI assistant’s responses.
15. Changes to this Policy
We may update this Policy on an ongoing basis in line with developments in legislation, our Platform or data processing practices. The date of the last update is always stated in the document header.
We inform you of material changes by e-mail to the address registered in your account or via an in-app notification, at least 14 days before they take effect.
The current version of the Policy is always available at awentail.com/privacy.
16. Contact and how to exercise your rights
Please send all requests, questions or complaints regarding the processing of personal data to:
Digital D&A s.r.o. | Školská 660/3, 110 00 Prague | support@awentail.com
We respond to requests without undue delay, no later than within 30 days, to the extent set out by applicable law. We verify the requester’s identity in order to protect your data against unauthorised access.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), www.uoou.cz.
Digital D&A s.r.o. | Company ID: 23691271 | Version 1.0 | Effective from 14 March 2026