Privacy Policy

Vision Lab Agency s.r.o.

Effective from 25 May 2026

1. Data controller

The controller of personal data is:

Vision Lab Agency s.r.o.
Registered office: Na Folimance 2155/15, 120 00 Prague 2, Czech Republic
Company ID (IČO): 19495935, VAT ID (DIČ): CZ19495935
Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 387532
E-mail: info@visionxlab.cz, tel.: +420 734 699 056
(the „Controller")

This policy describes what personal data we process in connection with offering and delivering the AI training, on what legal basis, to whom we transfer it and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on Personal Data Processing.

2. What personal data we process

a) Identification and contact data: first and last name, company name, company/VAT ID, e-mail, phone, billing and registered address.

b) Data from the order / booking form: information about your company and business that you provide, the chosen date, and any other information you share with us.

c) Payment and billing data: data necessary to issue and pay an invoice; card payments are processed by the Stripe payment gateway - you enter card details directly with the payment gateway provider, and the Controller does not have access to full card details.

d) Data from the Training Recording: the live online Training is recorded. The camera is voluntary; if you turn it on or participate actively, the Recording may capture your image, voice and questions. We provide the Recording solely to Participants of the given Training.

e) Data for „networking" contact sharing: if you give consent, at the end of the Training we share your contact card with other Participants for the purpose of establishing business contacts. Without consent we do not share the card.

f) Data on granting / certifying consent: in order to prove consent to the Terms and to data processing, we record data on the completion of the form (date and time, IP address, document version, and possibly a certificate of interaction with the form produced by the TrustedForm service).

g) Communication: the content of e-mail, phone or other communication with us.

h) Website data (cookies and marketing): see Art. 7.

3. Purposes and legal bases of processing

Purpose	Legal basis
Conclusion and performance of the training contract (order, booking, delivery of the training, materials and recording, support)	Performance of a contract - Art. 6(1)(b) GDPR
Issuing invoices and keeping accounts, complying with tax and archiving obligations	Compliance with a legal obligation - Art. 6(1)(c) GDPR
Making and providing the Recording of the Training to Participants	Performance of a contract and legitimate interest - Art. 6(1)(b) and (f) GDPR; turning the camera on voluntarily is an informed choice
Sharing the contact card with other Participants („networking")	Consent - Art. 6(1)(a) GDPR
Sending marketing communications (news, offers)	Consent - Art. 6(1)(a) GDPR, or legitimate interest for existing clients - Art. 6(1)(f) GDPR
Protecting the Controller's rights, recovering claims, protecting intellectual property (tracing the source of a materials leak)	Legitimate interest - Art. 6(1)(f) GDPR
Operating the website, measurement and improvement (cookies, analytics, advertising)	Consent (for non-essential cookies) / legitimate interest (for essential ones)

4. Recipients and processors

We may transfer your data to vetted processors that provide us with services necessary for operation. In particular:

Stripe - online payment processing;
Zoom (or a similar platform) - online streaming and recording of the training;
Fakturoid - issuing invoices and billing agenda;
Go High Level - CRM, contact and communication records;
Make - process automation (connecting tools);
TrustedForm (ActiveProspect, Inc.) - certifying and evidencing consent given (recording the interaction with the order form);
Google (Google Tag Manager, possibly Google Analytics) - website operation and measurement;
Meta (Facebook/Instagram) - where we run advertising campaigns and measurement (e.g. the Meta Pixel);
the web hosting and e-mail service provider;
accounting, tax and legal advisors; and, to the necessary extent, public authorities where required by law.

We have concluded appropriate data processing agreements (DPAs) with our processors.

5. Transfers outside the EU / EEA

Some processors (in particular Stripe, Zoom, Google, Meta, Go High Level, ActiveProspect/TrustedForm) may process data outside the EU/EEA, in particular in the USA. Such transfers take place on the basis of appropriate safeguards under the GDPR - in particular the Standard Contractual Clauses approved by the European Commission, or within the EU-US Data Privacy Framework.

6. Retention period

Contractual and contact data: for the duration of the contractual relationship and then for the period necessary to assert and defend legal claims (typically until the limitation periods expire).
Accounting and tax documents: for the period set by law (typically 10 years).
Training Recording: for the period it is made available to Participants (typically at least 12 months), after which it may be deactivated or deleted.
Data processed on the basis of consent (marketing, „networking"): until consent is withdrawn, at the latest until the purpose ceases.

After the retention periods expire, we delete or anonymize the data.

7. Cookies and the website

Our website uses cookies and similar technologies. Essential cookies ensure basic website functionality. The website may further use analytics and marketing technologies (e.g. via Google Tag Manager, analytics or the Meta Pixel) for measuring traffic and advertising. You can manage or refuse the use of non-essential cookies in your web browser settings; where required by law, processing is based on your consent, which can be withdrawn at any time.

8. Automated decision-making

We do not carry out automated decision-making with legal or similarly significant effects on the data subject within the meaning of Art. 22 GDPR.

9. Your rights

In connection with the processing of personal data, you have the right:

of access to the data and to a copy of it;
to rectification of inaccurate data and completion of incomplete data;
to erasure (the „right to be forgotten") under the conditions of the GDPR;
to restriction of processing;
to data portability;
to object to processing based on a legitimate interest, including direct marketing;
to withdraw consent at any time where processing is based on consent (withdrawal does not affect the lawfulness of processing before withdrawal);
to lodge a complaint with a supervisory authority.

You can exercise your rights at the e-mail info@visionxlab.cz. We will handle your request without undue delay, at the latest within one month.

10. Security

We adopt reasonable technical and organizational measures to protect personal data against unauthorized access, loss or misuse (in particular access management, encryption of transfers and contractual commitments of processors).

11. Supervisory authority

You have the right to lodge a complaint with the supervisory authority, which is:

Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
web: uoou.gov.cz

If you are located in another EU/EEA country, you may also lodge a complaint with your local data protection authority.

12. Effectiveness

This Privacy Policy takes effect on 25 May 2026. The Controller is entitled to update it; the current version is always available on the Controller's website.

Vision Lab Agency s.r.o., Company ID 19495935