GDPR

Aenze s.r.o. acts as controller for KORD account registration, billing, security, support and service-operation data.

For personal data in a customer workspace and instructions to publish through connected profiles, the customer normally acts as controller and KORD acts as processor. The online Data Processing Addendum forms part of the Terms for that processing.

A connected social platform may act as an independent controller under its own terms after the customer instructs KORD to send data to it.

We apply purpose limitation, data minimization, access control, retention limits and security measures appropriate to the risk. Provider permissions are requested for visible product functions rather than unrelated future uses.

KORD relies on performance of a contract, legitimate interests in security and reliable operation, legal obligations and consent where a specific optional integration requires it. The Privacy Policy maps these bases to the relevant processing.

• General Data Protection Regulation - official GDPR text on EUR-Lex

Subject to GDPR conditions and exceptions, data subjects may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing.

Send requests concerning KORD-controlled account data to [email protected]. If the request concerns content placed in KORD by your employer, agency or another customer, contact that customer first; KORD will assist it as processor. We may verify identity and authority.

You may complain to the supervisory authority in your habitual residence, place of work or place of the alleged infringement. KORD's lead contact in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

• Czech Office for Personal Data Protection - official supervisory-authority information

Primary production hosting is in the EEA. When a provider processes data in a country without an EU adequacy decision, KORD uses an applicable safeguard such as the European Commission Standard Contractual Clauses and supplementary measures. Customer-selected social platforms receive data under their own terms and the customer's instruction.

KORD uses tenant isolation, role-based access, scoped API tokens, encryption of provider credentials, secure sessions, rate limits, audit events, monitoring and tested backups. The DPA describes technical and organizational measures, incident assistance, audits and subprocessor controls.

KORD keeps processing records appropriate to its role and assists customers with data subject requests, security incidents and impact assessments as required by Article 28 GDPR.

KORD does not make solely automated decisions about users that produce legal or similarly significant effects. AI suggestions, validation and readiness states support the customer's publishing workflow; authorized people or explicitly scoped customer automations decide what is scheduled or published.

Use the Privacy Policy for controller processing, the DPA for processor commitments, the Subprocessors page for service providers, the Cookie Policy for browser storage and the Data Deletion page for practical deletion instructions.

Privacy and GDPR questions can be sent to [email protected]. KORD has not appointed a data protection officer because its current processing does not meet the mandatory appointment criteria; this contact remains responsible for privacy inquiries.