Privacy Policy and Personal Data Protection

1. General Information

The data controller according to the Regulation of the European Parliament and Council (EU) No. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”) is Y Soft Corporation, a.s., Company ID: 26197740 (hereinafter referred to as “Controller” or “we”).

The contact details of the Controller are:

• address: Technická 2948/13, 616 00 Brno – Královo Pole, Czech Republic
• Company ID: 26197740, VAT ID: CZ26197740
• email: hw@ysoft.com
• phone: +420 533 031 500

Personal data, in accordance with the GDPR, refers to any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to a specific identifier, such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (hereinafter referred to as “Personal Data”).

These Policies apply to all individuals visiting the Controller's website https://hw.ysoft.com (“Website”), regardless of whether they are in a contractual relationship with the Controller or not.

2. Sources of Processed Personal Data

We process personal data:

• that you have provided by filling out the contact form on the Website, or
• that you communicate to us via email, phone, or other similar means, or
• that are collected through cookies when you visit the Website, to the extent you have given your consent.

3. Legal Grounds and Purposes for Processing Personal Data

The purpose of processing personal data is

• Communication with clients and prospective clients: When you fill out the contact form on our Website, we process your name, email address, phone number, company name and any other information you provide in your message in order to respond to your inquiry.
• The legal basis is the legitimate interest of the Controller in responding to inquiries (Article 6(1)(f) GDPR) or, where the inquiry concerns entering into a contract, steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• Protection of the Website against spam and abuse: The contact form is protected by Google reCAPTCHA, which evaluates whether the form is being filled out by a human.
• The legal basis is the legitimate interest of the Controller in protecting the Website and its forms against misuse (Article 6(1)(f) GDPR).
• Website traffic analysis: The Controller uses Google Analytics 4 to analyze traffic on the Website.
• The legal basis is your consent given through the cookie bar (Article 6(1)(a) GDPR). Analytical cookies are stored only if you allow them.

The Controller does not engage in automated individual decision-making as defined in Article 22 GDPR.

4. Data Retention Period

We retain personal data

• for the time necessary to handle an inquiry or request received through the contact form on the Website or by email or phone;
• for data processed on the basis of consent (cookies), until the consent is withdrawn or until the cookie expires, as specified in Section 8.2.

After the retention period for personal data has expired, we will delete the personal data.

5. Provision of Personal Data

Recipients of personal data are persons

• involved in ensuring the operation of the Website and related services,
• providing analytical services.

Specifically, we share your personal data with the following entities:

• Google Ireland Limited (and its affiliate Google LLC), which operates Google Analytics, Google Tag Manager and Google reCAPTCHA. Information on how Google processes your personal data can be found at https://policies.google.com/privacy.

We may also disclose personal data to public authorities where required by law.

In connection with the use of Google services, personal data may be transferred to the United States of America. Such transfers take place on the basis of the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, in which Google LLC participates. The Controller does not otherwise transfer personal data to third countries or international organizations.

6. Means of Personal Data Protection

We declare that we have taken all appropriate technical and organizational measures to secure personal data:

• Technical measures: we declare that measures have been implemented to technically secure servers, data storage, and websites against unauthorized manipulation.
• Organizational measures: we declare that only authorized individuals have access to personal data. Individuals who come into contact with personal data are informed about privacy protection principles and are bound by confidentiality when processing them.

7. Rights of Data Subjects

Under the conditions set forth in the GDPR, the data subject

• has the right to access their personal data according to Article 15 of the GDPR,
• has the right to rectify personal data according to Article 16 of the GDPR, or to restrict processing according to Article 18 of the GDPR,
• has the right to erasure of personal data according to Article 17 of the GDPR,
• has the right to object to processing according to Article 21 of the GDPR,
• has the right to data portability according to Article 20 of the GDPR,
• has the right to withdraw consent to processing at any time, in writing or electronically to the address or email of the Controller specified in Section 1 of these Policies, or by changing the settings in the cookie bar.

The aforementioned rights and any complaints can be exercised in writing or electronically at our address or email provided in Section 1 of these Policies.

Additionally, you have the right to file a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz) if you believe your right to personal data protection has been violated.

8. Cookies

In accordance with the provisions of Section 89, Paragraph 3 of Act No. 127/2005 Coll., on Electronic Communications, as amended, in accordance with Act No. 110/2019 Coll., on the Processing of Personal Data, and in accordance with the GDPR, we hereby declare that for the purpose of improving the services provided to you, the Website uses so-called cookies for its operation.

What are cookies?

Cookies are small data files that the visited website sends to your browser, which stores them on your computer, mobile phone, or other similar device, and are commonly used to distinguish individual users.

On each subsequent visit to the Website, the cookies are sent back to the original website or to another page that recognizes the cookies. Cookies thus help remember your activities and preferences for a certain period, so you do not have to re-enter them when you return to the website or navigate from one webpage to another.

8.1. Types and Uses of Cookies

The Website uses various categories of cookies for different purposes. Cookies primarily serve to:

• Ensure the proper functioning of the Website.
• Remember your cookie preferences.
• Analyze traffic and user behavior.

Technical (Necessary) Cookies

Technical cookies are necessary for the basic functionality of the Website. We cannot do without processing these cookies for the Website to fulfill its basic function.

We can process technical cookies without the consent of the Website visitor. All other cookies can only be processed with the consent of the Website visitor, which can be revoked (refused) at any time in the cookie settings.

Analytical Cookies

Analytical cookies are used to analyze how the Website is used in order to improve its functioning and content.

We will store these cookies on your device only if you allow us to do so through the cookie bar.

Conversion, Tracking and Marketing Cookies

The cookie bar also allows you to grant or refuse consent to conversion and marketing cookies. The Website does not currently use any such cookies. If we start using them, we will update these Policies and store them only with your consent.

8.2. Cookies on the Website

Types of cookies used by the Website:

8.3. Do you want to change your cookie settings?

When you first visited any page of this Website, a cookie bar appeared asking for your consent to the use of cookies. Consent to the use of cookies is voluntary.

If you wish to change your consent, you can do so at any time through the cookie settings on the Website, or you can modify these preferences in your browser. Information on setting specific browsers can be found at the following addresses:

• Google Chrome: https://support.google.com/chrome
• Mozilla Firefox: https://support.mozilla.org/
• Microsoft Edge: https://support.microsoft.com/microsoft-edge
• Opera: https://help.opera.com
• Safari: https://support.apple.com/

9. Final Provisions

By submitting information through the contact form, you confirm that you are familiar with these Policies.

We are entitled to change these Policies. The new version will be published on the Website.

These Policies are valid and effective from January 15, 2026.

Y Soft Corporation, a.s., Technická 2948/13, 616 00 Brno, Czech Republic