Privacy Policy

Last updated: 25. 11. 2025

This Privacy Policy explains how Performance4 s.r.o. ("we", "us", or "our") collects, uses and protects personal data in connection with the P4PDF by Performance4 s.r.o. service (the "Service").

1. Data Controller

The data controller is:
Performance4 s.r.o.
Husova 429, 373 67, Borek, Czech Republic
Company ID: 08415765
Email: support@performance4.cz

2. Personal Data We Process

We may process the following categories of personal data:

Account data (name, email address, password hash);
Billing and invoicing data (company name, address, VAT ID);
Technical data (IP address, browser information, log files);
API usage logs (endpoints called, timestamps, technical metadata);
Documents uploaded for signing or timestamping (temporarily);
Payment-related identifiers from Stripe (no card numbers are stored by us).

3. Purposes and Legal Bases

We process personal data for the following purposes and on the following legal bases:

To provide the Service, manage your account and process your requests – performance of a contract (Art. 6(1)(b) GDPR).
To comply with legal obligations (e.g., accounting, tax) – legal obligation (Art. 6(1)(c) GDPR).
To maintain and improve the Service, prevent abuse and ensure security – legitimate interest (Art. 6(1)(f) GDPR).
To send you important service-related communications – performance of a contract or legitimate interest.
For marketing communications, where applicable – consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

4. Document Processing and Retention

Documents you upload (PDF files and attachments) are processed only for the purpose of performing the requested operation (signature, timestamp, attachment). We do not permanently store the contents of your documents, unless explicitly stated otherwise and agreed with you.

By default, documents are retained only for the short technical period necessary to complete processing and ensure reliability (e.g., transient backups, error handling).

5. Retention Periods

Account data – for the lifetime of your account and a reasonable period thereafter;
Billing data – for the period required by applicable law (typically 10 years);
API logs – for 365 days, unless needed longer for security reasons;
Documents – only temporarily as described in Section 4.

6. Recipients and Processors

We may share personal data with the following categories of recipients:

Stripe, as our payment processor;
Timestamp authority (TSA) providers, where only document hashes may be shared;
Professional advisors (e.g., accountants, lawyers) where necessary;
Public authorities, where required by law.

7. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision, in accordance with GDPR requirements.

8. Your Rights

Under GDPR, you have the following rights (subject to conditions):

Right of access to your personal data;
Right to rectification of inaccurate data;
Right to erasure ("right to be forgotten");
Right to restriction of processing;
Right to data portability;
Right to object to processing based on legitimate interests;
Right to withdraw consent (for consent-based processing) at any time.

To exercise these rights, please contact us at support@performance4.cz.

9. Cookies and Tracking

We use cookies and similar technologies primarily for essential functionality. For more details, see our Cookies Policy.

10. Complaints

If you believe that your data protection rights have been violated, you may lodge a complaint with your local supervisory authority. If our company is established in the EU, our lead supervisory authority is:
Úřad pro ochranu osobních údajů (ÚOOÚ)
https://www.uoou.cz