Data Controller
The data controller within the meaning of Art. 4(7) GDPR is:
Company name
GM Media s.r.o.
Registered office
Czech Republic
Phone
+420 602 462 001Website
www.gmlobee.comPlatform
Lobee — AI virtual reception
Data We Process
As part of operating the Lobee platform, we process the following categories of personal data:
- Full name of the user
- Email address
- Phone number
- User account (via Keycloak)
- Authentication tokens (JWT)
- Login records
- Phone call recordings
- Conversation transcripts
- Call transcriptions (text)
- Access and error logs
- Usage statistics
- IP address (anonymised)
Purpose & Legal Basis
Each processing purpose is supported by a specific legal basis under Art. 6 GDPR:
| Purpose | Legal basis | GDPR Article |
|---|---|---|
| Providing the AI reception service | Contract performance | Art. 6(1)(b) |
| User account management | Contract performance | Art. 6(1)(b) |
| Technical support and fixes | Legitimate interest | Art. 6(1)(f) |
| Service quality improvement | Legitimate interest | Art. 6(1)(f) |
| Security and abuse prevention | Legitimate interest | Art. 6(1)(f) |
| Compliance with legal obligations | Legal obligation | Art. 6(1)(c) |
Retention Period
We retain personal data only for as long as necessary to fulfil the processing purpose or as required by law:
Recipients & Processors
To provide the service, we work with carefully selected technology partners who process data exclusively under a data processing agreement:
Identity management & authentication
User account management, SSO login
Cloud infrastructure & AI
Platform hosting, Azure AI Speech, Azure Translator
Telecommunications services
Voice call transmission
We do not sell or rent your personal data to third parties for marketing purposes.
International Transfers
All personal data processing takes place primarily within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards under Art. 46 GDPR:
European Commission-approved model contracts under Decision 2021/914
Transfers to countries with an adequacy decision (USA — EU-U.S. Data Privacy Framework)
Your Rights
As a data subject you have the following rights guaranteed by the GDPR:
You have the right to obtain confirmation of whether we process your personal data and to access it (Art. 15 GDPR).
You have the right to request correction of inaccurate or completion of incomplete personal data (Art. 16 GDPR).
Subject to legal conditions, you have the right to have your personal data deleted (Art. 17 GDPR).
You have the right to request restriction of the processing of your personal data (Art. 18 GDPR).
You have the right to receive your data in a structured, machine-readable format (Art. 20 GDPR).
You have the right to object at any time to processing based on legitimate interest (Art. 21 GDPR).
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
You have the right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), www.uoou.cz.
Submit your request by email to sales@lobee.cz. We will respond without undue delay, within 30 days at the latest. In exceptional cases the deadline may be extended by a further 2 months — we will notify you in advance.
Data Security
We implement technical and organisational measures to protect your personal data against unauthorised access, loss or misuse:
Transfer encryption
TLS 1.3 for all communications
Storage encryption
AES-256 for data at rest
Access control
Role-based access control (RBAC)
Audit logs
Record of all access events
Regular backups
Automated backups with verification
Penetration testing
Regular security audits
In the event of a personal data breach posing a risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR.
Policy Changes
We may occasionally update this privacy policy in response to legislative changes, new platform features, or changes in our data processing practices.
We will notify you of material changes by:
- →Email to the address associated with your account
- →A notification within the Lobee platform interface
- →Updating the "Last updated" date at the top of this document
We recommend reviewing this policy periodically. Archived versions are available upon request.
Contact & Exercising Rights
For any questions about the processing of personal data, exercising your rights, or submitting a complaint, please contact us:
Supervisory Authority
ÚOOÚ