GDPR and your data rights

BeMetrix is operated from the Czech Republic and works under EU data-protection law (GDPR). This article explains where your data lives, how long we keep it and how to exercise your rights.

Where the data lives

• Application and database hosting is inside the European Union.
• Traffic between your browser and the platform is encrypted in transit (TLS).
• Stored data is encrypted at rest, including database storage and backups.
• Sub-processors are engaged by category (hosting, email delivery, payment processing, AI providers) under data-processing agreements; the current categories are listed in the privacy policy.

Controller and processor

For workspace operational data — creators, shifts, transactions, payouts — the studio is the controller and BeMetrix is the processor. For account data (your login, billing records) BeMetrix is the controller. A creator asking about their own operational records should ask their studio first; we support the studio in fulfilling the request.

Retention

• Active workspaces — operational records are kept while the workspace is active, because reporting and payout history depend on them.
• Billing and invoicing records — kept for the period EU and Czech accounting law requires, even after an account closes.
• Deleted accounts — operational data is removed after deletion is confirmed; residual copies in encrypted backups age out on the normal backup rotation.
• Support correspondence — kept only as long as it is useful for handling the case and any follow-up.

Your rights

You can request access to your personal data, a copy in a portable format, correction of inaccurate data, deletion, restriction of processing, or object to a particular processing activity. You can also withdraw consent where processing is based on consent.

Making a request (DSAR)

1. Write from the email address on the account through /contact or to support@bemetrix.com.
2. Say which right you are exercising and which workspace it concerns.
3. We verify that you are who you say you are before acting — this protects you, so expect a verification step.
4. We respond within one month; complex requests may be extended once, and we will tell you if that happens.

For a self-service copy of operational records, most of what you need is already available — see exporting your data. For account closure, read data privacy first: deletion is permanent.

Complaints

If you are not satisfied with how we handled a request, you may complain to your local supervisory authority, or to the Czech Office for Personal Data Protection.