Privacy Policy of the Alive App Application


1. Table of Contents

2. Introductory Provisions

2.1. The purpose of this Privacy Policy of the Alive App Application (the “Policy”) is to provide complete information about the processing of personal data of an Alive App User, including the fulfillment of any information requirements within the meaning of Articles 13 and 14 of the General Data Protection Regulation (the “GDPR”).

2.2. By using the Alive App mobile application (the “Application” or “Alive App”) or by downloading it on a device of a user (the “User”), as appropriate, you represent that you are duly acquainted with this Policy, understand its wording, and take note of any and all information.

2.3. If you have any questions prior to accepting this Policy, contact GTS Alive Group using the below contact details.

2.4. The use of Alive App shall be governed by the terms of use that are available here.

3. Data Controller, Data Protection Officer, and Contact Details

Data controller is GTS ALIVE Group s.r.o., identification number (IČ): 09296727, with its registered office at Na Maninách 1092/20, Holešovice, 170 00 Prague 7, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, section C, entry no. 334013 (“GTS Alive Group”).

3.1. You can contact the controller using:

  • Telephone at +420 226 222 335
  • Fax at +420 226 222 300
  • Email at legal@gtsalive.com
  • Mail at GTS ALIVE Group s.r.o., identification number (IČ): 09296727, with its registered office at Prague 7, Na Maninách 1092/20, Postcode: 170 00

3.2. The controller has appointed the following Data Protection Officer (DPO): Mgr. Karel Beck, email: legal@gtsalive.com, tel.: +420 226 222 325

4. Alive App Installation

4.1. Purpose: The purpose of the Application is to provide services, and particularly to allow User authentication to gain universal access to different Alive Profiles for individual countries, display of digital Cards, and other products and services in different countries, including other services associated with individual Alive Profiles in individual countries (e.g. insurance coverage, etc.). Individual functionalities of the Application are described below. In order to select the preferred language and country settings, it will be verified whether such preferences correspond to the device settings; if this is the case, these preferences will be used as the Application settings. If the selected language and/or country preferences are not available, English will be selected without default country and language settings; the User may configure these settings afterwards. If the language of the selected country is not available, even though the Application is available in the given country, English will be selected (or another language, depending on User’s preferences).

4.2. Legal basis for the processing: performance of a contract in the form of the provision of Application services; Application services cannot be used without the processing of personal data.

4.3. Categories of personal data concerned: network identifiers, device IP address, device settings, date, time, and data required for installation.

4.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

4.5. Transfers to third countries: to be ensured only if the User activates the Alive Profile in countries outside the EU, solely to an administrator of such profile, subject to a User’s confirmation.

4.6. Period for which the personal data are stored: throughout the use of the Application; after this period only in cases specified in Article 11. If a login for Alive App is created; however, the Alive Profile is not activated, the relevant data will be deleted within 24 hours.

5. Verification of consents of individuals who are under the age limit provided for by the applicable legislation

5.1. Purpose: If User authentication is requested by a person who is under the age limit provided for by the applicable legislation (such User intends to use an information society service provided by GTS Alive Group), the processing of personal data shall only be lawful if and to the extent that such consent was given or approved by a person that exercises parental supervision over such minor. Consequently, GTS Alive Group requires that the consent be approved by a legal guardian by such User, whereas the personal data of such legal guardian shall be retained for the purpose of authenticating such person and registering such consent. Age verification shall be carried out both for the Application and the Alive Profile during the Alive Profile registration. Overview of age limits for individual countries is available here.

5.2. Legal basis for the processing: performance of a contract, compliance with a legal obligation, and legitimate interest. A parent’s consent cannot be verified without the aforementioned processing. You can object to our legitimate interest.

5.3. Categories of personal data concerned: data concerning the User and his/her legal guardian and verification of consents, including the relevant logs and network identifiers, and legal guardian’s contacts.

5.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

5.5. Period for which the personal data are stored: throughout the use of the Application; after this period only if provided for by Article 11.

6. Discount search

6.1. Purpose: to show available discounts and benefits near you; if you give your consent, we will use the location of your device for this purpose.

6.2. Legal basis for the processing: consent that may be withdrawn at any time.

6.3. Categories of personal data concerned: device location data, network identifier, data about available discounts and benefits, IP address, information about date and time of use of functionalities.

6.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

6.5. Period for which the personal data are stored: 24 hours.

7. Application push notifications

7.1. Purpose: to notify you of important information and/or messages; if you give your consent in your device settings, we will use the Application notifications within your device for this purpose.

7.2. Legal basis for the processing: consent that may be withdrawn at any time.

7.3. Categories of personal data concerned: information about notification, network identifier, data about the notification contents, and associated data for ensuring the notification.

7.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

7.5. Period for which the personal data are stored: 24 hours.

8. Alive Profile notifications

8.1. Purpose: to notify you of important information and/or messages; if you give your consent, we will use the Application notifications for this purpose – i.e. notifications that are linked to your Alive Profile. These messages are always sent by an administrator of the given profile; the administrator shall also act as data controller for this purpose.

8.2. Legal basis for the processing: consent that may be withdrawn at any time.

8.3. Period for which the personal data are stored: no more than one year.

8.4. Detailed information about the processing is included in the principles relating to processing of personal data of the controller in the given country – an overview is available here.

9. User authentication before signing-in to the Alive Profile

9.1. Purpose: in order to sign-in to the Alive Profile of the selected country, it is first necessary to verify the identity of the person that signs-in (or email address of such person, as appropriate); this is done through the Application. In order to verify an email address, the User must confirm the relevant link. Once the authentication process is completed, the User can sign-in to different Alive Profiles in individual countries. Consequently, GTS Alive Group thus ensures identity check for the Alive Profile administrator, together with the transfer of data required to sign-in to the Alive Profile. For more information about the Alive Profile click here. The User shall set up access (Application login) using a password. The User may change his or her password in the Application settings; if the User forgets the password, it can be reset using his or her email address.

9.2. Legal basis for the processing: performance of a contract; identity cannot be verified for the purpose of signing-in to the Alive Profile without the processing of personal data.

9.3. Categories of personal data concerned: email address, password, authenticated User’s ID, network identifiers, authentication date and time, authentication verification.

9.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

9.5. Period for which the personal data are stored: personal data are stored for the period the Application login is used. If the email address verification process is not completed, the personal data used for the relevant purpose will be deleted after 24 hours. If the email address verification process is completed; however, the Alive Profile registration/sign-in is not completed, any personal data will be deleted after 24 hours from the verification. Selected data, such as logs, will be retained for the period necessary to document compliance, as foreseen in Article 11.

10. Displaying information about products, contests, and other information in the Application without signing in

10.1. Purpose: In case the email address verification process is not completed or is already invalid (more than 24 hours after the email verification), the purpose of the Application is to display information in the same manner as on a website.

10.2. Legal basis for the processing: performance of a contract; the Application cannot be used in this manner without the processing of personal data.

10.3. Categories of personal data concerned: network identifiers, IP address, language and country, information about the use of the Application, displayed information, and date and time such information is displayed.

10.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

10.5. Period for which the personal data are stored: 24 hours.

11. Cookies

11.1. Cookies must be used to ensure all functionalities of the Application. Cookies are small text files classified as follows:

  • Technical cookies: these cookies cannot be disabled, as they are necessary for contract performance – they ensure various functionalities of the Application;
  • Analytical cookies: these cookies are subject to express consent of the User; they are typically used to ensure statistics, analyses, and to improve Application functionalities.

11.2. Overview of all cookies available in the Application:

Technical cookies:

  • Sentry by Functional Software Inc.
  • This service is used to monitor system stability and to identify any errors in the code. We receive application malfunction notifications from the service.
  • Legal basis: performance of a contract.
  • Categories of personal data concerned: device information, data about the use of the Application, IP address, User ID.
  • Recipients: Functional Software Inc., 132 Hawthorne Street, San Francisco, California 94107 United States of America.
  • Terms of service: Data Privacy for Mobile | Sentry Documentation.
  • Transfers to third countries: USA – on the basis of standard contractual clauses.
  • Data retention period: Data are deleted once they are not necessary for the purposes of the processing; however, no more than 90 days.
  • Keycloak by Red Hat
  • This service is used to sign in and verify users.
  • AUTH_SESSION_ID and AUTH_SESSION_ID_LEGACY: Keycloak internal cookie; ID of current authentication session in the following format: session_id.keycloak_node_name.
  • KEYCLOAK_IDENTITY and KEYCLOAK_IDENTITY_LEGACY: Keycloak internal cookie; identification token of the current authenticated user.
  • KEYCLOAK_SESSION and KEYCLOAK_SESSION_LEGACY: Keycloak internal cookie; ID session of the current authenticated user in the following format: realm_name/user_id/session_id
  • KEYCLOAK_REMEMBER_ME: Customizable attribute – whether the login page is to remember a User’s username.
  • KEYCLOAK_LOCALE: Customizable attribute – whether the login page is to remember a User’s username.
  • KC_RESTART: Keycloak internal cookie; internal functional attribute.
  • Legal basis: performance of a contract.
  • Categories of personal data concerned: technical data, network identifiers.
  • Recipients: GTS ALIVE Group, Red Hat.
  • Terms of service: open source tool provided by Red Hat https://www.redhat.com/en
  • Transfers to third countries: USA – on the basis of standard contractual clauses.
  • Data retention period:
  • AUTH_SESSION_ID – for the duration of the session
  • AUTH_SESSION_ID_LEGACY – for the duration of the session
  • KEYCLOAK_IDENTITY – for a period of 90 days
  • KEYCLOAK_IDENTITY_LEGACY – for a period of 90 days
  • KEYCLOAK_SESSION – for a period of 90 days
  • KEYCLOAK_SESSION_LEGACY – for a period of 90 days
  • KEYCLOAK_REMEMBER_ME – for a period of 1 year
  • KEYCLOAK_LOCALE – for the duration of the session
  • KC_RESTART – for the duration of the session.

Analytical cookies:

  • Google Analytics by Google
  • This service is used to obtain statistics and information about the use of the Application.
  • Legal basis: consent that may be withdrawn at any time in the Application settings.
  • Categories of personal data concerned: information about the Application, device information, location, network data and analytical data.
  • Recipients: Google USA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Terms of service:
  • This service records Application errors and circumstances thereof; it thus allows quicker corrections.
  • Legal basis: consent that may be withdrawn at any time in the Application settings.
  • Categories of personal data concerned: Application malfunction and reasons for such malfunction, IP address, User ID, Application settings configuration, network and technical data.
  • Recipients: Google USA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Collected data: device information, data about the use, IP address, User ID.
  • Terms of service: Privacy and Security in Firebase (google.com)
  • Transfers to third countries: USA – on the basis of standard contractual clauses.
  • Data retention period: Data are deleted once they are not necessary for the purposes of the processing; however, no later than 90 days.
  • Google Cloud Vision by Google
  • This service is used for the purpose of the initial validation of a photograph uploaded for a card.
  • Legal basis: consent that may be withdrawn at any time by sending an email to the contacts.
  • Data categories: a photograph and parameters for assessing such photograph – compliance with requirements for a card photo (check for face and its position, any headwear, etc.)
  • Recipients: Google USA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Terms of service: Data Usage FAQ  |  Cloud Vision API  |  Google Cloud
  • Transfers to third countries: USA – Google USA; on the basis of standard contractual clauses.
  • Data retention period: Data are deleted immediately after validation; however, in any case within 24 hours.

12. Contents of the Application after signing-in to the Alive Profile

12.1. Alive App allows Users to sign-in to a single profile that includes the Alive Profile user interface (the “Alive Profile”). By using the Alive Profile, you acknowledge that it is operated by another entity – GTS Alive Group s.r.o., which only provides the Application (and not the Alive Profile), shall not be responsible for the contents of such profile or related processing of personal data. With regard to its purposes, GTS Alive Group does access any data provided during the Alive Profile registration or use of other Alive Profile services.

12.2. For more information about the Alive Profile in individual countries click here.

12.3. In order to ensure that data are linked between the Application and the Alive Profile, GTS Alive Group stores information about the fact that a certain Alive Profile is active for a specific Application login. However, GTS Alive Group does not collect any data or information from the Alive Profile.

12.4. If the User switches between different Alive Profiles (in different countries) in the Application, GTS Alive Group stores information about the fact that another profile in another country was added to a specific Application login. However, once again, GTS Alive Group cannot automatically access any profile data, whereas the controller (administrator) in the relevant country shall be responsible for each profile.

12.5. Users are permanently signed in to their Alive Profiles in the Application in order to allow the use of instant functionalities. Users may sign out at any time.

13. Legitimate Interest

13.1. Purpose: In the event GTS Alive Group carries out the above processing, then, following the termination thereof, it collects limited documents and personal data in order to protect its own rights, to defend any claims made, and also to protect its rights during court/administrative/control or other proceedings.

13.2. Legal basis for the processing: legitimate interest of GTS Alive Group with a view to protect its rights, document compliance and defend itself in respect of supervisory authorities. You may object to this legitimate interest at any time.

13.3. Categories of personal data concerned: evidence of legal acts, such as granted consents, confirmations, relevant logs, submitted requests to exercise rights, etc.

13.4. Recipients: only contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

13.5. Period for which the personal data are stored: GTS Alive Group shall retain such collected data for a period of 3 years from the expiry of the processing period set down by another purpose under this Policy. The period shall not end before any initiated court or other proceedings and associated deadlines for any appeals.

14. Compliance with Legal Obligations

14.1. Purpose: Where GTS Alive Group is required to retain certain documents under the applicable legislation, it does so for the purpose specified by such legislation. One example is the retention of documents in the area of insurance, bookkeeping, and taxes.

14.2. Legal basis for the processing: compliance with a legal obligation.

14.3. Categories of personal data concerned: only such data or documents that are to be retained under the applicable legislation.

14.4. Recipients: only contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

14.5. Period for which the personal data are stored: GTS Alive Group shall only retain such collected data for a period defined by the applicable legislation.

15. User’s Rights and Exercising Such Rights

15.1. Any processing of personal data shall respect User’s rights guaranteed by this article.

15.2. Right of access to personal data – your right to obtain from GTS Alive Group, without undue delay, information about which personal data are being processed, purpose of processing, recipients, retention period, and information about associated rights.

15.3. Right to rectification – right to obtain from GTS Alive Group, without undue delay, the rectification of inaccurate personal data or completion of any incomplete data.

15.4. Right to erasure (“right to be forgotten”) – right to obtain from GTS Alive Group, without undue delay, the erasure of your personal data.

15.5. Right to restriction of processing of your personal data – right of the User to obtain from GTS Alive Group restriction of processing, provided the requirements of Article 18 of the GDPR are met (e.g. accuracy of personal data is contested, the User has objected to processing, etc.).

15.6. Right to data portability – right to receive the personal data concerning you, which you have provided to GTS Alive Group and which are processed by automated means on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller or to have the personal data transmitted directly to another controller, where technically feasible.

15.7. Right to object to processing of personal data that concern you. GTS Alive Group shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which also includes profiling. If you object to such processing, your personal data will no longer be processed for such purposes.

15.8. Right to lodge a complaint to a supervisory authority, i.e. the Office for Protection of Personal Data (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice, www.uoou.cz.

15.9. You have the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. GTS Alive Group does not base any of its decisions solely on automated processing.

15.10. You can request partial or complete erasure or blocking of your personal data at any time and free of charge; you can also request information about personal data concerning you that we store and apply for the rectification of such data. You can simply contact us using the above contact details.

15.11. We will handle all your requests without undue delay, but in any case no later than 30 days in duly justified cases.

15.12. If you wish to exercise your right, in your capacity of data subject, with regard to GTS Alive Group, in its capacity of controller, or if you wish to submit any requests, inquiries or complaints relating to the processing of personal data, use our contact details.

16. Final Provisions

16.1. The processing of personal data shall be governed by the laws of the Czech Republic.

16.2. This Policy is effective as of 1 July 2023.

16.3. GTS Alive Group may amend this Policy as and when necessary. Any such changes shall be effective on the date of notification or on a later date specified in the notification thereof.

‍