Data protection at CFO Panorama – in brief

Who is who: Your company is normally the controller; Hospitality CEE, s.r.o. is the processor of client data under the DPA. Any processor chain must satisfy Article 2.2. The accepted DPA contains standing instructions for necessary onboarding, imports, mapping, diagnostics, support and reporting operations. Each such staff access does not require a separate ticket or consent. For limited purposes of our own, such as platform security and contract evidence, we are an independent controller under the user notice.

What data: Accounting exports, chart of accounts, cost centres, activities, jobs/projects/orders, budgets and possibly PMS statistics. These may contain suppliers’, employees’ and guests’ personal data; their scope is not automatically insignificant. Minimise data and prefer aggregates. Do not upload special categories, Article 10 GDPR data or birth numbers without prior written agreement under Article 4.2 and appropriate measures.

Where data are: Service databases, files and backups are in Google Cloud in Frankfurt. Resend also processes transactional emails in the USA; Microsoft 365 is used for support. Overseas support and global infrastructure may involve transfers outside the EEA. Article 8 and Annex C set out the applicable mechanisms and providers; an EU region alone is insufficient. List: https://reporting.finance/legal/sub-processors.

Security and access: Client separation, roles, mandatory 2FA for admins, editors and staff, encryption and seven-day database backups. The provider’s superuser has full administrator rights in every group for instructed activities, including imports and reporting setup; second-factor verification is renewed at least every 12 hours. Necessary access and material-operation records are visible under Settings → Platform access log. Routine security and diagnostic records are kept for no more than 90 days; the operational history of your reporting (imports, mapping, entries, user changes) is part of your data and is deleted with it; no separate long-term history of routine page views is maintained. Exceptions for specific incidents, duties and legal claims are narrow and documented.

Incidents: We notify you of a personal data breach without undue delay and within 48 hours of becoming aware (including notice from a sub-processor).

Sub-processors and AI: Changes are notified under DPA Article 7, normally 30 days in advance; changes to a supplier’s own sub-processors and urgent situations follow the special procedure in Articles 7.2 and 7.4; the right to object and obtain a resolution remains. No client AI feature is active. A future feature through Vertex AI with an EU endpoint requires prior notice of the specific processing and your express documented instruction; data will not be used to train models.

Deletion and termination: You normally have 30 days’ read-only export access. An authorised person may request earlier deletion of specified or all client data at any time; the export period then need not expire first. Active-system deletion occurs without undue delay and is more than hiding data. Database backups expire in a seven-day cycle and residual Google copies in its cycle up to 180 days from initiation of the relevant deletion. Only narrowly justified statutory data and minimal legal-claims evidence may remain under Article 14.5. Deleting a user account does not itself delete the whole company’s data; “deleted user #id” is not automatically anonymisation.

What we need from you: Identify every company and establish authority under the DPA. Where joint representation is required, all necessary persons accept the same text and company schedule; alternatives are a valid power of attorney or signed document. Group membership alone gives no authority. Uploads are blocked until acceptance and necessary authorisation are complete. Complete Annex A, manage users, minimise data and retain your own original accounting records. User notice: https://reporting.finance/legal/user-privacy-notice. Contact: privacy@reporting.finance.

This summary (version 1.4 dated 26 October 2026) is guidance only and not part of the contract. The applicable DPA, version 1.4, governs. The Czech version prevails.