User privacy notice

CFO Panorama · Hospitality CEE, s.r.o. · version 1.1 dated 26 October 2026 (supersedes version 1.0 dated 30 September 2026)

This notice, including information under Articles 13 and 14 GDPR, explains how Hospitality CEE processes personal data of natural persons who have a user account in CFO Panorama (app.reporting.finance), and of persons whose name and email appear on invitations, password resets or contract-acceptance messages. Czech text prevails if the language versions differ. This notice covers processing where Hospitality CEE is an independent controller (DPA Article 2.3). Accounting and PMS content uploaded by a client is processed as a processor for that client; requests about that content go to the client.

1. Controller

Hospitality CEE, s.r.o., company ID 19489617, registered office Kaprova 42/14, Staré Město, 110 00 Prague 1, Czech Republic, registered at the Municipal Court in Prague, section C, file 387413. Statutory body: Anna Dempsey, executive director. Contact: <privacy@reporting.finance>. No data protection officer has been appointed.

2. Who this notice is for

Users of the Service (admin, editor, viewer), persons invited to an account, and persons who accept the Data Processing Agreement or the Main Agreement for a client. The employer or client that granted you access is a separate controller of that access decision. This also includes applicants for accounts whose activation is approved by provider staff.

3. Purposes and legal bases

Concluding, administering and evidencing the client contract, checking representatives’ authority, approving registrations, managing user accounts, support and necessary transactional messages: for corporate-client representatives and users, Article 6(1)(f) GDPR – legitimate interests in delivering and administering the Service and protecting legal claims; where a sole trader is personally the contracting party, Article 6(1)(b) for steps and performance necessary for that contract. Platform security and diagnostics, including sign-in, 2FA, rate limiting, proportionate security records and abuse detection: Article 6(1)(f) – protecting the platform and client data. Establishing and defending legal claims: Article 6(1)(f). Data required in accounting and tax records: Article 6(1)(c), under applicable accounting and tax laws; ordinary business contacts outside those duties: Article 6(1)(f). We do not make decisions based solely on automated processing, including profiling, with legal or similarly significant effects under Article 22 GDPR.

4. Categories of data

Name, email, position, organisation, role, language and account identifier; data needed for registration, authority checks and support communications; sign-in time and result, IP address, browser identification and two-factor status; minimal security and diagnostic records of access and material operations; transactional-message content and delivery records; contract-acceptance records, versions and hashes and accepting persons’ authority. Client operational history is processed for the client under the DPA; as an independent controller we use only data necessary for section 3 purposes. Passwords are salted hashes and TOTP secrets are encrypted. We do not request a birth number or special-category data for a user account.

5. Client accounting and PMS data

Content the client uploads (journal, documents, payroll, hotel statistics, supplier or guest names) is processed by us as processor under the DPA. Sections 3–4 do not treat that content as our controllership. Address access, rectification or erasure requests for that content to the client (your employer or contracting company). We assist the client through the Service. We forward a request received by us to the relevant client and provide legally required assistance; we do not decide to delete an entire company’s accounting data on an individual user’s request. Our authorised staff may also access data under the DPA for necessary onboarding, import diagnostics and reporting operations.

6. Recipients

Google Cloud EMEA Limited and affiliates (infrastructure, region europe-west3 Frankfurt). Plus Five Five, Inc. – Resend (transactional email; sending may be from the EU, account administration and logs in the USA). Microsoft Ireland Operations Limited (Microsoft 365 support mailbox if you email us). Our employees who need access, bound by confidentiality. Public authorities where the law requires it. Where necessary, also professional advisers bound by confidentiality and courts for protecting legal claims. Current technical service providers are listed at https://reporting.finance/legal/sub-processors.

7. Transfers outside the EEA

Service databases, files and backups are stored in Frankfurt. Resend also processes data in the USA; Google and Microsoft may process or access data outside the EEA through support, global infrastructure or exceptions to regional commitments. For recipients with valid DPF certification covering the transfer, Commission Decision (EU) 2023/1795 applies. Otherwise, before transfer we use appropriate safeguards, in particular agreed standard contractual clauses under Decision (EU) 2021/914 and necessary assessment and supplementary measures. You may request a copy of applicable safeguards or information about them at privacy@reporting.finance; others’ confidential information may be proportionately redacted. Recipient and location details appear in the current provider list.

8. Retention

We retain a user account while its use is authorised; on deletion, we remove the profile and sign-in credentials without undue delay, even where the user previously performed operations. Unsuccessful or abandoned account applications are deleted within 30 days of rejection, withdrawal or the last contact. We do not keep a separate long-term history of routine page views. Necessary security and diagnostic records are retained for no more than 90 days from the event. Any records remaining after user deletion display only an internal label, such as “deleted user #id”, and are deleted within the applicable period. This is pseudonymisation and may still constitute personal data. Client accounting and operational records follow the client’s instructions and the DPA; deleting a user account does not itself delete the client’s accounts.
We retain minimal evidence of the contract, authority, instructions and completed deletion during the contract and normally for no more than 3 years after it ends to protect legal claims. A specific dispute, legal obligation or documented longer applicable period justifies only necessary longer retention; we regularly assess whether the reason continues. Records of a specific incident are kept separately as necessary for resolution and associated duties or claims. These exceptions do not mean blanket retention of client accounting data.
Temporary support working copies are deleted when no longer needed, and minimal correspondence on a closed request within 90 days unless needed for a specific duty or claim above. Resend: message content and delivery records for the period configured in our Resend account (a limited number of days) and in any event deleted no later than 90 days after termination of the account (Resend DPA, Exhibit A). Microsoft 365: deleted messages are recoverable for 14 days and are then removed by Microsoft within its cycle (at most 30 days); no hold or archiving. Mandatory accounting and tax records are kept for the period legally required for their document type. Automatic database backups expire in a seven-day cycle; residual Google copies may be erased up to 180 days from initiation of the relevant deletion at Google. Remaining copies stay protected and deletions are reapplied on restoration.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection to Article 6(1)(f) processing, and portability where processing is automated and based on contract. Use privacy@reporting.finance. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or to the supervisory authority in another EU Member State where you live or work. Erasure is not absolute: necessary data may be retained in particular to comply with a legal obligation or establish, exercise or defend legal claims under Article 17(3) GDPR. We assess and respond without undue delay, normally within one month; any statutory extension is notified with reasons. Identity checks are proportionate.

10. Legitimate interests and objection

Legitimate interests are stated for each purpose in section 3. You may object at any time to Article 6(1)(f) processing on grounds relating to your particular situation. We will stop the processing concerned unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or a need to establish, exercise or defend legal claims. An objection is not treated as an automatic waiver of rights or general consent to retention.

11. Source of data

We obtain data from you (registration, sign-in, 2FA), from the client administrator who invites you, and automatically from your device when you use the Service. Contract-conclusion data are generated in the Service. Providing your name, email and necessary authentication and security data is a condition for creating and securely using an account; without them the account cannot be created or operated. There is no general legal duty to have an account. Data necessary to verify authority are a condition for accepting on a company’s behalf. Optional data need not be provided. When data come from a client, we provide this information no later than our first contact, otherwise within the statutory Article 14 GDPR period.

12. Changes

The current text is at https://reporting.finance/legal/user-privacy-notice. We will notify a material change by email to the account or by a notice in the Service. We provide required information before processing for a new purpose; changing this notice does not itself create a legal basis and does not require user consent where processing relies on another legal basis.