Privacy Policy
Rules and commitments governing the processing and protection of personal data on the Zůstalo.cz marketplace in accordance with the GDPR, the Digital Services Act (DSA), and Responsible Artificial Intelligence Principles (EU AI Act). Learn what data we process, retention periods, how AI moderation and assistance function, and how we safeguard your privacy.
Official policy of the Zůstalo.cz classifieds platform for the Czech market. Operator identification and contact details are set out below.
Updated on 16 October 2026
Operator and contact
- Name / legal name
- Sebastian Wieczorek
- Registered address
- Prameny 826/23, 734 01 Karviná-Ráj, Česká republika
- Company registration / IČO
- IČO: 05612071
- Contact email
- [email protected]
1. Data Controller and Service Overview
The data controller is the operator of the Zůstalo.cz classifieds platform (identification and contact details are shown in the header of this page).
Zůstalo.cz is a free online classifieds marketplace operating in the Czech Republic, focused on construction materials, renovation surplus, and tools. The service provides a contact venue connecting buyers and sellers. We do not provide an online checkout or payment gateway, and we do not process payment card information. All transactions and payments in CZK take place directly between users.
2. Scope of Personal Data We Process and Current Features
Account and authentication: email address, user ID, secure password hash, or one-time login links and magic codes. For business profiles: company name, registration number (IČO), registered office, and business contact details.
Materials listings: listing title, detailed description (up to 7,000 characters), price in CZK (or marked as free for collection), category, technical material attributes (Grade condition grade, units), location (municipality, postal code, and approximate map coordinates), and phone number if you choose to provide it.
Business profiles and craftsmen: company name, IČO, detailed description of activity (up to 15,000 characters), pickup address, business hours, wholesale terms (batch purchase), certificates, and portfolio project photos.
Communications and inquiries: content of internal messages, quick question templates, price negotiation offers, and wholesale batch inquiries (including optional buyer IČO/tax ID), timestamps, and read statuses.
Craftsman inquiries: name, contact information (email or phone), and message text submitted via a craftsman inquiry form, transmitted to the selected professional with your consent.
Phone number anti-scraping protection: seller phone numbers on the site are protected against automated robot scraping and require active user interaction to reveal.
Material Calculator (/kalkulacka) and Printable Fence Sign: material consumption and wastage calculations run 100% locally in your web browser and are not saved to the server. The printable A4 fence banner with QR code generates in-browser; any phone number entered solely for physical print is not stored in our database.
Security audit and IP addresses: client IP address, user-agent string, and UTC timestamps are recorded in the security log during login, registration, and authentication events (retained for 12 months). The IP address is not published on public listings. Anonymous browsing of public listings does not associate IP addresses with user profiles.
3. Responsible Artificial Intelligence (AI) Principles
At Zůstalo.cz, we develop and deploy artificial intelligence and machine learning (AI / ML) technologies in an ethical, safe, and human-centric manner, guided by the EU Artificial Intelligence Act (EU AI Act) and recognized responsible AI principles. AI technologies on our platform serve strictly to assist users and protect the integrity of the building surplus marketplace.
Purpose and Use Cases of AI: We deploy artificial intelligence specifically for: (a) assisting users when creating and refining listings (suggesting material attributes, structuring clear descriptions, and matching appropriate categories), (b) intelligent discovery and recommendations (such as the „Similar Listings“ carousel and contextually linking surplus materials with craftsmen in /remeslnici), (c) calculating material requirements and cut allowances in the construction calculator, and (d) proactive content moderation to block spam, scams, and prohibited materials.
Transparency and Disclosure: Users are informed clearly and openly whenever artificial intelligence tools are active. When assistive features generate draft descriptions or suggest attributes, this is visibly signaled in the user interface. Zůstalo.cz never deploys deceptive bots, concealed generative personas, or algorithms designed to manipulate user behavior.
Human Agency and User Control: Artificial intelligence serves an advisory role and never makes unilateral publishing commitments on behalf of users. Every suggestion (e.g. suggested draft wording, technical specifications) requires the user's voluntary review and confirmation; users retain full freedom to edit, modify, or reject any suggestion prior to publishing.
Fairness and Bias Controls: AI systems at Zůstalo.cz are engineered and tested for objectivity. We do not conduct behavioral profiling, social scoring, or creditworthiness evaluations. Search, ranking, and moderation mechanisms rely on objective technical attributes of construction materials and geographical proximity, preventing unlawful bias or unjustified favoritism.
Privacy by Design and Zero Public Model Training: User personal data, private chat messages, telephone numbers, and listing content are NEVER used to train external, public AI foundational models. Communication with AI models is conducted over encrypted API channels governed by strict Zero Data Retention agreements (prohibiting model providers from retaining query payloads for secondary training).
Technical Robustness, Safety, and Governance: Deployed models undergo regular security testing against adversarial prompt manipulation (prompt injection) and continuous accuracy auditing. Users may submit inquiries, feedback, or anomaly reports regarding AI features at any time via [email protected] or through our support portal at /podpora.
4. Automated Content Moderation and Appeals Procedure (DSA)
In compliance with the EU Digital Services Act (DSA) and to safeguard marketplace participants against fraud, advance-fee scams, spam, and prohibited goods (such as illegal asbestos, hazardous waste, or stolen property), newly posted and modified listings (descriptions up to 7,000 characters, attributes, photos) and craftsman/business profiles (descriptions up to 15,000 characters, logo) are subjected to automated safety review.
Human-in-the-Loop Oversight: When potential safety violations are detected, the system may place the listing or profile on temporary administrative hold. Any definitive sanctions or content rejections are subjected to human moderation oversight.
Right of Appeal: Users whose listings or profiles are suspended or rejected through moderation receive a statement of reasons and maintain the right to lodge a free administrative appeal via our contact form or by emailing [email protected]. Appeals are reviewed by a human compliance specialist within 14 business days.
5. Listing Photos, Mobile Upload Handoff, and Automatic EXIF Metadata Stripping
When listing photos are uploaded and processed, our system automatically and irreversibly removes all EXIF metadata, including camera details and precise GPS location coordinates. This actively protects your home and job site privacy.
The “Phone Photos” feature (/telefon-foto) enables convenient direct image handoff from a smartphone via a single-use QR code and secure, short-lived session token. Uploaded images are immediately sanitized of all metadata upon receipt.
Raw image files containing EXIF metadata are never kept on the public server. Only cleaned, web-optimized formats (WebP/JPEG) are published.
For security and fraud prevention, we maintain an audit trail of image operations. If an image is removed, an encrypted copy is kept in private evidence storage strictly for the legal retention period (12 months).
6. Listing Versioning and Price History
On the public marketplace, editing a listing updates its active content (the latest edit overwrites the previously displayed listing description). To maintain price transparency and protect against deceptive practices, a verified price history is publicly displayed for each listing.
For fraud prevention, dispute resolution, and defense against legal claims, the operator internally preserves an audit trail of modifications including a UTC timestamp and the author’s IP address.
7. Purposes and Lawful Bases
Providing the marketplace service and managing user accounts: Article 6(1)(b) GDPR (performance of a contract on your request).
Platform security, AI safety moderation, fraud prevention, legal claim defense, and listing versioning: Article 6(1)(f) GDPR (legitimate interests of the operator and users in a safe marketplace under the DSA).
Compliance with statutory obligations (responding to lawful requests from public authorities): Article 6(1)(c) GDPR.
Web analytics (Google Analytics 4), conversion measurement (Google Ads), and craftsman inquiry forwarding: Article 6(1)(a) GDPR (your explicit, freely given consent, revocable at any time).
8. Data Retention and Account Deletion (30 Days + 12 Months)
Active service: personal data is kept for as long as your account remains open.
Account deletion request (30-day grace period): when you request account closure, a 30-day grace period applies during which you can cancel the request and restore the account.
Secure legal archive (12 months): after 30 days the account and listings are permanently removed from the live database. Before deletion a secured, non-public archive is created containing the account data, login records (IP addresses), listings with their change history, photos (including removed ones), violation reports and orders, and SHA-256 checksums; the content of private messages is not included. The archive is kept for 12 months solely to defend against legal claims and for law-enforcement and court requests, and is then permanently and irreversibly destroyed.
Login audit logs: authentication and IP records are kept for 12 months and automatically pruned thereafter.
9. Disclosure to Law Enforcement and Courts
We disclose personal and operational data to police authorities, courts, and public prosecutors solely upon receipt of a written, reasoned request grounded in specific statutory law (Article 6(1)(c) GDPR) referencing an official case number.
We log every request in a confidential internal legal registry, verify the authority of the requesting body, and release data strictly within the scope requested (data exports, SHA-256 file manifests). Private chat messages are never released without an express court warrant.
Official legal requests must be sent to the dedicated address [email protected] or the operator’s physical postal address.
11. Data Recipients and Hosting
Public listings can be viewed by all visitors and search engines. Do not disclose sensitive personal information in public listings.
Private conversations are restricted to participants. Authorized operator staff may inspect them only in justified cases of reported fraud, security incidents, or court order.
The service runs on a server operated by the operator in Poland (European Union). To run it we additionally rely on processors: an e-mail service (SMTP), Cloudflare (traffic protection and acceleration, Turnstile anti-spam check), AI model providers through the OpenRouter platform (automatic moderation of listings and, as the service grows, business profiles — the listing text, photos and logo are sent, without account data), the Photon geocoding service on OpenStreetMap data (the town or address you type), browser and mobile push providers (e.g. Google, Apple, Mozilla — only with your consent to notifications) and, only with your consent, Google (Analytics, Ads). Some of them are established or run infrastructure outside the European Economic Area; transfers rely on the European Commission standard contractual clauses or an adequacy decision (EU–US Data Privacy Framework). We use them under their data processing agreements (DPA) or terms of service that contain such provisions.