Subprocessors

Version 1.4 · effective from the date of publication of this version on recenzik.cz.

Here we list the providers that we actually use in the operation of the Recenzík service and who may come into contact with personal data.

We intentionally keep the list short. We only list what we truly use.

1. Overview of Providers

2. Scope of Involvement

Google Ireland Limited / Google Workspace

Operates our contact and work email inbox partner@recenzik.cz. During communication, it may access names, email addresses, message contents, and attachments, including order materials, submitted review texts, and draft replies.

When we ask a client to fill out an onboarding form at the beginning of our cooperation, the answers are stored in Google Forms on our Google Workspace account, or optionally in a linked Google Sheets table. This involves data the client themselves provides in the form: contact for the approving person, reply style, verified facts about the premises, and rules on what we may or may not include in the replies. We do not collect passwords, access credentials, or payment data via the form.

Cloudflare, Inc.

Provides hosting and delivery for the recenzik.cz website, DNS, TLS, and protection against attacks. It processes technical visit data, mainly IP address, time, browser type, and the requested page.

Website fonts are self-hosted and loaded directly from our hosting. The website contains no analytics, tracking codes, or advertising scripts, and does not store tracking cookies.

Outscraper LLC

We used a one-time purchased commercial dataset about businesses. It contains public data about premises: name, address, field, website, public phone and email, and public ratings.

This source does not apply to client orders. We use it exclusively for our own selection of companies to call with an offer. Data from client orders does not enter it, and vice versa.

OpenAI

Purpose: technical text processing and drafting of replies.

Transferred data: only data necessary for the specific text processing, mainly the review content and related context necessary to draft the reply. Contractually relevant categories of personal data are detailed in the Data Processing Agreement, especially in Art. 4 and 6.

We do not transfer: access passwords, tokens, or access to the client's Google account. According to our processing terms, the model provider must not use the inputs for training.

Human control: the output is merely a draft. Nothing is published autonomously; every text is reviewed by a member of the Recenzík team. It is published either by the client, or — during the pilot or continuous care, if agreed in writing and Recenzík has valid authorization and verified access — manually by Recenzík.

We use the same technical processing when preparing sample replies for companies we are just offering the service to. In such cases, we are the data controller — see Privacy Policy, Art. 5.

3. Transfers outside the EU

Some providers above are based in the USA or may transfer data there. These transfers are based on standard contractual clauses adopted by the European Commission, or an adequacy decision, according to the terms of the given provider.

4. What we do not use

This list is just as important as the previous ones:

• We have no connection to the Google Business Profile API. We do not need the client's Google account password or 2FA code and never ask for either. We do not publish any reply automatically. We may manually publish replies on behalf of the client during the pilot or continuous care if the mode is agreed in writing, we have valid authorization, and we have verified access to the profile granted through Google's official mechanism. The client may remove access at any time. If we do not have authorization or access, we email the text to the client for them to publish.
• We do not use Facebook, Booking, or other review platforms.
• We do not use bulk email tools or third-party CRMs.
• We do not use analytics, ad networks, or traffic tracking tools.
• We do not use any other artificial intelligence provider than the one listed in the overview above.

5. Changes to the List

We inform clients about intended changes to this list at least 30 days in advance by email. The client may object within this period following the procedure in Art. 6 of the Data Processing Agreement.

Inquiries regarding this list: partner@recenzik.cz