This Notice explains how we process personal data about users of the ComGuide educational service, comprising the account and course website and the connected realtime training environment (the “Portal”), in accordance with Regulation (EU) 2016/679 (the “GDPR”).
1. Who controls your data
The controller is ComGuide a.s., with its registered office at Libečkova 252/1, Řeporyje, 155 00 Prague 5, Company ID No. 178 51 319, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. B 27795.
Data-protection contact: gdpr@comguide.cz
Considering the scale of processing, we have not appointed a data protection officer.
2. What data we process
a) Registration and profile data — first and last name, gender, profession, communication language, email address, password stored only in a secured form, and your legal-document and marketing choices.
b) Course activity data — course progress, login and activity dates and times, total time in the application, number and duration of training conversations, selected input mode, ratings, feedback and related evaluation results.
c) Training conversation content — text transcripts of conversations with the virtual character, including automatic speech transcription, and related context needed to conduct and evaluate the training.
We do not store an audio recording of your voice. The live audio stream is transmitted to the AI providers used for the conversation solely to process the conversation and transcription. Provider accounts are configured without persistence and without using the content for AI training. ComGuide retains the text transcript.
d) Technical data — IP address, browser and device type, cookies and similar technologies, language and functional preferences stored in the browser, diagnostics, and Portal usage analytics.
We do not intentionally process special categories of personal data. Do not enter real personal data about patients, clients or other people into avatar conversations.
3. Why and on what legal basis we process data
| Purpose | Data | Legal basis |
|---|---|---|
| Managing the account and providing the Course, including the virtual character and training feedback | a), b), c) | Performance of a contract (Article 6(1)(b) GDPR) |
| Reporting Course completion to the Customer | Name and data listed in section 4 | Our and the Customer’s legitimate interests (Article 6(1)(f) GDPR) |
| Improving and developing the Portal | b), c), d), pseudonymised or anonymised as far as possible | Legitimate interests (Article 6(1)(f) GDPR) |
| Scientific research and professional publications | Only anonymised data | Anonymous data is not personal data; anonymisation based on legitimate interests |
| Sending news and offers for other Courses | Email and name | Voluntary consent, withdrawable at any time (Article 6(1)(a) GDPR) |
| Optional usage analytics | d) | Consent (Article 6(1)(a) GDPR) |
| Portal security, abuse prevention and technical troubleshooting | d) | Legitimate interests (Article 6(1)(f) GDPR) |
| Compliance with legal obligations | Necessary data | Legal obligation (Article 6(1)(c) GDPR) |
You may object at any time to processing based on legitimate interests.
4. Data disclosed to the Course Customer
If an organisation ordered and paid for your Course access, we disclose only:
- your first and last name;
- Course progress;
- date of last activity;
- total time spent in the application;
- number of completed training conversations and selected input mode.
We do not disclose your training conversation transcripts to the Customer. The Customer sees only whether and to what extent you completed the Course.
5. Processors and other recipients
| Processor / service | Purpose | Note |
|---|---|---|
| Hosting infrastructure | Hosting the Portal, Realtime environment and databases | ComGuide-rented VPS located in Germany/EU |
| OpenAI | Conversational voice processing, transcription, response generation and evaluation | Processes live audio, scenario context and transcripts; configured without persistence or training use |
| ElevenLabs | Conversational voice processing and virtual-character speech synthesis | Processes live audio, scenario context and transcripts; configured without persistence or training use |
| Mixpanel | Optional Portal usage analytics | Loaded only after analytics opt-in |
| Google Tag Manager | Management of optional analytics tools | Loaded only after analytics opt-in |
| Twilio SendGrid | Sending emails, particularly account verification and notifications |
Some providers are established in the United States. ElevenLabs, Mixpanel and Twilio participate in the EU–U.S. Data Privacy Framework. Transfers to OpenAI are governed by its data-processing agreement and, as applicable, EU Standard Contractual Clauses or a relevant adequacy decision.
We may also disclose personal data to public authorities where required by law.
6. How long we retain data
- Account, Course activity and transcript data — while your account exists. We delete or anonymise the account and related data after two years from your last activity, or earlier upon request.
- Technical access logs — 30 days.
- Data disclosed to the Customer — retained by the Customer as an independent controller under its own rules.
- Email used for news — until consent is withdrawn.
- Evidence of legal-document acceptance and marketing-consent history — in a minimal form for as long as necessary to demonstrate compliance and protect legal claims, including after account deletion.
- Anonymised data — without a time limit.
Data necessary to comply with legal obligations or protect legal claims is retained for the period required by law or the applicable limitation period.
7. Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection to legitimate-interest processing, withdrawal of consent, and complaint to a supervisory authority. In the Czech Republic, the authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
Exercise your rights by emailing gdpr@comguide.cz. We will respond without undue delay and no later than one month.
8. Cookies, browser storage and analytics
The Portal uses:
- essential cookies for login, CSRF protection, security and storing your cookie choice;
- browser storage for language choice and, in Realtime, functional participant information, particularly language, gender and email;
- Mixpanel and Google Tag Manager only after your analytics opt-in; we use them for anonymous or pseudonymous usage statistics that help us improve the Portal.
You may reject analytics and later change your choice using “Cookie settings”. The Portal remains usable without analytics consent.
9. Security
We protect data through appropriate technical and organisational measures, particularly encrypted transport (HTTPS), access controls, secured password storage and contractual safeguards with processors.
10. Changes to this Notice
We may update this Notice, particularly when processors or Portal functions change. The current version is always available on the Portal; we will notify you of material changes by email or at login.
This Notice is available in Czech, English and German. If the language versions conflict, the Czech version prevails.