snaprime

Terms of Service

This English translation is provided for convenience only. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails.

Effective from July 1, 2026 · Last updated October 12, 2026 · Annex No. 1 – Data Processing Agreement

These terms of service (the “Terms”) govern the use of the Snaprime software service available at snaprime.com and in the application at app.snaprime.com (the “Service”). The Service is operated by snaprime s.r.o. (the “Operator” or “we”), whose identification details are set out below. You accept the Terms by ticking the consent box when registering an account or ordering the Service, and they apply for the entire time you use the Service.

Operator of the Service
snaprime s.r.o.
Registered office: Plynární 1617/10, Holešovice, 170 00 Praha 7, Czech Republic
Company ID (IČO): 29815487
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 452847
Managing Director (jednatel): Matěj Procházka
E-mail: info@snaprime.com

1. What Snaprime Does

Snaprime is software for creating advertising. The core of the Service, and what you pay the subscription for, is the automated creation of the following outputs based on your profile:

All outputs created in this way are available in the Service for preview, download and export. You may use them anywhere else, independently of any advertising platform.

In addition, the Service offers a supplementary technical feature: a connection to third-party accounts (in particular Meta and the Stripe payment gateway). This connection makes it possible to publish and manage prepared ads directly from Snaprime without entering them manually into those platforms. The connection is merely one of the ways in which the outputs of the Service are delivered. It is neither a separately charged feature nor the essence of the performance. An automated connection via an application programming interface (API) is the technical means of providing this feature; its existence and scope depend on the terms and interfaces of third parties and may change over time (see Article 8).

2. Account and Eligibility

3. Authorization to Act in Connected Accounts

By connecting the relevant third-party account to the Service or by activating a feature that requires such a connection, you expressly authorize us to perform, in your name and in your third-party accounts, the acts necessary to provide the Service, in particular to:

This authorization is voluntary. You grant it by taking an active step when connecting the relevant account or activating the relevant feature, and you may revoke it at any time by removing the connection in your Meta account or by terminating the Service. The authorization also covers the manual execution of instructions directly in your Meta account in the cases set out in Article 8. After the authorization is revoked, it may no longer be possible to provide the Service. Neither revoking the authorization nor terminating the Service automatically stops campaigns that are already running in third-party systems; these must be stopped separately.

4. Your Control and Your Responsibility

The acts under Article 3 are performed automatically by the Service or manually by the Operator on the basis of your settings, approvals and instructions. If you activate automatic optimization or other automated campaign management in the Service, such activation is deemed an instruction to make changes within the scope of that feature and the parameters you have set or approved. All accounts, campaigns, budgets and spend remain yours and under your control. You acknowledge and agree that:

In short: you decide whether to launch a campaign and on its basic parameters. Snaprime performs the technical management and automated optimization of campaigns in accordance with your instructions and the features you have activated; it does not guarantee the business results of a campaign, the functioning of Meta or the budgets you have set or approved.

5. Content Created by the Service and Responsibility for It

Based on the data, texts, images, logos, trade names and other materials you provide (the “Inputs”), the Service automatically generates content proposals, in particular ad copy, visuals, targeting and other materials (the “Outputs”). Outputs are created using, among other things, artificial intelligence technologies and may contain factual inaccuracies, errors or elements that need to be corrected. The Operator does not provide legal, tax or other professional advice and does not warrant that the Outputs are fit for any particular purpose. You retain the rights you hold in the Inputs and grant the Operator a royalty-free, non-exclusive right to use them for the necessary period to the extent required to provide the Service. You represent that you are entitled to use the Inputs for this purpose and to grant such a right.

Approval of content rests solely with you. No Output will be published or launched as an ad without your decision. You must review, verify and approve each Output before using it. To the extent the Operator is entitled to grant a license or other right to an Output or any part of it, it grants you a non-exclusive right, unlimited in territory and time, to use, modify, reproduce, publish and commercially exploit the Output, including use through persons acting on your behalf. Given the nature of generative technologies, the Operator does not warrant that each Output will be unique or eligible for copyright protection, or that a similar output will not also be created for another user.

You are solely and exclusively responsible for the Inputs you upload to the Service and for all content you approve, publish or launch through the Service, in particular for ensuring that such content:

Exclusion of the Operator's liability and indemnification. The Operator is a provider of a technology tool and, to the extent permitted by law, bears no liability for content you approve or publish, nor for any damage, penalty or other harm arising from such content to you or to third parties. If a third party or a public authority asserts any claim against the Operator in connection with content you have approved or published, you undertake, to the extent permitted by law, to indemnify the Operator, in particular to compensate it for the damage incurred, the penalties imposed and the costs reasonably incurred, including legal representation costs, and to provide it with the necessary cooperation in resolving such a claim. You bear all risks associated with the content.

Use of ads for the Operator's marketing purposes. To the extent you are entitled to grant such a right, you grant the Operator a royalty-free, non-exclusive license, unlimited in territory and time, to use the ads and other Outputs created through the Service, including their previews, screenshots and campaign results achieved, for the Operator's marketing and promotional purposes. In particular, the Operator is entitled to publish and share these materials with anyone, including as examples, case studies or references on its website, on social media, in presentations, in its own advertising and in other business materials. The license also covers the use of your business name, name, logo and likeness to the extent they are contained in the ad and you are entitled to permit such use. You are responsible for holding the rights to third-party elements contained in the Outputs that are necessary to grant this license. You may revoke the license with effect for the future by written notice to info@snaprime.com. Revocation does not affect materials lawfully used up to that time.

Use of campaign data to improve the Service and sharing of such data. You acknowledge and agree that the Operator uses data about your campaigns (the “Campaign Data”) to improve the Service and may share it with other persons. Campaign Data means in particular ad copy and headlines, graphics and videos, campaign settings (campaign type, targeting, budgets, placements), sales pages, forms and their questions, your briefs and prompts, your feedback and aggregate campaign results (for example cost per lead, click-through rate or number of leads). Campaign Data does not include the personal data of individual enquirers (leads). We process those solely for you under Annex No. 1 and do not use them for the purposes set out in this paragraph. Where Campaign Data contains other personal data, its processing is also governed by the Privacy Policy.

The Operator is entitled in particular to:

For these purposes, you grant the Operator a royalty-free, non-exclusive license, unlimited in territory and time, to the Campaign Data to the extent the rights to it belong to you and you are entitled to grant such a license. If you do not agree to the use of your Campaign Data under this paragraph, write to us at info@snaprime.com. From the delivery of your notice, we will not use your further Campaign Data for these purposes and will stop newly publishing and sharing your existing Campaign Data. The notice does not affect models, algorithms, templates, general patterns, recommendations or aggregate anonymized values already created on the basis of Campaign Data, nor materials lawfully used up to that time.

6. Payments and Subscription

The terms of any trial period, its length and any transition to a paid subscription are set out in the specific offer before it is activated. An automatic transition to a paid subscription occurs only if this was expressly stated in the offer and a payment method was entered or authorized in advance. Payments are processed by the Stripe payment gateway.

When you order a paid subscription, the Service will display the price and the selected billing period. Unless stated otherwise for a specific offer, the subscription renews automatically for the same period at the end of each paid period, and the price is charged repeatedly to the stored payment method. You may cancel the subscription at any time in your account; cancellation stops further renewals and you may use the Service until the end of the period already paid. Advertising budgets spent with Meta are not part of the subscription price (see Article 4).

If a recurring payment fails, the Operator is entitled to retry the payment within reason, ask you to update your payment method and restrict or suspend access to the Service until the amount due is paid. If the Operator changes the subscription price, it will notify you of the new price in advance; the new price will apply no earlier than to the next renewal period. If you do not agree with it, you may cancel the subscription before it renews. If a specific offer expressly includes a money-back guarantee, a discount or another special arrangement, the terms of that specific offer apply to that extent.

The subscription price is the price for access to the Service as a whole under Article 1, not for individual features, integrations, the number of campaigns launched or the number of leads obtained. The unavailability, change or discontinuation of any supplementary feature or connection to a third-party platform therefore does not give rise to any entitlement to a refund or a price reduction (see Article 8).

Amounts paid are non-refundable. All payments for the Service (subscriptions for any period, credits, add-on services) are final and non-refundable. No entitlement to a refund of the price or any part of it, to a discount, to substitute performance or to any other compensation arises, in particular, where:

In such cases you may cancel the subscription at any time; cancellation prevents further renewal but does not affect the period already paid. This provision does not apply only where a refund is expressly required by a mandatory provision of law or is expressly agreed in a specific offer or in Annex No. 1.

7. Data and Privacy

The processing of personal data for which we are the controller (in particular data about you as a customer: registration, invoicing, communication) is governed by the Privacy Policy. To operate the Service, we also process access credentials and data in your connected accounts (Meta, Stripe) to the extent necessary to provide the Service.

The enquiries (leads) that the Service collects for you are personal data for which you are the controller. We process them solely for you and in accordance with your instructions, i.e. as a processor within the meaning of Article 4(8) GDPR. The terms of this processing are set out in Annex No. 1 – Data Processing Agreement, which forms an integral part of these Terms. By accepting the Terms, you also enter into this data processing agreement. No separate signature is required; Article 28(9) GDPR permits written form, including electronic form.

8. Availability, Dependence on Third-Party Platforms and Limitation of Liability

We provide the Service “as is”. We make reasonable efforts to ensure that it runs without defects, but we do not guarantee uninterrupted operation or any particular business results.

Dependence on third parties. The supplementary features of the Service under Article 1, in particular publishing and managing campaigns directly from Snaprime, are technically possible only thanks to the interfaces (APIs) and permissions provided by third parties, above all Meta Platforms. The Operator does not operate these interfaces, has no legal entitlement to their provision and cannot influence their existence, scope, terms, pricing or the duration of access. You acknowledge and agree that a third party may at any time, even without giving reasons and without prior notice, change, restrict, start charging for, or temporarily or permanently disable its interface, change its rules or withdraw access from the Operator or from you. Such conduct lies entirely outside the Operator's control.

Unavailability of the Meta API and manual execution of instructions. If, as a result of a restriction, change or unavailability of the Meta API, an instruction you have entered in the Service cannot be executed automatically, and it can technically be executed directly in the Meta user interface, the Operator will execute such instruction manually directly in your Meta account. This applies in particular to changing the budget or another campaign parameter, creating or adding a new campaign and launching, pausing or switching it off, and other similar acts supported by the Service.

The Operator will execute a duly entered instruction under the preceding paragraph no later than 72 hours after it is entered in the Service. This period does not run for as long as manual execution is prevented by the unavailability of the Meta platform itself, the blocking or restriction of your account, the withdrawal of the necessary permissions or any other circumstance beyond the Operator's reasonable control. If a widespread outage or other extraordinary event simultaneously gives rise to such a volume of manual requests that, despite reasonable efforts, they objectively cannot all be executed within this period, the Operator will execute them without undue delay.

Consequences. If access is changed, restricted or lost under this Article, including permanently and for all customers of the Service at once, we expressly agree that:

Circumstances excluding liability. The Operator is not liable for the unavailability, restriction or termination of the Service or any part of it caused by circumstances beyond its control, including outages, rule changes or decisions of third-party platforms and providers, connectivity or hosting outages, interventions by public authorities or changes in legislation.

To the extent permitted by law, the Operator is not liable for indirect, consequential or incidental damage (for example lost profits). The Operator's total liability is limited to the amount you have paid for the Service in the last 12 months. The limitations and exclusions under this Article do not apply to the extent they are impermissible under mandatory provisions of law, in particular to harm caused intentionally or through gross negligence.

9. Termination

You may stop using the Service at any time by cancelling your subscription. You may use the Service until the end of the period already paid, unless stated otherwise in the specific offer. Neither cancelling the subscription nor the end of the Service in itself stops campaigns running in Meta's systems at that time; these must be stopped separately in the Service or directly in the Meta account, and until they are stopped you are responsible for ad spend under Article 4. After the end of the paid period, the Operator is entitled to terminate access to the Service and disconnect the connected accounts. The handling, export and erasure of personal data is governed by Article 10, the Privacy Policy and Annex No. 1. The Operator may restrict, suspend or terminate the Service in the event of a breach of these Terms or of third-party rules, non-payment of an amount due, misuse of the Service or a security risk; where the nature of the matter so requires, it may do so without prior notice.

10. Switching to Another Provider

This Article applies only to the extent that the Service is subject to the rules on switching between data processing services under Chapter VI of Regulation (EU) 2023/2854 of the European Parliament and of the Council (the Data Act). The Customer may notify us at info@snaprime.com that it wishes to switch to another provider of a service of the same type, to transfer its exportable data and digital assets to its own ICT infrastructure, or to have them erased after termination of the Service. The notice period for initiating the switching is two months, unless the Operator agrees to a shorter period.

After the notice period expires, the Operator will enable the switching within no more than 30 calendar days. If this period is technically unfeasible, the Operator will inform the Customer within 14 working days and may set an alternative transitional period of no more than seven months. The Customer may extend the transitional period once to the extent permitted by the Data Act. During the switching, the contract remains in effect, the Customer pays the price of the Service and the Operator provides cooperation, continuity and security to the extent required by the Data Act.

Exportable data and digital assets are, insofar as they are stored in the Service or available to the Customer: (i) profile, account and user permission data; (ii) Inputs and media files uploaded by the Customer; (iii) Outputs made available to the Customer; (iv) campaign settings and Campaign Data made available to the Customer, including available results and metrics; (v) enquiries (leads), contacts and related data in the CRM; and (vi) other data created or provided directly by the Customer that the Service allows the Customer to download or export. To the extent permitted by the Data Act, the following categories are excluded from export: source code, models and their internal configuration, internal system prompts, algorithms and internal rules of the Service, security configurations and access credentials, internal logs and telemetry not made available to the Customer, internal analytical datasets and third-party materials that the Operator is not entitled to transfer.

After the end of the transitional period, the exportable data and digital assets will remain available to the Customer for retrieval for at least 30 calendar days and will then be erased to the extent required by the Data Act, unless a legal obligation prevents this. The contractual relationship ends upon successful completion of the switching or, if the Customer requests erasure only, upon expiry of the notice period. Such termination does not in itself give rise to a right to a refund of the price already paid for a prepaid period, unless such a right arises from a mandatory provision of law or a specific offer.

Until January 12, 2027, the Operator may charge for the switching process only the costs directly linked to the specific switching, to the extent permitted by the Data Act; from January 12, 2027, no fee will be charged for the switching process, unless otherwise provided by law. Information on the jurisdiction of the ICT infrastructure and the measures under Article 28 of the Data Act is published and kept up to date by the Operator at snaprime.com/en/subprocessors.

11. Changes to the Terms

The Operator may amend the Terms to a reasonable extent where required by a change in legislation, in the Service or its features, in technology or in the pricing or business model, for security reasons, by third-party terms or by another reasonable operational need related to the provision of the Service. We will inform you of any change that may materially affect your rights or obligations at least 30 days before it takes effect, by e-mail or by a notice in the application. If you do not agree with such a change, you may reject it by cancelling your subscription before the date on which it takes effect. If you have a prepaid period at that time, a change that is materially unfavorable to you will apply to you no earlier than from the next renewal of the subscription, unless earlier application is necessary to comply with the law, a binding requirement of a public authority, to eliminate a security risk or due to a change in third-party terms without which the Service could no longer be provided. If you continue to use the Service after the change takes effect and have not cancelled your subscription, the new version applies. Changes to Annex No. 1 are governed by Article 17 thereof.

12. Governing Law and Contact

These Terms are governed by the laws of the Czech Republic. If you have any questions, contact us at info@snaprime.com.

Annex No. 1

Data Processing Agreement

Version 1.2 · effective from October 12, 2026 · an integral part of the Snaprime Terms of Service
Concluded pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

What this means in plain terms. The enquiries Snaprime brings you are under your control. We store, transfer and display them for you in your account. This Annex is a data processing agreement under Article 28 GDPR and sets out what we may do with personal data, how we protect it, which other processors we may engage and what happens to the data after the Service ends.

1. Parties and Conclusion

The controller of personal data is the customer of the Service – a business (for example a sole trader, small company or marketing agency) that has set up the Service and whose identification details are stated in its account in the Service (the “Controller”, “you”).

The processor is snaprime s.r.o., Company ID (IČO) 29815487, with its registered office at Plynární 1617/10, Holešovice, 170 00 Praha 7, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 452847 (the “Processor”, “we”).

This agreement (the “Data Processing Agreement”) is concluded at the moment the Controller accepts the Terms of Service – i.e. usually by ticking the consent box when registering or ordering the Service. For each Controller, the Processor records the version accepted and the date and time of acceptance. At the Controller's request, the Processor will provide, free of charge, confirmation that this Data Processing Agreement has been concluded, together with its text in a format suitable for archiving; it is sufficient to send the request to info@snaprime.com.

In the event of a conflict between the text of the Terms of Service and this Annex, this Annex prevails in matters of personal data processing.

2. Subject Matter, Nature and Purpose of Processing

The subject matter of processing is the processing of personal data of natural persons who respond to advertising campaigns run by the Controller through the Service, and of any other contacts that the Controller itself enters or imports into the Service (the “Personal Data”).

The purpose of processing is solely the provision of the Service to the Controller, in particular: receiving enquiries from the lead forms of third-party platforms, storing them and displaying them in the Controller's account, keeping them in the Service's CRM, notifying the Controller of new enquiries, evaluating campaign performance and providing technical support to the Controller.

The nature of processing consists mainly of automated operations: collection, recording, storage, structuring, consultation, use, disclosure to the Controller, restriction, erasure and backup.

The Processor does not process Personal Data for its own purposes, does not use it to build its own database, to offer its own services to data subjects or to train artificial intelligence models, and does not sell it or otherwise transfer it to third parties outside the scope of this Data Processing Agreement.

3. Categories of Data Subjects and Categories of Personal Data

Categories of data subjects Categories of personal data
Prospects who have completed an enquiry form in the Controller's ad (typically property owners considering a sale, prospective buyers, persons interested in a mortgage or financial advice) Identification data (first name and surname); contact data (telephone number, e-mail address); data provided in answers to form questions (e.g. location, type and condition of the property, time horizon, indicative price, reason for the enquiry)
Contacts that the Controller itself enters or imports into the Service Data to the extent entered by the Controller
All of the persons listed above Operational and technical data relating to the enquiry (date and time of submission, ad, ad set and campaign identifier, source and channel); records of work with the enquiry in the Service's CRM (status, the Controller's notes, history of status changes, record of notifications sent)

Special categories of personal data under Article 9 GDPR and data relating to criminal convictions under Article 10 GDPR are not processed within the Service. The Controller undertakes not to enter such data into the Service and not to configure ad forms to collect it. If the Controller breaches this obligation, it alone is responsible for the consequences.

4. Duration of Processing

The Processor processes Personal Data for the duration of the contractual relationship under the Service and thereafter for the period necessary to settle the rights and obligations of the parties, but no longer than the period specified in Article 14 of this Annex.

5. Obligations of the Controller

The Controller represents and undertakes that it:

  • is the controller of the Personal Data and is responsible for the lawfulness of its processing, in particular for the existence of an appropriate legal basis under Article 6 GDPR and for being able to demonstrate it;
  • will fulfill its information obligations towards data subjects under Articles 13 and 14 GDPR – i.e. that its own privacy policy is available, up to date and referenced in the ad form, and that it lists the categories of its processors therein;
  • will give the Processor only lawful instructions and will not require it to process data in breach of the law;
  • will use the Personal Data in the Service solely for the purpose for which it was obtained, and for any other purpose only on the basis of its own legal basis;
  • will secure its access credentials to the Service and manage the permissions of the members of its team to whom it grants access to the Service; the Controller is responsible for the conduct of such persons;
  • has entered or will enter, in its own name, into a contractual relationship with the operator of the advertising platform (in particular Meta Platforms Ireland Limited) and has accepted its terms for lead ad forms, on the basis of which the enquiries are provided to it.

6. Processing Only on Documented Instructions

The Processor processes Personal Data only on documented instructions from the Controller, including with regard to transfers to a third country or an international organization. The following are deemed documented instructions of the Controller:

  • this Data Processing Agreement and the Terms of Service;
  • the settings and actions the Controller performs in its account in the Service (for example switching on a campaign, setting up a form, exporting data, deleting an enquiry);
  • a written instruction sent from the Controller's contact e-mail address to info@snaprime.com.

Where processing is required of the Processor by Union or Member State law, the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. If the Processor has reasonable grounds to suspect that an instruction of the Controller infringes the GDPR or other data protection legislation, it will immediately inform the Controller and is entitled to refuse to carry out such instruction.

7. Confidentiality

The Processor ensures that persons authorized to process Personal Data (employees, contractors, suppliers) have committed themselves to confidentiality or are under a statutory obligation of confidentiality. This obligation continues after their relationship with the Processor ends. Only those who need access to Personal Data to perform their tasks have such access (principle of least privilege).

8. Security of Processing

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of natural persons, the Processor has implemented appropriate technical and organizational measures under Article 32 GDPR, in particular:

  • encryption in transit of all communications using TLS (version 1.2 and higher) and encryption of data in the storage of infrastructure providers;
  • encryption of sensitive secrets at rest – access tokens to the Controller's third-party platform accounts are stored encrypted and are not available in plain text;
  • access control – named accounts, multi-factor authentication for administrator access, principle of least privilege, regular review of permissions and immediate removal of access when cooperation ends;
  • separation of environments – the production environment is separated from development and testing environments; real Personal Data is not used in the development environment;
  • logging and monitoring – records of administrator access and significant operations, automatic reporting of errors and security events;
  • backup and recoverability – regular database backups with point-in-time recovery, regular verification of recoverability;
  • secure development – dependency and update management, code review before deployment, separation of secrets from source code;
  • incident response – a defined procedure for detection, assessment, mitigation and notification under Article 10 of this Annex.

The Processor is entitled to change and replace individual measures over time, provided always that the level of security is not reduced.

9. Sub-processors

The Controller grants the Processor general written authorization to engage other processors in the processing pursuant to Article 28(2) GDPR, under the conditions set out in this Article.

The current list of sub-processors, including the purpose of their engagement, the categories of data processed and the place of processing, is permanently available at snaprime.com/en/subprocessors and forms part of this Data Processing Agreement. The Processor keeps it up to date.

The Processor will inform the Controller in advance of any intended addition of a new sub-processor or replacement of an existing one, at least 14 days in advance, by e-mail to the Controller's contact address or by a notice in the application. Within this period, the Controller has the right to raise a reasoned objection to the change at info@snaprime.com. If the parties fail to resolve the objection, the Controller is entitled to stop using the Service with effect from the date on which the new sub-processor is engaged, without penalty and with a refund of the pro rata portion of the subscription already paid for the unused period.

The Processor will contractually impose on each sub-processor the same data protection obligations as those set out in this Data Processing Agreement and remains fully liable to the Controller for the performance of their obligations as if it were performing them itself.

10. Personal Data Breach Notification

If the Processor becomes aware of a personal data breach, it will notify the Controller without undue delay, and no later than 48 hours after becoming aware of it. The notification will be sent by e-mail to the Controller's contact address stated in the account and will contain, where available: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point for further information. Where not all information is available at once, the Processor will provide it in phases without further undue delay.

Notification of the breach to the supervisory authority (the Office for Personal Data Protection, Úřad pro ochranu osobních údajů) under Article 33 GDPR and communication to data subjects under Article 34 GDPR are carried out by the Controller; the Processor will provide it with all necessary assistance for this purpose.

11. Assistance by the Processor

11.1 Data Subject Rights

The Processor assists the Controller by appropriate technical and organizational measures in fulfilling its obligation to respond to requests for the exercise of data subject rights under Chapter III GDPR (access, rectification, erasure, restriction of processing, portability, objection). The Controller can carry out most of these actions itself directly in the Service (in particular viewing, correcting, exporting and deleting an enquiry). Where this is not possible, the Processor will carry out the action on the Controller's instruction without undue delay, and no later than within 10 working days.

If a data subject submits a request directly to the Processor, the Processor will not handle it itself, will forward it to the Controller without undue delay and will inform the data subject accordingly.

11.2 Obligations under Articles 32 to 36 GDPR

The Processor assists the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR – i.e. security of processing, notification and communication of breaches, data protection impact assessment (DPIA) and any prior consultation with the supervisory authority – taking into account the nature of processing and the information available to the Processor.

11.3 Records of Processing Activities

The Processor maintains records of all categories of processing activities carried out on behalf of the Controller under Article 30(2) GDPR and makes them available to the Controller on request.

12. Information and Audit

At the Controller's request, the Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

Practical rules: an audit may be carried out no more than once per calendar year (and additionally at any time following a demonstrable security breach or at the request of the supervisory authority), on the basis of a written request delivered at least 30 days in advance, on working days and during business hours, so as not to disrupt the Processor's operations unreasonably, and on condition that the auditor is not a competitor of the Processor and is bound by confidentiality. The costs of the audit are borne by the Controller, unless the audit reveals a material breach of the Processor's obligations. The Processor is entitled to fulfill its obligation under this Article also by providing its own security documentation or the documentation and certifications of its infrastructure providers, provided that this fulfils the purpose of the audit.

13. Transfers to Third Countries

Personal Data is processed primarily within the European Union. Some sub-processors established outside the EU or with global infrastructure (listed in the list under Article 9) may transfer data to a third country, in particular to the United States of America.

Such a transfer takes place solely on the basis of a valid legal instrument under Chapter V GDPR, in particular: a European Commission adequacy decision (for recipients certified under the EU–U.S. Data Privacy Framework) or the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical measures. The specific instrument used is indicated for each recipient in the list of sub-processors. The Processor ensures that these instruments are concluded, and the Controller hereby authorizes the Processor to do so.

14. Deletion or Return of Data upon Termination

After the end of the provision of the Service, the Processor will, at the Controller's choice, delete the Personal Data or return it to the Controller and delete existing copies, unless Union or Member State law requires storage of the data.

Practical procedure: after the subscription ends, the Controller retains the ability to export its enquiries from the Service in a structured, commonly used and machine-readable format for 30 days. After this period expires, the Processor will delete or irreversibly anonymize the Personal Data in its production systems no later than 90 days after termination. Data is removed from backup copies automatically as part of the standard backup cycle, no later than within 180 days; during this period, the backups are secured and are not used for any purpose other than restoring operations. The Controller may request earlier deletion or return of the data in writing at any time; the Processor will comply with such a request without undue delay and will confirm the deletion to the Controller in writing upon request. If a shorter mandatory period for complete erasure under the Data Act applies to a specific termination or switching, that shorter period prevails.

Data necessary to demonstrate compliance with the Processor's legal obligations (in particular accounting and tax records) is retained for the period prescribed by law; deletion under this Article does not apply to such data.

15. Liability

Each party is liable for damage caused by a breach of its obligations under the GDPR and this Data Processing Agreement to the extent provided in Article 82 GDPR. The limitation of liability under Article 8 of the Terms of Service does not apply to obligations under this Annex to the extent such a limitation is impermissible under mandatory provisions of law.

16. Data Protection Contact

The Processor's contact point for all submissions under this Annex – instructions, objections to sub-processors, requests for assistance, incident reports and requests for a signed copy of this agreement – is the e-mail address info@snaprime.com. The Processor has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR.

17. Term and Changes to this Annex

This Data Processing Agreement is concluded for the duration of the contractual relationship under the Service and terminates together with it; provisions which by their nature are intended to survive termination (in particular confidentiality and the obligations under Article 14) remain in force.

Changes. Unlike the other provisions of the Terms of Service, this Annex cannot be changed unilaterally without the Controller's knowledge. The Processor will notify the Controller of any intended change at least 30 days in advance by e-mail or by a notice in the application, together with an overview of what is changing. If the Controller does not agree with the change, it is entitled to stop using the Service as of the date the change takes effect, without penalty and with a refund of the pro rata portion of the subscription already paid for the unused period. If the Controller continues to use the Service after the date the change takes effect, it is deemed to have accepted the new version. Updates to the list of sub-processors under Article 9 are governed by the time limits set out in Article 9 and are not considered a change to this Annex.

The Processor archives all previous versions of this Annex and will provide them to the Controller on request.

18. Final Provisions

This Annex is governed by the laws of the Czech Republic and shall be interpreted in accordance with the GDPR and Act No. 110/2019 Coll., on the Processing of Personal Data. If any provision of this Annex is invalid or ineffective, this does not affect the validity of the other provisions. Disputed provisions shall be interpreted in favor of compliance with the GDPR.