Personal Data Processing Policy
Netlion s.r.o., Company No. 05999235, registered office at Vladislavova 85, Vysoké Mýto-Město, 566 01 Vysoké Mýto, Czech Republic, registered in the Commercial Register kept by the Regional Court in Hradec Králové, file no. C 39080
Version 1.0, effective from 2026-08-23
This is a translation. The Czech version prevails in the event of any discrepancy.
This policy describes the processing of personal data in the operation of the QueryBeam service under Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").
Article 1 – The Operator's position
1.1The Service is ordered in two ways, and in each of them somebody different is responsible for the Called Person's personal data:
| Ordered by an individual | Ordered by an organisation | |
|---|---|---|
| Who orders | a consumer | a provider of health services, a provider of social services, or a company |
| Controller of the Called Person's data | the Operator | the organisation; the Operator is the processor |
| Legal basis for calling | the Called Person's consent | a legal basis held by the organisation |
| Where rights are exercised | with the Operator | with the organisation |
1.2What decides is who entered the Called Person into the Service. Where the Service calls because a provider of health services, a care service or a company ordered it, the right-hand column applies; where an individual ordered the calling for themselves or for a close person who consented to it, the left-hand column applies.
1.3In relation to the data of users of the Service, that is persons holding an account, the Operator is always the controller, irrespective of how the Service was ordered.
1.4An individual who orders calling for themselves or for a close person acts, as a rule, in the course of a purely personal activity under Article 2(2)(c) GDPR and does not become a controller.
Article 2 – Data of users of the Service
2.1The Operator processes the following categories of data:
| Category | Data | Source |
|---|---|---|
| Registration | name, e-mail, password as a hash | from the user |
| Sign-in through Google, Microsoft or Facebook | name, e-mail, account identifier | from the provider, where the user chooses that route |
| Verification | telephone number, record of verification | from the user |
| Billing | details for issuing a document, history of credits and payments | from the user |
| Operational | sign-ins, IP address, actions in the application, audit records of changes | arise from use |
2.2Purposes and legal bases of processing:
| Purpose | Legal basis |
|---|---|
| Providing the Service and managing the account | performance of a contract — Article 6(1)(b) GDPR |
| Billing and accounting | compliance with a legal obligation — (c) |
| Security, prevention of misuse, audit trail | legitimate interest — (f) |
| Support and communications concerning the Service | performance of a contract — (b) |
| Commercial communications about the Operator's services | legitimate interest — (f); may be refused at any time |
2.3Data is retained for the duration of the account. After the account is closed it is retained for 3 years on account of possible claims; accounting documents for 10 years under Act No. 235/2004 Coll., on value added tax.
Article 3 – The Called Person's data where an individual ordered the calling
3.1In this case the Operator is the controller.
3.2The legal basis is the Called Person's consent under Article 6(1)(a) GDPR and, for health data, under Article 9(2)(a) GDPR.
3.3Before the first call, a message is sent to the Called Person containing a verification code and the wording to which the Called Person consents by confirming the code; the full wording is in Consent to Telephone Questioning. Without a confirmed code the Service does not call.
3.4Consent may be withdrawn at any time, during a call or at info@querybeam.eu. On withdrawal the calling stops and data resting solely on that consent is deleted. Withdrawal has no consequences for the Called Person and need not be reasoned.
3.5A call produces:
a)a recording and transcript of the call in full, that is everything said during it;
b)answers to the questions entered by whoever entered the Called Person into the Service, including the verbatim quotation the answer arose from;
c)operational data about the call, that is its time, duration and outcome.
3.6The recording and transcript are retained for 12 months from the call and are then deleted. What remains with a recorded answer is only the quotation it arose from.
3.7The call is conducted by an automated voice assistant. The Called Person is informed of this at the beginning of every call.
3.8The recorded answers are made available to the person who entered the Called Person into the Service. The Called Person is informed of this in the wording referred to in Article 3.3.
3.9The rights under Article 6 are exercised by the Called Person with the Operator at info@querybeam.eu.
Article 4 – The Called Person's data where an organisation ordered the calling
4.1The Operator calls on behalf of the organisation that instructed it. That organisation is the controller, the Operator is the processor and processes the data solely on the organisation's instructions under a data processing agreement.
4.2The scope of data produced by a call and its retention are the same as under Article 3.
4.3The rights under Article 6 are exercised by the Called Person with that organisation. Should the Called Person approach the Operator, the Operator shall pass the request to the organisation without undue delay and inform the applicant accordingly; it cannot settle the request itself, as it does not decide about the processing.
4.4Details are in the Patient Information.
Article 5 – Recipients of data and transfers to third countries
5.1Providers of telephone services, voice interaction, text processing, hosting and electronic mail delivery take part in operating the Service. The current overview is set out in the list of sub-processors.
5.2Some providers are established outside the European Economic Area. A transfer relies on an adequacy decision or on standard contractual clauses under Chapter V GDPR; the mechanism used is stated for each of them in the overview under Article 5.1.
5.3The Operator does not sell personal data and does not pass it on for third-party advertising.
Article 6 – Rights of the data subject
6.1A data subject has the right of access to their data, to rectification, to erasure, to restriction of processing, to portability, and the right to object to processing based on legitimate interest (Articles 15 to 21 GDPR). Consent given may be withdrawn at any time (Article 7(3) GDPR).
6.2Rights are exercised at info@querybeam.eu. The Operator replies within one month.
6.3Where the rights concern data from calls and the calling was ordered by an organisation, they are exercised with that organisation under Article 4.3. Access and erasure are available to the organisation directly in the application. On exercise of the right of access, the data subject receives a machine-readable file containing everything stored, which also satisfies the right to portability under Article 20 GDPR.
6.4Where an individual ordered the calling, the Operator settles the request itself, to the same extent and by the same means.
6.5A statutory exception applies to the right to erasure, and solely on the organisation's side: data forming part of medical records must be retained by the provider of health services and the right to erasure does not reach it (Article 17(3) GDPR in conjunction with the law of the state in which the provider provides health services; in the Czech Republic Section 53 of Act No. 372/2011 Coll., on health services). In such a case the data subject is told which parts of the request were met and on what grounds the remainder was not (Article 12(4) GDPR). Where an individual ordered the calling this exception does not arise, as the Operator keeps no medical records.
6.6A data subject has the right to lodge a complaint with a supervisory authority, in the state of their habitual residence, place of work or place of the alleged infringement, or with the authority competent for the Operator, being the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. A list of the authorities of all Member States is kept by the European Data Protection Board at edpb.europa.eu.
Article 7 – Security
7.1Access to data is limited to persons who need it for the performance of their work, and all of them are bound by confidentiality. Transmissions are encrypted and changes to data are logged.
7.2A detailed overview of the measures is in the Data Security Declaration; it is provided to organisations as Annex B to the data processing agreement.
Article 8 – Changes to the policy
8.1The Operator is entitled to update this policy. It informs users of any substantial change in advance, by electronic mail or in the application.
8.2A change is issued as a new version; effective wording is not altered retrospectively.