Internal working document. Serves as a reference basis for answering vendor due-diligence questionnaires from clients/tenants and for an internal overview of personal data processing on the Sokordia iSpis platform. It supplements, and does not replace, the formal Record of Processing Activities under Art. 30 GDPR (/onas/doc/gdpr-zaznamy) and the public Privacy Policy (/onas/doc/privacy-policy).
Version: 1.0 | Date: 2026-01-01 | Prepared by: Mgr. Martin Šárfy
Data Protection Officer (DPO): Mgr. Milan Kvasnica, attorney (milan@kvasnica.cz). Appointment confirmed as currently valid.
Sokordia operates the multi-tenant SaaS platform Sokordia iSpis for clients (tenants) active mainly in consumer lending, debt/claims management and collection, background screening, and communication with public authorities (data mailboxes, courts, bailiff and insolvency registries).
With respect to the personal data of a tenant's end customers, debtors, and screened persons, Sokordia generally acts as a processor — the purpose and means of processing are determined by the tenant (controller) under a data processing agreement/terms of service. As an independent controller, Sokordia only processes its own administrative data (billing, system user accounts, operational logs).
"Tenant" in this document means a Sokordia business client operating its own logically separated instance on the platform, identified by an internal code (ak).
A detailed breakdown of individual processing activities and their legal bases is maintained in the Record of Processing Activities (gdpr-zaznamy.md). In summary, this covers mainly:
The legal basis is mainly a contract between the tenant and the data subject (loan agreement, debt collection agreement), legitimate interest (protection of property, enforcement of claims), and compliance with legal obligations; for public registries, the basis is the statutory public nature of the data.
Across tenants, this mainly includes:
The exact data model is specific to each entity (table) in the system — see the Record of Processing Activities, item 4, for the full list.
The platform is designed so that data belonging to different tenants is logically separated and inaccessible across tenants (separation at the database/application level by tenant identifier). User access is restricted exclusively to the data of the tenant they belong to.
| Area | Vendor | Note |
|---|---|---|
| Production server hosting | own server in own rack, in a building operated by a Czech internet service provider | building with permanent physical security and CCTV; CZ/EU |
| Cloud storage | Google Cloud Platform — Google Ireland Limited | EEA region only (Ireland) |
| SMS gateway | ATS Praha s.r.o., Garden Eleven, Kubánské náměstí 11, 100 00 Praha, Company ID 27635007 | |
| Postal mail delivery | Česká pošta, s.p. | confirmed, currently in use |
| Accounting | Marta Vránová, Brušperská 657, 739 23 Stará Ves nad Ondřejníkem, Company ID 13599275, VAT CZ5756110613 | |
| Access to public registries | Chamber of Bailiffs of the Czech Republic (Exekutorská komora ČR), Slovak Chamber of Bailiffs (Slovenská komora exekútorov) | confirmed by invoice in expense records |
| Hosting services | Web4U, s.r.o. | confirmed by invoice in expense records |
| Sending and receiving SMS | Interactive Marketing, s.r.o. | confirmed by invoice in expense records |
Data processing agreements are in place with all subprocessors that process personal data (either in writing or via agreed, published terms of service).
All infrastructure processing tenant personal data is operated exclusively within the European Economic Area (Czech Republic — own server; Ireland — Google Cloud Platform). Outside the EEA, personal data is not transferred or made accessible, with the exception of publicly available screening results from public registries, which are public by law.
Formal certification (e.g. ISO 27001) and regular external penetration testing are in preparation. Security is currently addressed on an ongoing basis through internal code review and monitoring of cybersecurity recommendations.
Retention periods are set individually according to the requirements of the specific tenant and are driven mainly by statutory archiving periods for lending and debt-collection purposes, or by the tenant's own records retention schedule. After the retention period expires, or at the tenant's request, personal data is irreversibly destroyed (not merely deactivated).
Requests from data subjects (access, rectification, erasure, portability, etc.) may be submitted by e-mail to info@sokordia.cz. Requests are handled without undue delay, typically within a few business days, depending on the nature of the request and cooperation from the relevant tenant (in its role as controller).
The company has a formal Incident Response Plan in place (incident-response-plan.md). If a security incident involving personal data is detected, it is handled internally according to this plan, and the affected tenant is informed without undue delay so that it can fulfil its own notification obligations under Art. 33/34 GDPR, if applicable.
Access to tenants' personal data is limited to the minimum circle of people involved in developing and operating the platform. Employees and collaborators with potential access to the data are contractually bound to confidentiality.
As a processor, Sokordia informs the affected client (tenant, in its role as controller) at the contact specified in the relevant agreement, in particular about:
Notification is provided in writing (by e-mail to the client's contact person) and is documented.
/onas/doc/gdpr-zaznamy/onas/doc/privacy-policy/onas/doc/incident-response-plan/onas/gdpr© 2026 Sokordia, s.r.o. All rights reserved. Confidential — internal document, not for external distribution without prior written consent of Sokordia, s.r.o.