I. Introductory information and the data controller

This Privacy Policy explains which personal data of users of the FFF EXPO application (the ‘Application’) is processed, for what purposes and on what legal grounds, to whom it may be disclosed, and what rights users of the FFF EXPO application have in connection with the processing of their personal data.

The controller of personal data obtained through use of the FFF EXPO application is Future Advanced Technologies, z.ú., with its registered office at Brigádníků 44/2, 100 00 Praha 10, Czech Republic, company identification number 19075341, registered in the Register of Institutes maintained by the Municipal Court in Prague under file number U 1132 (the ‘Controller’).

The Controller’s contact email for personal data protection matters is [email protected].

II. Scope of the Privacy Policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the ‘Regulation’), Act No. 110/2019 Coll., on the Processing of Personal Data, and other generally binding legislation governing the processing of personal data, this Privacy Policy applies to all Users of the Application.

The scope and manner of personal data processing depend on each User’s role, how they use the Application and its features, whether they are a Registered Participant or a Public User, and whether they have activated the Match-Making feature in the Application.

Capitalised terms used in this Privacy Policy have the meanings given to them in the Terms of Use of the FFF EXPO Application.

III. Sources of personal data

The Application processes personal data:

IV. Categories of personal data processed

Personal data means any information about a User by which the User can be identified. Depending on the feature used and the mode of the Application, the following data is processed:

V. Purposes of processing, legal bases and processing periods

When registering in and using the Application, personal data is processed for the purposes of:

Purpose of processing Legal basis
Registration and administration of user accounts Provision of the Application’s services, namely performance of the Controller’s obligations towards the User as a data subject arising from use of the Application, pursuant to Article 6(1)(b) of the Regulation.
Use of the Application’s services as such
(excluding the Match-Making profile visibility and networking feature)		 Provision of the Application’s services, namely performance of the Controller’s obligations towards the User as a data subject arising from use of the Application, pursuant to Article 6(1)(b) of the Regulation.
Match-Making profile visibility and networking The User’s consent pursuant to Article 6(1)(a) of the Regulation.
A Registered Participant may withdraw their consent to Match-Making separately at any time by selecting the option to opt out of Match-Making in Settings. Once this choice has been processed, the Registered Participant will no longer be included among Match-Making users, and their profile visibility, searchability and communication associated with this feature will be disabled. Public content remains available. Withdrawal does not affect the lawfulness of previous processing of the disclosed data and does not automatically remove information or content that has already been made available to another User.
Improving the Application The User’s consent pursuant to Article 6(1)(a) of the Regulation.
Consent may be withdrawn at any time through the privacy settings in the Application.
Protecting against misuse of the Application The Controller’s legitimate interests pursuant to Article 6(1)(f) of the Regulation.
Protecting, defending or exercising the Controller’s rights and claims The Controller’s legitimate interests pursuant to Article 6(1)(f) of the Regulation.
Recording consent and handling the exercise of the User’s rights Compliance with a legal obligation of the Controller pursuant to Article 6(1)(c) of the Regulation.
The Controller’s legitimate interests pursuant to Article 6(1)(f) of the Regulation.

Processing periods

The Controller retains the User’s personal data for the period necessary to fulfil the purpose of processing. Personal data is processed during active use of the Application and for up to 5 years after the last activity, unless otherwise specified below.

The User’s personal data processed in connection with contact between the User and the Controller will be processed until the User’s request or enquiry has been dealt with.

The User’s personal data processed to comply with a legal obligation of the Controller will be processed for the period prescribed by the relevant legislation.

The Controller may process the User’s personal data for the purposes of its legitimate interests, in particular personal data it may need to defend its legal claims, during active use of the Application and for up to 10 years after the last activity.

Personal data processed on the basis of the User’s consent will be processed for as long as that consent remains in force. Analytics and statistical data (cookies and similar technologies) processed on the basis of the User’s consent will be processed for as long as that consent remains in force, but for no longer than 6 months.

Following withdrawal of consent, an Application reset or another request, data will be erased, anonymised or its further use restricted to the extent that the Controller no longer has a legal basis for it. This may require a reasonable period for technical implementation. Content and information already provided to other users may remain in their possession. Retention periods of individual third parties are governed by their terms and the settings of the service used.

VI. Firebase, analytics and diagnostics, push notifications

The Application uses certain services of the Google Firebase platform. These services help analyse use of the Application, diagnose technical issues and ensure the Application’s proper operation and configuration.

In particular, the following Firebase services are used:

Google Analytics for Firebase (GA4)

Google Analytics for Firebase enables the collection and evaluation of information about use of the Application, such as interactions with individual features and screens of the Application, events, usage time, device technical parameters, operating system version, Application version and other data relating to use of the Application. The data is not used for advertising targeting or automated decision-making producing legal or similarly significant effects.

Google Analytics for Firebase is activated only on the basis of the User’s prior consent. If the User does not give consent, analytics data for the purposes described above will not be processed through this service. Consent may be withdrawn at any time through the privacy settings in the Application. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Names, email addresses, telephone numbers, search content, private messages, photographs, or sign-in or encryption data are not sent to analytics. Technical IDs of viewed lists, exhibitors, delegations and fields, as well as the ID or QR code of a viewed participant, are recorded to evaluate the content used; these identify the content, rather than the signed-in User. The User’s Firebase UID, User-ID, chat identifiers and actual page addresses are not added. Advertising identifiers, Google Signals and advertising integrations are not used.

Diagnostics and Crashlytics

Diagnostic tools, including the Firebase Crashlytics service provided by Google, are used to ensure the stability, security and proper operation of the Application.

Crashlytics helps record and analyse Application crashes and technical errors. In this connection, information about device type and model, operating system version, Application version, the time and circumstances of an error, technical data about the Application’s operation, and identifiers relating to the device or Application installation may be processed in particular.

This data is used exclusively to diagnose errors, enhance the stability and security of the Application, and improve its operation.

Firebase Remote Config

The Firebase Remote Config service is used to configure certain features and parameters of the Application remotely.

Remote Config allows selected settings of the Application to be changed remotely without releasing a new version of the Application. This service may be used, for example, to configure features, the user interface, technical parameters or other properties of the Application.

In connection with use of Remote Config, technical information about the device, the Application and its installation, and other data necessary to deliver the relevant configuration may be processed.

Remote Config is used primarily to ensure the proper operation, configuration and maintenance of the Application, and the gradual introduction or modification of features.

Google LLC provides the Google Analytics for Firebase (GA4), Firebase Crashlytics and Firebase Remote Config services described above. In connection with the provision of these services, Google may process technical data and other information in accordance with the terms and documentation of the respective services.

Push notifications

The OneSignal service, provided by OneSignal, Inc., is used to send push notifications.

OneSignal enables delivery of notifications relating to use of the Application to users.

In connection with the provision of push notifications, identifiers required for push notification delivery, the Application installation identifier, the sender’s name and information about notification delivery may be processed in particular.

VII. Recipients of personal data

Personal data may be disclosed to entities that carry out further processing of personal data for the Controller, in particular service providers through which the Controller ensures the operation of the Application. Each entity to which the User’s personal data is transferred is bound to protect it.

Specifically, we transfer the User’s personal data to the following entities:

FFF / Future Soldier API: https://admin.future-soldier.org/;

Google Firebase: https://firebase.google.com/ and Google Cloud: https://cloud.google.com/;

OneSignal: https://onesignal.com/ and Apple and Google services;

hosting, network infrastructure and content distribution providers, including services on the admin.future-soldier.org.cz, future-forces-forum.org and future-forces-forum.com domains and Cloudflare: https://www.cloudflare.com/;

Google Fonts: https://fonts.google.com/;

The User’s personal data may also be transferred to public authorities in connection with judicial proceedings, proceedings concerning administrative offences and other administrative proceedings, preliminary inquiries and investigations into criminal offences, and to insurers for the settlement of insurance claims, or when complying with the Controller’s obligations under applicable law.

XIII. Transfers of personal data outside the EEA

In connection with the use of certain third-party services, personal data may be processed or transferred outside the European Economic Area (the ‘EEA’), in particular in the provision of cloud, analytics, diagnostic, communication, security and other technical services.

In such cases, personal data is transferred using an appropriate mechanism recognised under applicable law, such as an adequacy decision or standard contractual clauses, where applicable to the transfer concerned.

IX. Security of personal data

The Controller uses appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or making available of personal data transmitted, stored or otherwise processed, and unauthorised access to it. Only authorised persons who need the data to perform their duties have access to personal data.

Personal data is regularly backed up in encrypted form and stored securely so that it can be restored in the event of an emergency.

X. Automated decision-making and profiling

No automated decision-making or profiling that would produce legal effects concerning the User or otherwise significantly affect the User is carried out as part of the processing of Users’ personal data.

XI. Rights of data subjects

The User has the right of access to personal data concerning them that is being processed, the right to request its rectification and completion, the right to object to processing, and the right to request restriction of processing if they find that the data is inaccurate or is being processed contrary to applicable law. In certain cases, the User has the right to obtain personal data in a format allowing it to be transferred to another controller, and, subject to the conditions laid down by applicable law, the right to erasure of personal data. The User may exercise all their rights by emailing [email protected] or by writing to the registered office of Future Advanced Technologies, z.ú., at Brigádníků 44/2, 100 00 Praha 10, Czech Republic.

To protect personal data and prevent unauthorised access to it, the applicant’s identity may be verified when handling a request to exercise the rights set out above. Where there are reasonable doubts about the applicant’s identity, the Controller may request proportionate additional information or another appropriate verification necessary to confirm that the request is legitimate. The scope of verification will correspond to the nature of the request and the risk of unauthorised disclosure of personal data.

If the User considers that the processing of personal data infringes the Regulation, they also have the right to lodge a complaint with the Czech Office for Personal Data Protection at Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic.

XII. Changes to the Privacy Policy and effective date

The Controller may unilaterally review and update this Privacy Policy. The User will be informed of changes through a notice published in the Application before they take effect. In the event of a material change to the Privacy Policy, the Controller may require renewed confirmation of consent to this Privacy Policy before the next sign-in.

This Privacy Policy takes effect on 7 October 2026.

© 2010 – 2026 FUTURE FORCES FORUM. All rights reserved.