Privacy policy

Who is the controller

The controller is the company named in the site footer, with the registered office and identifiers stated there. For data protection matters, contact us at the e-mail address in the Contact section.

What data we process

We process only what you give us, plus the technical data needed to run the site:

• From the contact form: your name and company, an e-mail or phone number, and the text of your message.
• From the analysis order form: full name, company, company ID, e-mail, phone, the systems you use, where those systems run, headcount and a description of your brief.
• Technical data: IP address and the submission timestamp, kept briefly as protection against spam and abuse.
• During the entry analysis: information about your infrastructure and processes, governed by a separate contract and an NDA.

Why we process it and on what legal basis

• Handling your enquiry and communicating with you — basis: steps prior to entering a contract (Art. 6(1)(b) GDPR).
• Protecting the forms against spam and abuse — basis: legitimate interest (Art. 6(1)(f) GDPR).
• Measurement using tools that store data on your device — basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Meeting legal obligations such as accounting and tax — basis: legal obligation (Art. 6(1)(c) GDPR).

How long we keep it

• Enquiries that do not lead to an engagement: at most 12 months from the last contact.
• Client data: for the duration of the engagement and then for the period required by law (usually 10 years for accounting records).
• Anti-spam technical data: at most 30 days.
• Measurement consent: 12 months, after which we ask again.

Who we share it with

We never sell data. We share it only with processors necessary to operate: our web hosting and e-mail providers and, where you have consented, the analytics tools. Data processing agreements are in place with all of them.

Data connected to the entry analysis stays in the EU. If a specific project required anything else, you would be told in advance and in writing.

Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy,
• have inaccurate data corrected,
• have your data erased (the “right to be forgotten”), where we have no other lawful ground,
• restrict how we process it,
• receive your data in a portable format,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of prior processing,
• lodge a complaint with the Czech Data Protection Authority (uoou.cz).

Security

The site is served exclusively over HTTPS. Only the team members handling an enquiry can see what you send. We sign an NDA as standard before an entry analysis begins.