Privacy policy

Effective from [DD Month YYYY]

This policy explains how I process the personal data you provide through the gradiamdigital.cz website – in particular through the contact form. I follow Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.

1. Data controller

Tomasz Dziwoki, a self-employed individual registered in the Czech Republic, Company ID (IČO): [04835344], registered address: [Javorník 205, 696 74 Javorník].
Email: [tomasz@gradiamdigital.cz], phone: [+420 608 751 002].

I have not appointed a Data Protection Officer, as I am not legally required to do so.

2. What data I process

• Contact form data: your name or company name, email address, the service you selected and your message, if you write one.
• Further correspondence: if you email or call me, I process the information you share with me.
• Website usage data (only with your consent): if you accept analytics cookies, Google Analytics records which pages you visit, how long you stay, where you came from, your device and browser type and your approximate location (city, country). According to Google, Google Analytics 4 does not store IP addresses.
• Technical data: when you submit the form, your IP address – only as a one-way hash, to protect against spam. The hosting provider also automatically keeps server logs: IP address, time of access, page requested and browser type.

3. Purposes and legal bases

• Replying to your enquiry and preparing a quote – Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).
• Protecting the website and form against spam and misuse – Art. 6(1)(f) GDPR (legitimate interest in running the website securely).
• Keeping correspondence in case of a dispute – Art. 6(1)(f) GDPR (legitimate interest in protecting legal claims).
• Measuring visits with Google Analytics – your consent under Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications. You can withdraw your consent at any time.
• If we sign a contract: performing it – Art. 6(1)(b) GDPR, and meeting legal obligations such as tax and accounting – Art. 6(1)(c) GDPR.

I don’t sell your data, and I don’t send you marketing messages or newsletters without your consent.

4. How long I keep data

• Enquiries that don’t lead to a project: [12 months] after our last contact.
• If we sign a contract: for its duration and then for the period required by law (especially tax and accounting rules) or needed to protect legal claims.
• IP address hash (spam protection): no longer than 1 hour.
• Google Analytics data: [2 months] (retention period set in the Google Analytics account).
• Your cookie choice: 12 months, after which the website asks again.
• Server logs: according to the hosting provider’s settings, [no longer than XX days].

5. Who receives the data

I process the data myself. To run the website and email, I use the following processors:

• Hosting provider: A2 Hosting, LLC, 1201 North Market Street, Suite 111-N73, Wilmington, DE 19801 USA (trading as “hosting.com”).
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – provider of Google Analytics and Google Tag Manager (only if you give consent).
• Email provider for the mailbox that receives form messages: A2 Hosting, LLC, 1201 North Market Street, Suite 111-N73, Wilmington, DE 19801 USA (trading as “hosting.com”).

If we sign a contract, I may share invoice data with [my accountant / tax advisor] and with public authorities where the law requires it.

Google Analytics data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

[Transfers outside the EU: the hosting provider is based in the USA. If data is transferred outside the European Economic Area, state the basis here – e.g. a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses in the data processing agreement (DPA) with the provider.]

6. Cookies and Google Analytics

The website only stores the items listed below on your device. Analytics cookies are set only after you click “Accept” in the cookie bar. Until you give consent, Google Analytics is not loaded at all.

• gd_consent (browser storage, technical) – remembers whether you accepted or rejected cookies. Valid for 12 months. Does not require consent.
• _ga (Google Analytics cookie) – distinguishes users. Valid for 2 years. Only with consent.
• _ga_<ID> (Google Analytics cookie) – keeps the session state. Valid for 2 years. Only with consent.

You can withdraw your consent at any time using the “Cookie settings” link in the footer of every page – the analytics cookies are then deleted. You can also delete or block cookies in your browser settings.

Fonts and other scripts are stored on the website’s own server. The website contains links to other websites (for example, in the projects section); once you follow them, their owners’ policies apply.

7. Your rights

You have the right to:

• access your data and receive a copy,
• have inaccurate data corrected,
• have your data erased (“right to be forgotten”),
• restrict processing,
• data portability,
• object to processing based on legitimate interest.

To exercise your rights, email [tomasz@gradiamdigital.cz]. I will reply without undue delay, and within one month at the latest.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for the controller is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. You can also complain to the supervisory authority in the EU country where you live or work.

8. Do you have to provide your data?

No, providing data is voluntary. However, I can’t reply to you without your name and email address. No automated decision-making or profiling takes place.

9. Security

The website is only available over an encrypted connection (HTTPS), the software is kept up to date, and I am the only person with access to the messages received.

10. Changes to this policy

The current version is always published on this page. The effective date is shown at the top.