Privacy policy
This policy applies to the cze.agency website and its Czech version. It explains how we process personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Czech Act No. 110/2019 Coll., on personal data processing.
Who the controller is
The controller of your personal data is:
| Item | Details |
|---|---|
| Registered name | CZE-Solutions s.r.o. |
| Company ID (IČO) | 19305427 |
| VAT ID (DIČ) | CZ19305427 |
| Registered office | Horní Bludovice 203, 739 37 Horní Bludovice, Czech Republic |
| Commercial Register | file no. C 92521, Regional Court in Ostrava |
| info@cze.agency | |
| Phone | +420 773 194 165 |
We have not appointed a data protection officer because the GDPR does not require us to. Please send any questions to info@cze.agency.
What data we process and why
Enquiry form
When you send an enquiry, we process:
- your name, e-mail, phone number and company name,
- what you are interested in, company size, preferred timing and your message,
- technical details of the submission: the page you sent the form from, campaign parameters in the link (UTM) and, if you attached it, your self-check result,
- your IP address and the time of submission (to protect the form against spam and abuse).
Purpose: to respond to your enquiry, prepare an offer and arrange a consultation. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you send the enquiry on behalf of a company, we process your contact details based on our legitimate interest in communicating with the company you represent (Art. 6(1)(f) GDPR).
After you submit the form, you receive a confirmation e-mail with a copy of your enquiry.
E-mail and phone communication
When you e-mail or call us directly, we process the details you share and the content of the communication.
Purpose: to handle your request. Legal basis: legitimate interest in handling your request (Art. 6(1)(f) GDPR) or steps before entering into a contract (Art. 6(1)(b) GDPR).
The info@cze.agency mailbox (including enquiries from the form) is hosted on Google Workspace.
Newsletter and downloads
When you download a checklist or subscribe to our newsletter, we process your e-mail address, your name if provided, and the topic you are interested in (for example EET 2.0 or NIS2). We also record when and how you gave consent.
Subscription uses double opt-in: after you submit the form, you receive an e-mail with a link, and the subscription starts only once you confirm it.
Purpose: to send the material you requested, expert e-mails on the topic and offers of our services. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the link in every e-mail or by writing to info@cze.agency. Withdrawal does not affect the lawfulness of processing before it.
Self-checks
Your answers in self-checks (short questionnaires, for example on NIS2 or EET 2.0) are evaluated directly in your browser and are not sent anywhere. We only receive the result if you attach it to an enquiry or ask us to e-mail it to you. Having it e-mailed means subscribing to the newsletter, and the rules above apply.
Website analytics
- Cloudflare Web Analytics measures traffic without cookies and without storing anything on your device. It works with aggregated data (for example the page viewed, referring website, browser type, country). Legal basis: legitimate interest in understanding how the website is used and improving it (Art. 6(1)(f) GDPR).
- Google Analytics 4 is used only if you consent in the cookie banner. Google Analytics stores cookies in your browser and processes data about your behaviour on the website and a truncated IP address. Legal basis: your consent (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on electronic communications). You can change your consent at any time in the cookie settings.
For details on cookies, see our Cookie policy.
Website and form security
The website runs on Cloudflare infrastructure. Every visit involves technical data (IP address, browser type, time of request) needed to deliver the page and protect it against attacks. Forms are protected by Cloudflare Turnstile, a service that checks that a person, not a bot, is submitting the form, without picture puzzles. To limit the number of submissions from one IP address, we store it for a short time.
Purpose: secure operation of the website and protection against spam and abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Enquiry backup
We may store a copy of each submitted enquiry in Cloudflare storage (Workers KV) so it is not lost if e-mail delivery fails. Legal basis: legitimate interest in reliably handling enquiries (Art. 6(1)(f) GDPR).
How long we keep data
| Data | Retention period |
|---|---|
| Enquiries and related communication that did not lead to a contract | 3 years from the last communication |
| Enquiries that led to a contract | for the duration of the contract and then for the period required by law (for example accounting and tax rules) |
| Enquiry backup in Cloudflare Workers KV | up to 12 months from submission |
| IP address for form rate limiting | up to 24 hours |
| Newsletter subscription | until you withdraw consent; after that we keep only a record of the unsubscription so we do not contact you again |
| Unconfirmed newsletter sign-up (double opt-in) | up to 30 days |
| Record of newsletter consent | for the duration of the subscription and 3 years after it ends |
| Google Analytics 4 | 14 months (GA4 data retention setting) |
Cookie storing your choice (cze_consent) | 6 months |
Who processes data on our behalf (processors)
We do not sell personal data. We share it only with processors that provide technical services for us, to the extent necessary and under a data processing agreement:
| Processor | What it does for us | Where it processes data |
|---|---|---|
| Cloudflare, Inc. (USA) | website hosting (Cloudflare Pages), content delivery network (CDN), website security, Turnstile, Web Analytics, enquiry backup (Workers KV) | global data centre network including the USA |
| Resend (Plus Five Five, Inc., USA) | sending e-mails from the enquiry form (notification to us and confirmation to you) | USA, or the EU |
| Ecomail.cz, s.r.o. (Czech Republic) | newsletter subscriber management, double opt-in, sending e-mails | EU |
| Google Ireland Limited (Ireland), together with Google LLC (USA) | Google Workspace – the info@cze.agency mailbox where we receive enquiries and communicate with you | EU and USA |
| Google Ireland Limited (Ireland), together with Google LLC (USA) | Google Analytics 4, only with your consent | EU and USA |
We may also disclose data to public authorities where required by law, and to our legal or tax advisers, who are bound by confidentiality.
Transfers outside the EU
Some processors (Cloudflare, Resend, Google) are based in the United States or may process data there. Such transfers are protected by one of the following:
- the EU-U.S. Data Privacy Framework, where the recipient is certified under it – the European Commission has decided that certified recipients ensure an adequate level of protection,
- standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR), where needed together with additional technical measures.
You can check current certification status at dataprivacyframework.gov. On request, we will tell you which safeguard applies to a specific processor.
Your rights
Under the GDPR, you have the right:
- of access – to find out what data we process about you and get a copy,
- to rectification of inaccurate or incomplete data,
- to erasure (“right to be forgotten”) where the data is no longer needed or there is no legal basis for processing,
- to restriction of processing, for example while we verify the accuracy of the data,
- to data portability for data you gave us based on consent or a contract,
- to object to processing based on legitimate interest; you can object to direct marketing at any time and we will stop,
- to withdraw consent at any time, as easily as you gave it,
- not to be subject to automated decision-making; we do not carry out any automated decision-making or profiling with legal effects.
To exercise your rights, e-mail info@cze.agency or write to our registered office. We will respond without undue delay and within one month at the latest. To avoid disclosing data to the wrong person, we may ask you to verify your identity.
Complaints to the supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz). We would appreciate it if you contacted us first so we can try to resolve the matter.
Changes to this policy
We update this policy when we change our tools or the way we process data. The date of the last update is shown on this page. We inform newsletter subscribers of significant changes by e-mail.
Contact
Send questions about data protection to info@cze.agency or call +420 773 194 165.
Updated: