Privacy notice

Effective from 23 October 2026

1. Who processes your data

(“I” or the “controller”). I am not required to appoint a data protection officer; please contact me directly with any questions.

2. What data I process and why

• Enquiries via the form, e-mail or phone – your name, e-mail, phone number and the content of your message, used to reply to you and prepare a quote. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Working together – contact and billing details needed to perform the contract (Art. 6(1)(b) GDPR) and to meet my accounting and tax obligations (Art. 6(1)(c) GDPR).

Providing your data is voluntary, but without contact details I cannot reply to you.

3. Material for expert reports

Material an expert gives me for preparing a report (which may include health data) is not processed for my own purposes. I process it as a processor on the expert’s instructions; the expert is the controller. The terms are set out in a data processing agreement under Art. 28 GDPR, which I conclude with the expert.

4. How long I keep the data

• Enquiries that do not lead to cooperation: no longer than 12 months after our last contact.
• Contract and invoice data: for the duration of our cooperation and then for the period required by law (in particular tax and accounting rules – usually 10 years).

5. Who has access to the data

I do not sell your data or share it for marketing. To run the website and communication I use these services:

• FormSubmit (formsubmit.co, operated by Devro LABS) – forwards messages from the contact form to my e-mail. Data may be transferred outside the European Union in the process.
• WEDOS Internet, a.s. – the web hosting and e-mail provider whose servers host the website and the mailbox where enquiries arrive.

6. Visitor statistics and cookies

This website does not use cookies. For basic visitor statistics (number of visits, pages viewed, country, referring website, device type) I use Cloudflare Web Analytics (Cloudflare, Inc.). It stores no cookies on the visitor’s device, does not track individual visitors and shows results only in aggregate form. Legal basis: my legitimate interest in knowing how the website is used (Art. 6(1)(f) GDPR).

In addition, for technical and security reasons the hosting provider’s server may log access data (e.g. IP address, time and page visited). These logs are used only to keep the website running and secure and are kept for no more than a few days.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and to object to processing based on legitimate interest. Just write to info@posudky.org.

If you believe your data is being processed unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.