Privacy Policy

1. Controller and scope

This Privacy Policy applies to the-a.xyz and its contact form. The controller is Karel Ježek, acting in an individual capacity under the name the-a.xyz. the-a.xyz is not currently a registered business entity and does not have an IČO or registered business address. For every privacy request or question, contact [email protected].

This notice is provided under Articles 12–14 of the GDPR. It does not govern independent websites or services that you visit through an external link.

2. Personal data we process

Do not send special-category data (for example health, biometric, political, religious or similar sensitive data) through the contact form. The form is not designed to receive it.

• Contact enquiry data: name, email address and the content of the message you choose to send.
• Technical and security data: IP address, user-agent, request time, requested URL, and security or anti-bot verification events that may be generated by our server, hosting provider or content-delivery/security provider, including Cloudflare Turnstile.
• Choice and preference data: the language or theme you actively choose, and your cookie choices. See the Cookie Policy for details.
• Client and project data: only if an enquiry develops into a client relationship; the applicable contract or project documentation will provide further information where needed.

3. Why we use data and our legal bases

We do not sell personal data, use contact details for direct marketing or newsletters, or make decisions about you solely by automated means. We may use fully anonymised, aggregated counts (for example, the number of enquiries in a month); these do not identify a person.

• To read, assess and answer an enquiry, and to take steps at your request before a potential contract: Article 6(1)(b) GDPR where applicable, otherwise our legitimate interest in responding to genuine enquiries under Article 6(1)(f) GDPR.
• To keep the website safe, diagnose faults, prevent automated abuse of the contact form and defend legal claims: our legitimate interests under Article 6(1)(f) GDPR. We use Cloudflare Turnstile for this purpose when you use the contact form.
• To measure aggregate page performance and availability through Cloudflare Web Analytics (formerly Browser Insights): our legitimate interests under Article 6(1)(f) GDPR in maintaining and improving the website. We use its cookie-free real-user monitoring configuration only; we do not use it for advertising audiences, cross-site tracking or individual profiling.
• To meet a legal obligation: Article 6(1)(c) GDPR, where one applies.
• To load the optional Trustpilot review widget: your prior consent, Article 6(1)(a) GDPR and the Czech rules for storing or accessing information on a device. You can withdraw it at any time in Cookie settings.

4. Recipients, processors and transfers

Access is limited to Karel Ježek and people who have been given direct permission to work with the-a.xyz. They may access an enquiry only where needed to answer or handle it.

Some providers may process data outside the EEA. Cloudflare operates a global network and limited connection, security and Web Analytics data may be processed outside the EEA, including in the United States. Where a transfer is not covered by an adequacy decision, we rely on the provider’s applicable transfer mechanism, such as the EU Standard Contractual Clauses, the EU–US Data Privacy Framework where applicable, and supplementary safeguards where appropriate. Current provider terms are available from Resend, Contabo, Cloudflare and Trustpilot.

• Resend (Plus Five Five, Inc.) delivers contact-form email. It receives the name, email address and message supplied in the form. Resend’s Data Processing Addendum includes the EU Standard Contractual Clauses and its EU–US Data Privacy Framework commitment.
• Contabo GmbH provides the virtual private server on which the website is hosted. It may process technical data and any data contained in the server environment when providing hosting and support.
• Cloudflare provides DNS, content delivery and security services. It processes connection and security data needed to deliver and protect the site through its network. Cloudflare Turnstile is shown on the contact form to distinguish people from automated traffic. It processes the technical information needed to provide that security function; it does not access, store or transmit the content of the contact form. We send the requester’s IP address and the one-time verification token to Cloudflare’s Siteverify service to validate the form submission. We also use Cloudflare Web Analytics (formerly Browser Insights) for aggregate performance and availability measurement. Cloudflare states that its beacon does not access or store cookies or local storage and does not fingerprint visitors. The metrics can include page-performance and navigation information, page path, referring host, country, device category, browser and operating-system information. We do not use these metrics to identify people or build profiles. Cloudflare’s data-processing terms provide transfer safeguards where required.
• Trustpilot is loaded only after you enable it. It then receives the technical data needed to provide its review widget and acts under its own privacy and cookie information.
• Google Search Console provides the operator with Google Search performance reports. It does not add Google Analytics, advertising tags or a Google tracking script to this website.

5. Retention

Ordinary contact enquiries are deleted from the working inbox and related records after 12 months. If an enquiry leads to a client relationship, relevant records may be retained for the relationship and then for the period required by applicable law or reasonably needed to establish, exercise or defend legal claims. Technical security logs are kept only for the period necessary for security and operations. We do not retain Cloudflare Turnstile tokens; they are single-use and expire after five minutes. Cloudflare Web Analytics retains unsampled beacon data for seven days and then keeps sampled, aggregated analytics; its dashboard makes historical reporting available for up to six months. We do not export or combine these metrics with contact-form data. Backup copies expire through the provider’s normal backup cycle and are not restored merely to answer a routine request.

6. Your rights and how to use them

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing before withdrawal. Email [email protected] and describe your request. We may ask for proportionate information to verify that we are dealing with the right person.

You may lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (UOOU), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, or with the supervisory authority of your habitual residence, workplace or the place of the alleged infringement.

7. Language

The Czech version of this Privacy Policy is the official and controlling version. The English version and any future translations are faithful translations provided for convenience. If a translation differs from the Czech version, the Czech version prevails.

8. Changes

We will update this notice when our processing changes. The effective date at the top shows the current version. Material changes affecting an existing client relationship will also be communicated through an appropriate direct channel where feasible.