Privacy Policy
This policy explains how the Vstupko website handles your personal data when you contact us or request a no-strings quote. It applies only to visitors of this marketing site and the enquiry form. Processing of event attendees' personal data (ticket buyers) is carried out on behalf of individual event organisers and is governed by separate documentation.
1. Who is the controller and how to reach us
The controller of personal data processed through this website is:
- Zdeněk Pašek
For any privacy matter, contact us at info@vstupko.cz. General enquiries can go to info@vstupko.cz. We have not appointed a Data Protection Officer, as we are not legally required to; the address above handles all privacy-related communication.
2. What data we process and why
When you fill in the enquiry form (“Chci Vstupko”), we process the data you provide — typically your name, a contact email or phone number, and a description of the event you want to run. We use this data for two purposes:
- Responding to your enquiry and preparing a possible contract — so we can put together a quote and agree on working together. The legal basis is taking steps at your request prior to entering into a contract under Art. 6(1)(b) GDPR.
- Follow-up communication and keeping a record of enquiries — so we can reply, pick up on earlier discussions and protect our legitimate interests (including evidencing the course of dealings). The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. You may object to this processing at any time.
Filling in the form is voluntary. If you do not provide the data, we will not be able to respond to your enquiry. The enquiry form does not store your IP address.
3. Recipients and processors
We do not publish or sell your data. To run the website and our communications, we work with carefully selected providers who process data for us as processors under a contract:
- Resend (Resend, Inc., USA) — delivery of transactional emails (e.g. confirming we received your enquiry). The provider is certified under the EU–US Data Privacy Framework.
- An EU hosting and database provider — the server and data storage run on infrastructure located in the European Union.
- Plausible Analytics (EU-hosted) — anonymous, aggregated website traffic. The tool uses no cookies and does not build profiles of individual visitors. Analytics is only active when configured.
4. Transfers outside the EU
Running the website and storing data both take place within the European Union. A transfer outside the EU occurs only when sending emails via Resend (USA). This transfer is covered by the provider's certification under the EU–US Data Privacy Framework; as a fallback safeguard we also rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission. No other transfers to third countries take place.
5. How long we keep your data
We keep enquiry data for as long as necessary to handle the enquiry and any follow-up, and no longer than our legitimate interest requires (typically up to 24 months from the last contact); after that it is deleted automatically. If no engagement results from an enquiry, we delete the data sooner.
If an enquiry leads to an order and payment for the service, longer statutory retention periods will apply to accounting and tax documents (up to roughly 10 years under Czech accounting and VAT law) as an exception to the right to erasure under Art. 17(3)(b) GDPR. This paid-order regime applies only once the paid part of the service goes live; it does not apply to the enquiry itself.
6. Your rights
In relation to your personal data, you have the right:
- to access your data and obtain a copy,
- to rectify inaccurate or incomplete data,
- to erasure (the “right to be forgotten”), unless a legal obligation requires us to keep the data,
- to restrict processing,
- to data portability for data you provided to us,
- to object to processing based on legitimate interest.
To exercise a right, write to us at info@vstupko.cz. We will deal with your request without undue delay and within one month at the latest. To protect your data, we may need to verify your identity.
7. Right to lodge a complaint
If you believe we process your data in breach of the law, you have the right to lodge a complaint with the supervisory authority, which is the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. We would, however, appreciate the chance to address your concerns first — most things can be resolved directly.
8. Automated decision-making
We do not use your data for automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
9. Minors
Our website and enquiry form are not intended for children under 15. In the Czech Republic, the age at which a child can consent to the processing of data in connection with information-society services is set at 15 (Section 7 of Act No. 110/2019 Coll.). If you are under 15, please only fill in the form with the consent of a legal guardian. If we find that we have unintentionally obtained the data of a child under 15 without such consent, we will delete it.
10. Cookies
This website uses only strictly necessary cookies, which keep the site working and secure (e.g. form protection). For traffic measurement we use Plausible, which uses no cookies and does not identify individual visitors.
Because we use no marketing or tracking cookies that require consent, we do not show a cookie banner. It would be pointless — we do not need any cookie consent from you.
11. Fonts and third-party content
All fonts used on this website are hosted directly on our own servers. We do not load them from any external network (such as the Google Fonts CDN), so displaying the page involves no transfer of your IP address to third-party servers for fonts.
12. Changes to this policy
We may update this policy from time to time. The current version is always available on this page; the effective date is shown at the top.