Privacy policy

Effective from 25 August 2026

1. Who processes your data

The data controller is Softana s.r.o., registered office at Školní 634/23, 747 18 Píšť, Czech Republic, company ID 29801184, registered at the Regional Court in Ostrava, file no. C 104685.

For data protection matters contact us at [email protected], +420 739 674 193 or via Czech data box a6majvn.

We have not appointed a Data Protection Officer — we are not required to.

2. What data we process

From the contact form: your name, email address, company name (optional) and the text of your message. You enter these yourself and optional fields may be left empty.

From running the website: IP address, browser information and access time in server and security logs. This data is generated automatically.

We do not process special categories of personal data under Article 9 GDPR (health, biometric data and similar) and do not ask for them. Please do not include them in your message either.

3. Why and on what legal basis

Handling your enquiry and negotiating cooperation: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract.
Protecting the form against spam and abuse, website security: Article 6(1)(f) GDPR — our legitimate interest in a functional and secure website.
Accounting and tax obligations if a contract is concluded: Article 6(1)(c) GDPR — compliance with a legal obligation.

Filling in the form is neither a statutory nor a contractual requirement. Without your name, email and message, however, we cannot reply to you.

4. How long we keep the data

Enquiries that do not lead to cooperation: 12 months from the last communication, then deleted.
Enquiries that lead to cooperation: for the duration of the contract and then for the statutory periods — accounting and tax records for 10 years from the end of the relevant tax period.
Server and security logs: typically 30 days.

5. Who we share the data with

We do not sell your data and do not pass it to third parties for their own purposes. Only the following processors have access to it:

Web hosting provider — running the website and storing data on the server.
Email service provider — delivering and storing the message from the form.
Cloudflare, Inc. — the Turnstile service that tells humans from bots, and protection against attacks. During verification it processes your IP address and technical browser data.

We may also disclose data to public authorities where required by law.

6. Transfers outside the European Union

Cloudflare, Inc. is based in the United States. The transfer relies on the European Commission's adequacy decision (EU–US Data Privacy Framework), or on standard contractual clauses under Article 46 GDPR. Our other processors process data within the EU.

7. Cookies and similar technologies

This website uses no analytics, marketing or profiling cookies, and therefore has no consent banner. We only store strictly necessary data:

PHPSESSID — a temporary session holding the form security token (CSRF protection). It expires when you close your browser.
__cf_bm and similar Cloudflare files — protection against automated abuse, valid for tens of minutes.

This data is necessary to provide the service you explicitly requested, so consent under Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications is not required.

8. Your rights

In relation to your data you have the right:

of access and to a copy of the data processed (Article 15 GDPR),
to rectification of inaccurate or incomplete data (Article 16 GDPR),
to erasure (Article 17 GDPR),
to restriction of processing (Article 18 GDPR),
to data portability (Article 20 GDPR),
to object to processing based on legitimate interest (Article 21 GDPR).

Exercise these rights at [email protected]. We will respond within one month of receiving your request at the latest.

If you believe our processing infringes the GDPR, you may lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Data Protection Authority), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

9. Automated decision-making

We use no automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

10. Changes to this policy

We may update this policy — typically when the scope of processing or the set of processors changes. The current version is always at this address and the effective date is shown at the top of the page.