Privacy Policy

How stromyvcr.cz handles personal data under the GDPR and US privacy laws (CCPA/CPRA).

This policy explains what personal data we process when operating the website stromyvcr.cz, why we do so and what rights you have. We comply with Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll., on the Processing of Personal Data, and Czech Act No. 127/2005 Coll., on Electronic Communications, and we also take into account privacy laws in force in the USA (in particular the California CCPA/CPRA and similar laws of other states).

1. Data controller

Webmint s.r.o., Jana Želivského 2, 130 00 Praha 3, Czech Republic, Company ID (IČO) 27888819, VAT ID (DIČ) CZ27888819, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 124216.
E-mail for privacy enquiries: [email protected]

We have not appointed a Data Protection Officer, as the scope of our processing does not require one.

2. Summary at a glance

We do not use advertising or tracking cookies and we do not track you across websites. We measure traffic anonymously, without cookies.
We do not sell or share personal data for targeted (cross-context behavioural) advertising.
We process only what is necessary to operate the website, keep it secure and respond to your message.

3. What data we process and why

Purpose	Data	Legal basis	Retention period
Replying to a message sent via the contact form or by e-mail	name, e-mail, message content, language, IP address	legitimate interest in responding to an enquiry (Art. 6(1)(f) GDPR), or steps prior to entering into a contract (Art. 6(1)(b))	for the time needed to handle the enquiry and then a maximum of 24 months
Protecting the form against spam and abuse (reCAPTCHA v3)	IP address, browser and device data, interaction with the page	legitimate interest in security (Art. 6(1)(f) GDPR)	in accordance with Google's policies
Anonymous traffic measurement (w3min.com)	visited URL, referring page, browser, operating system and device type, country derived from the IP address; the IP address is not stored, and visits are distinguished using an anonymous identifier that changes daily	legitimate interest in improving the website's content (Art. 6(1)(f) GDPR)	aggregated statistics only
TOPlist visitor counter	IP address, visited URL and page title, referring page, screen resolution and colour depth, browser data	legitimate interest in traffic statistics (Art. 6(1)(f) GDPR)	in accordance with the TOPlist terms of service
Operation, security and protection against attacks	IP address, date and time, requested URL, user agent (server logs, CDN)	legitimate interest in secure operation (Art. 6(1)(f) GDPR)	usually 30 days
Login to the administration area (editorial staff only)	e-mail, password (encrypted), session cookie	performance of a contract / legitimate interest	for the lifetime of the account

Providing data in the contact form is voluntary; however, without an e-mail address we cannot reply to you. No automated decision-making or profiling with legal effects takes place.

4. Cookies and local storage

Ordinary visitors receive no cookies from us. Traffic measurement by w3min.com works without cookies. The TOPlist counter loads a tracking image from its own server, through which it processes the technical data listed in Section 3. In the browser's local storage (localStorage), the website only remembers your choice of light/dark mode and the fact that you have closed the offer of another language version. This data never leaves your device and is strictly necessary for a function you have requested (Section 89(3) of the Czech Electronic Communications Act, Art. 5(3) of the ePrivacy Directive).

Google reCAPTCHA is loaded only once you start filling in the contact form, and it may store its own cookies necessary to detect automated bots. Editorial staff use a single session cookie to log in to the administration area.

5. Recipients and processors

Hosting provider in the EU – operation of the server and database.
Cloudflare, Inc. – content delivery network (CDN) and protection against attacks; processes IP addresses and technical data.
TOPlist (toplist.cz) – visitor counter and traffic statistics.
w3min.com – anonymous, cookie-free traffic statistics.
Google Ireland Ltd. / Google LLC – reCAPTCHA v3 (Google Privacy Policy).
OpenAI and Anthropic – artificial intelligence tools used by the editorial team to prepare and translate articles. We do not transfer visitors' personal data to these services, only editorial texts.

6. Transfers of data outside the EU

Some processors (Google, Cloudflare) may also process data in the USA. Such transfers are based on the European Commission's adequacy decision (EU-US Data Privacy Framework), under which these companies are certified, or on standard contractual clauses (Art. 46 GDPR).

the right of access to your personal data (Art. 15),
the right to rectification (Art. 16) and erasure (Art. 17),
the right to restriction of processing (Art. 18) and to data portability (Art. 20),
the right to object to processing based on legitimate interest (Art. 21),
the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

We handle requests free of charge within one month at the latest. We may ask you for additional information to verify your identity.

8. Information for visitors from the USA

For residents of California (CCPA as amended by the CPRA) and other states with similar laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey and others):

Categories of data in the past 12 months: identifiers (name, e-mail, IP address), internet and network activity (server logs, anonymous traffic statistics), the content of your communications. We do not intentionally process sensitive personal information.
Sources: directly from you and automatically from your browser.
Purposes: see Section 3 – communication, security, website operation.
Sale and sharing: we do not sell or share personal data for targeted advertising and we do not use it for profiling. We honour the Global Privacy Control (GPC) signal, although, given the above, there is nothing to opt out of.
Your rights: to know what data we hold about you, to obtain a copy, to request correction or deletion, to opt out of sale/sharing and profiling, and not to be discriminated against for exercising your rights. You may submit a request by e-mail to [email protected], including through an authorised agent. If we deny your request, you may appeal by replying to our decision.

9. Children

The website is not intended for children under 16 (under 13 in the USA) and we do not knowingly collect personal data from them. If we discover that we have received such data, we will delete it without undue delay.

10. Security

The website is available exclusively over an encrypted HTTPS connection. We use up-to-date software, access restrictions, encrypted password storage and protection against automated attacks. Access to data is limited to the strictly necessary group of people.

11. Changes to this policy

We may update this policy, for example when legislation or the services we use change. The current version, with the date of the last update, is always published on this page.

Effective from 30 October 2026.