1. Identity of the Data Controller
The data controller responsible for processing personal data collected through this website is Vasuta, with its registered place of business at Na Maninách 1080/20, Praha, Czech Republic. Contact for data protection matters: [email protected] or by post to the address above.
Vasuta operates as a consultancy providing advisory services related to digital tools for project management and internal communication. This Privacy Policy describes how we collect, use, store, and protect personal data in connection with the operation of the website vasuta.info and our business activities.
2. Legal Framework
This Privacy Policy is governed by and drafted in compliance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, "GDPR")
- Act No. 110/2019 Coll., on the Processing of Personal Data (Zákon o zpracování osobních údajů), as the primary Czech implementing legislation for the GDPR
- Act No. 480/2004 Coll., on Certain Information Society Services, as amended, concerning electronic communications
- Act No. 127/2005 Coll., on Electronic Communications, as amended
Where Czech law provides specific rules supplementing or implementing the GDPR, those rules apply alongside the GDPR framework. In the event of any conflict, GDPR provisions take precedence unless Czech law provides additional protection.
3. Personal Data We Collect
We collect personal data in the following circumstances and of the following types:
3.1 Contact form submissions. When you use the contact form on this website, we collect your name, email address, the topic category you selected, and the content of your message. This data is submitted directly to our email address and is not stored on a third-party form database.
3.2 Email correspondence. When you contact us directly by email, we collect the email address and any personal information contained in the message body or email headers.
3.3 Telephone contact. When you contact us by telephone, we may retain a record of your telephone number and the substance of the conversation for internal purposes.
3.4 Cookies and browsing data. We collect technical data through the use of cookies as described in our Cookie Policy. This may include IP addresses, browser type, device type, pages visited, and session duration. Please refer to our Cookie Policy for full details.
3.5 Business engagement data. When you enter into a business relationship with Vasuta, we collect and process data necessary for the delivery of our services. This may include business contact information, workflow documentation, and other information you provide in the course of the engagement.
4. Purposes and Legal Bases for Processing
We process personal data only where we have a lawful basis under Article 6 GDPR. The following table describes our processing activities:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to enquiries submitted via contact form or email | Art. 6(1)(b) — performance of a contract or pre-contractual steps at your request; or Art. 6(1)(f) — legitimate interest in responding to business enquiries |
| Delivery of consultancy services under a contract | Art. 6(1)(b) — performance of a contract to which you are party |
| Compliance with legal obligations (e.g., accounting, tax) | Art. 6(1)(c) — compliance with a legal obligation |
| Website analytics and improvement (where consented) | Art. 6(1)(a) — consent, obtained via the cookie consent mechanism |
| Protection of legitimate business interests | Art. 6(1)(f) — legitimate interests, balanced against your interests and fundamental rights |
5. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law.
Enquiry correspondence is retained for a period of 24 months from the date of last contact. Data relating to business engagements is retained for the duration of the engagement plus 10 years, to comply with Czech accounting and civil law requirements (Act No. 563/1991 Coll., on Accounting, and Act No. 89/2012 Coll., the Civil Code). Data collected through cookies is retained for periods specified in the Cookie Policy. Where you request deletion of your data and no legal obligation prevents us from complying, we will act on that request within 30 days.
6. Data Sharing and Transfers
We do not sell personal data to third parties. We may share personal data with the following categories of recipients:
- IT service providers: Hosting, email, and infrastructure providers who process data on our behalf as processors under Article 28 GDPR data processing agreements.
- Professional advisors: Legal, accounting, or tax advisors where required for compliance or legal proceedings.
- Public authorities: Where required by applicable law or by lawful order of a competent authority.
We do not transfer personal data to countries outside the European Economic Area (EEA) unless appropriate safeguards are in place as required by Chapter V of the GDPR. Where transfers occur, we rely on Standard Contractual Clauses approved by the European Commission or other appropriate transfer mechanisms.
7. Your Rights Under GDPR
Under the GDPR and applicable Czech law, you have the following rights with respect to your personal data:
- Right of access (Art. 15 GDPR): To obtain confirmation of whether we process your personal data and, if so, to receive a copy.
- Right to rectification (Art. 16 GDPR): To have inaccurate personal data corrected without undue delay.
- Right to erasure (Art. 17 GDPR): To request deletion of your personal data where no legitimate ground for retention exists.
- Right to restriction of processing (Art. 18 GDPR): To request that we restrict processing of your data in certain circumstances.
- Right to data portability (Art. 20 GDPR): To receive your data in a structured, commonly used machine-readable format, where processing is based on consent or contract.
- Right to object (Art. 21 GDPR): To object to processing based on legitimate interests, including profiling.
- Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: To lodge a complaint with the Úřad pro ochranu osobních údajů (UOOU), the Czech supervisory authority, at Pplk. Sochora 27, 170 00 Praha 7, or at www.uoou.cz.
To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving a verifiable request, as required by Article 12 GDPR.
8. Security of Personal Data
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration, in accordance with Article 32 GDPR. These measures are reviewed and updated as appropriate in light of the nature of the data and the risks involved. While we take reasonable precautions, no transmission over the internet can be guaranteed to be completely secure.
9. Automated Decision-Making and Profiling
Vasuta does not engage in automated decision-making or profiling within the meaning of Article 22 GDPR. No decisions with legal or similarly significant effects are made about individuals through automated means using data collected through this website.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. When material changes are made, the "Last updated" date at the top of this document will be revised. We encourage you to review this Policy periodically. Continued use of the website following notification of changes constitutes acknowledgement of the revised Policy.