Privacy matters and I take it seriously. This page sets out who processes your personal data, what data that is, why I need it, how long I keep it and what rights you have. Processing follows Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing. This English text is a translation of the Czech version for your convenience. If the two ever differ, the Czech version is the binding one.
Who controls your data
The data controller is:
- Name
- Tomáš Tylich
- Trading as
- Statly
- Registered office
- V. K. Jeřábka 22, Záhradí, 570 01 Litomyšl, Czech Republic
- Business ID
- IČO 24466492 (listed in the Czech Trade Licensing Register, not registered for VAT)
- [email protected]
What data I process
Depending on how you get in touch, I may process these categories of data:
- Identification and contact details: name, email, and where relevant your company name and company number. I get these when you write to me about a job, either through the form or by email.
- Website usage data: IP address, browser type, pages visited, time spent on the site, where the visit came from. This is processed in anonymised form (Google Analytics 4) and only with your consent.
- Marketing data: interaction with advertising campaigns (Meta Pixel). Only with your consent.
- Correspondence: the content of emails and messages you send me.
Why I process it and on what basis
Every kind of processing has a clear purpose and a legal basis:
- Dealing with your enquiry and entering into a contract: if you contact me about a specific job, I process your data on the basis of performance of a contract or steps taken before entering into one (Article 6(1)(b) GDPR).
- Correspondence: answering your questions is done on the basis of legitimate interest (Article 6(1)(f) GDPR).
- Legal obligations: mainly accounting and tax (Article 6(1)(c) GDPR).
- Analytics and marketing: measuring traffic and personalising adverts happens only on the basis of consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
How long I keep it
- Enquiries and contract data: for as long as we work together, then three years in case of any claims.
- Accounting and tax records: ten years, as required by law.
- Analytics and marketing data: fourteen months at most (the Google Analytics 4 default) or until you withdraw consent.
- Record of your cookie choice: 365 days, stored in your own browser.
Who I share it with
I never sell your data. I pass it on only where it is necessary to run the website and the service:
- Cloudflare, Inc.: website hosting, CDN, and protection of the contact form against spam and bots through Cloudflare Turnstile (processes your IP address and browser signals on the basis of legitimate interest, so no consent is needed)
- Resend (email): delivering the message from the contact form to my inbox
- Supabase (database, servers in the EU): storing submitted enquiries securely so that none of them gets lost
- Google Ireland Limited: Google Analytics (only with consent)
- Meta Platforms Ireland Limited: Meta Pixel (only with consent)
- My accountant: for issuing invoices and meeting tax obligations
Where a service is operated outside the EU (Google and Meta, for example), the transfer is covered by standard contractual clauses approved by the European Commission.
Cookies and similar technologies
Cookies are small text files stored in your browser. They keep the site working properly and make it possible to measure how it is used. Analytics and marketing cookies are switched on only after you agree to them, and nothing loads before that.
The cookie categories I use
You can change which cookies you allow at any time:
Your rights
In relation to the processing of your personal data, the GDPR gives you these rights:
- Right of access: you can ask me what data I hold about you.
- Right to rectification: if the data is wrong or incomplete, you can ask me to correct it.
- Right to erasure (the right to be forgotten): if the reason for processing has gone, I will delete your data.
- Right to restriction of processing: you can ask me to stop using the data for a while.
- Right to data portability: I will hand your data over in a structured, machine readable format.
- Right to object: to processing based on legitimate interest.
- Right to withdraw consent: at any time and without giving a reason, for example consent to cookies or marketing.
- Right to lodge a complaint: with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, Czech Republic). If you are in the UK, you may also contact the Information Commissioner's Office.
How to exercise your rights
Just write to me at [email protected]. I will come back to you within 30 days at the latest. The request is free unless it is clearly unfounded or excessive.
Security
I protect your data to a reasonable standard, proportionate to what the processing involves. That means an encrypted connection (HTTPS), secure storage and access limited to me as the controller. No system is completely secure, though. If I became aware of a data breach, I would tell you as the law requires.
Children
Neither the website nor the service is intended for anyone under 16. I do not knowingly process children's personal data. If you find that such data has been given to me, please tell me and I will delete it.
Changes to this policy
I may update this policy from time to time, for example when the tools I use change or the law does. The current version is always on this page, with the date of the last update at the top.
Contact
Any question about this policy, or about how I handle your data? Write to me at [email protected].