1. Who controls the data and how to contact us
The personal data controller is provozovatel, Registered Office: registered office, company number company number, registration note, data protection registration.
On the website we operate under the České aplikace trade brand. For privacy questions and data subject requests, use the DPO contact .
2. What data we may process
When you submit the contact form, we process your name, email address, company or project name, website address, requested collaboration type and message content. We use this data to handle the enquiry and continue the related communication.
During normal website use, technical data may be created, such as IP address, device and browser information, request time, performance information, security logs and data connected with content delivery.
If a secured Care section is made available in the future, access and operational data connected with authentication, authorisation, account management, security and access history may also be processed.
3. Why we process data and on what legal basis
We use form data to receive and handle enquiries, start communication and take steps before a potential contract is concluded. The legal basis is Article 6(1)(b) GDPR.
We use operational, analytical and security data to run the website, protect the service, measure traffic and performance, detect abuse and improve the website over time. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure and functional operation.
If push notifications or an authorised client area are activated in the future, the related processing will rely on the appropriate legal basis for the specific feature, especially user consent for push notifications or contract performance and legitimate interest for the client area.
4. Tools and providers we use
Wir hosten diese Website mit Cloudflare Workers und Static Assets. Cloudflare kann technische Daten verarbeiten, die für Betrieb und Schutz der Website erforderlich sind, etwa IP-Adressen, Anfragedaten und Sicherheitsprotokolle.
Cloudflare Turnstile schützt unser Kontaktformular vor Missbrauch. Der Dienst wertet technische Signale aus Browser und Gerät aus. Beim Absenden prüft unser Server ein kurzlebiges Token.
Wenn die Weiterleitung von Anfragen aktiviert ist, prüft der Cloudflare Worker die Eingaben, übermittelt sie zur Bearbeitung an ClickUp und sendet sie über Cloudflare Email Service an das Markenpostfach in Google Workspace. Cloudflare D1 speichert eine Kennung, einen geschützten Fingerabdruck und den Übermittlungsstatus, um wiederholtes Senden zu verhindern. Dieser technische Datensatz enthält weder Namen noch E-Mail-Adresse oder Nachrichtentext.
For aggregated traffic and performance measurement we use Umami in a privacy-focused mode. If Umami is deployed in a cookieless configuration, it works with aggregated metrics without marketing profiling or advertising tracking.
For the PWA layer, installation and possible push notifications, we may use Progressier. If a user voluntarily allows push notifications, a technical identifier or push token may be created so notifications can be delivered.
If we publish or connect a public status page through Uptime Kuma, that layer may process technical data related to service availability, monitoring and the display of operational status.
5. Push notifications and the future client area
Push notifications are optional. They are activated only after explicit consent in the browser or device and can later be disabled in the relevant device, browser or application settings.
If we launch the Care client section, it will be a separate restricted-access layer. That area may process access data, audit records, operational metadata and content connected with the care being provided.
6. How long we keep data
We keep enquiry-form data for the period needed to handle the communication and related business steps. If no collaboration follows, we usually keep it for no longer than 12 months from the last meaningful contact, unless a longer period is needed to protect our rights.
Aggregated analytical and technical data is kept for a period appropriate to operation, security and performance evaluation. Data from a future client area will be assessed according to the nature of the service, security needs and contractual framework.
7. Recipients, international element and your rights
We disclose data only to the extent necessary for running the website and providing services. This typically includes hosting, CDN, DNS and security infrastructure, form infrastructure, analytics, PWA and push layers or status tools where they are actively used.
The controller is based in the United Kingdom and some technical services may also operate outside the EU. Where international transfers occur, we aim to use appropriate legal mechanisms and keep the scope of transfer to what is necessary.
You have the right to access, rectification, erasure, restriction of processing, portability, objection and to lodge a complaint with the relevant supervisory authority. For privacy requests, use the DPO contact .