1. Who controls the data and how to contact us
The personal data controller is operator, Registered Office: registered office, company number company number, registration note, data protection registration.
On the website we operate under the České aplikace trade brand. For privacy questions and data subject requests, use the DPO contact .
2. What data we may process
When you submit the contact form, we process your name, email address, company or project name, website address, requested collaboration type and message content. We use this data to handle the enquiry and continue the related communication.
During normal website use, technical data may be created, such as IP address, device and browser information, request time, performance information, security logs and data connected with content delivery.
If a secured Care section is made available in the future, access and operational data connected with authentication, authorisation, account management, security and access history may also be processed.
3. Why we process data and on what legal basis
We use form data to receive and handle enquiries, start communication and take steps before a potential contract is concluded. The legal basis is Article 6(1)(b) GDPR.
We use operational, analytical and security data to run the website, protect the service, measure traffic and performance, detect abuse and improve the website over time. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure and functional operation.
If push notifications or an authorised client area are activated in the future, the related processing will rely on the appropriate legal basis for the specific feature, especially user consent for push notifications or contract performance and legitimate interest for the client area.
4. Tools and providers we use
We host and deliver this website using Cloudflare Workers and Static Assets. Cloudflare may process technical information needed to operate and protect the site, such as IP addresses, request information and security logs.
We use Cloudflare Turnstile to protect the contact form from abuse. It assesses technical signals from the browser and device, and our server verifies a short-lived token when the form is submitted.
When enquiry delivery is enabled, the Cloudflare Worker checks the submitted details, sends them to ClickUp for handling and uses Cloudflare Email Service to email the brand mailbox hosted in Google Workspace. Cloudflare D1 stores an identifier, a protected fingerprint and the handover status to prevent repeat sending. This technical record contains no name, email address or message text.
For aggregated traffic and performance measurement we use Umami in a privacy-focused mode. If Umami is deployed in a cookieless configuration, it works with aggregated metrics without marketing profiling or advertising tracking.
For the PWA layer, installation and possible push notifications, we may use Progressier. If a user voluntarily allows push notifications, a technical identifier or push token may be created so notifications can be delivered.
If we publish or connect a public status page through Uptime Kuma, that layer may process technical data related to service availability, monitoring and the display of operational status.
5. Push notifications and the future client area
Push notifications are optional. They are activated only after explicit consent in the browser or device and can later be disabled in the relevant device, browser or application settings.
If we launch the Care client section, it will be a separate restricted-access layer. That area may process access data, audit records, operational metadata and content connected with the care being provided.
6. How long we keep data
We keep enquiry-form data for the period needed to handle the communication and related business steps. If no collaboration follows, we usually keep it for no longer than 12 months from the last meaningful contact, unless a longer period is needed to protect our rights.
Aggregated analytical and technical data is kept for a period appropriate to operation, security and performance evaluation. Data from a future client area will be assessed according to the nature of the service, security needs and contractual framework.
7. Recipients, international element and your rights
We disclose data only to the extent necessary for running the website and providing services. This typically includes hosting, CDN, DNS and security infrastructure, form infrastructure, analytics, PWA and push layers or status tools where they are actively used.
The controller is based in the United Kingdom and some technical services may also operate outside the EU. Where international transfers occur, we aim to use appropriate legal mechanisms and keep the scope of transfer to what is necessary.
You have the right to access, rectification, erasure, restriction of processing, portability, objection and to lodge a complaint with the relevant supervisory authority. For privacy requests, use the DPO contact .