1. Who controls the data and how to contact us
The personal data controller is provozovatel, Registered Office: registered office, company number company number, registration note, data protection registration.
On the website we operate under the České aplikace trade brand. For privacy questions and data subject requests, use the DPO contact .
2. What data we may process
When you submit the contact form, we process your name, email address, company or project name, website address, requested collaboration type and message content. We use this data to handle the enquiry and continue the related communication.
During normal website use, technical data may be created, such as IP address, device and browser information, request time, performance information, security logs and data connected with content delivery.
If a secured Care section is made available in the future, access and operational data connected with authentication, authorisation, account management, security and access history may also be processed.
3. Why we process data and on what legal basis
We use form data to receive and handle enquiries, start communication and take steps before a potential contract is concluded. The legal basis is Article 6(1)(b) GDPR.
We use operational, analytical and security data to run the website, protect the service, measure traffic and performance, detect abuse and improve the website over time. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure and functional operation.
If push notifications or an authorised client area are activated in the future, the related processing will rely on the appropriate legal basis for the specific feature, especially user consent for push notifications or contract performance and legitimate interest for the client area.
4. Tools and providers we use
Nous hébergeons et diffusons ce site avec Cloudflare Workers et Static Assets. Cloudflare peut traiter les données techniques nécessaires au fonctionnement et à la protection du site, comme les adresses IP, les informations sur les requêtes et les journaux de sécurité.
Nous utilisons Cloudflare Turnstile pour protéger le formulaire de contact contre les abus. Le service évalue des signaux techniques du navigateur et de l’appareil. Lors de l’envoi, notre serveur vérifie un jeton à durée de validité limitée.
Lorsque la transmission des demandes est activée, le Cloudflare Worker vérifie les données, les transmet à ClickUp pour leur traitement et les envoie via Cloudflare Email Service à la messagerie de la marque dans Google Workspace. Cloudflare D1 conserve un identifiant, une empreinte protégée et le statut de transmission pour éviter les envois répétés. Cet enregistrement technique ne contient ni nom, ni adresse e-mail, ni texte du message.
For aggregated traffic and performance measurement we use Umami in a privacy-focused mode. If Umami is deployed in a cookieless configuration, it works with aggregated metrics without marketing profiling or advertising tracking.
For the PWA layer, installation and possible push notifications, we may use Progressier. If a user voluntarily allows push notifications, a technical identifier or push token may be created so notifications can be delivered.
If we publish or connect a public status page through Uptime Kuma, that layer may process technical data related to service availability, monitoring and the display of operational status.
5. Push notifications and the future client area
Push notifications are optional. They are activated only after explicit consent in the browser or device and can later be disabled in the relevant device, browser or application settings.
If we launch the Care client section, it will be a separate restricted-access layer. That area may process access data, audit records, operational metadata and content connected with the care being provided.
6. How long we keep data
We keep enquiry-form data for the period needed to handle the communication and related business steps. If no collaboration follows, we usually keep it for no longer than 12 months from the last meaningful contact, unless a longer period is needed to protect our rights.
Aggregated analytical and technical data is kept for a period appropriate to operation, security and performance evaluation. Data from a future client area will be assessed according to the nature of the service, security needs and contractual framework.
7. Recipients, international element and your rights
We disclose data only to the extent necessary for running the website and providing services. This typically includes hosting, CDN, DNS and security infrastructure, form infrastructure, analytics, PWA and push layers or status tools where they are actively used.
The controller is based in the United Kingdom and some technical services may also operate outside the EU. Where international transfers occur, we aim to use appropriate legal mechanisms and keep the scope of transfer to what is necessary.
You have the right to access, rectification, erasure, restriction of processing, portability, objection and to lodge a complaint with the relevant supervisory authority. For privacy requests, use the DPO contact .