Personal data protection

The controller of personal data is the sole trader operating the SmlouvaHned.cz platform (the “Controller”):

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on personal data processing.

Personal data may be passed to the following processors:

• →Stripe, Inc. — payment processing. A processor under Art. 28 GDPR, PCI DSS Level 1 certified.
• →Upstash (Redis) — temporary storage of form data while the document is generated and downloaded (7–30 days depending on the document purchased, or 90 days with the archiving add-on).
• →Resend — transactional e-mails, delivery of the document link, forwarding of contact-form messages and sending the newsletter to confirmed subscribers.
• →Upstash (Redis) — temporary record of an unconfirmed newsletter subscription for 24 hours and a record of confirmed consent for the duration of the subscription.
• →Upstash (Redis) — job data (Moje zakázka) for 12 months from the last change (a closed job 6 months), hashes of return tokens and the reminder schedule; requests for follow-up services for 6 months.
• →Stripe, Inc. — also payment for a follow-up job document; Stripe receives your e-mail and the document name, not its content.
• →Vercel — hosting of the platform. Data is processed within the EEA or under corresponding safeguards.

A follow-up partner does not automatically receive the content of the contract or your contact details. The offer is selected from minimised categories. Only by a deliberate click does the user move to a specific provider’s website; any transfer of contact details requires separate, specific consent for that partner.

The Controller does not sell personal data to third parties. Marketing e-mails (the newsletter) are sent solely on the basis of voluntary consent, which you can withdraw at any time.

Stripe, Inc. and Resend are based in the USA. Transfers are safeguarded by standard contractual clauses (SCC) approved by the European Commission together with supplementary technical measures. Upstash and Vercel allow an EU region to be selected (which applies to our deployment).

• →Right of access — you may ask what data we process about you.
• →Right to rectification — you may ask us to correct inaccurate data.
• →Right to erasure — you may ask for your data to be deleted.
• →Right to restriction of processing — you may ask us to restrict processing.
• →Right to data portability — you may receive your data in a machine-readable format.
• →Right to object — you may object to processing based on legitimate interest.

Exercise your rights at info@smlouvahned.cz. We will respond to your request within 30 days.

SmlouvaHned uses no third-party marketing or profiling cookies. Technically necessary session cookies may be used for the basic functioning of the application. No behavioural advertising platform (Facebook Pixel, Google Ads remarketing and the like) is deployed on the website.

For anonymised traffic statistics we use Vercel Web Analytics (aggregated page views, without identifying a specific person). Our own product events (for example entering a form or clicking through to checkout) are sent only after your optional consent and without any link to a payment card; completed payments are recorded by the server only after Stripe confirms them.

Regardless of that choice, the server may record the necessary aggregated security and operational signals about rejected or invalid requests, so that checkout can be protected and an outage detected. These signals contain neither form content nor contact details and do not count as revenue or completion.

Only after that consent do we store, in first-party session storage and for the purpose of evaluating the path to the product, the category of the first source, the public page path and possibly an article slug. We actively delete the record after 30 minutes; an older record is additionally rejected and deleted on every read. The attribution itself contains no user UUID, form content, VIN, name, e-mail, telephone number or address. If you subsequently create a document, however, the server attaches a copy of this minimised attribution to the secure document record, so for that period it may be linkable to the order data: 24 hours for the free flow, 7–30 days for a paid document, or 90 days with the archiving add-on. The raw reporting buffer holds at most 5,000 events and the dashboard works with the last 30 days. We pass neither the attribution nor the order data to any affiliate partner.

Withdrawing consent stops further browser product events and new attributions and immediately deletes the attribution from the current browser tab. It does not retroactively remove server events already received or the attribution attached to a document created earlier; a server-side completion or download of such a previously attributed document may therefore be recorded for as long as it remains available. You can exercise your rights over these records as described in section 5.

Analytics consent can be changed at any time on the Czech version of this page, where the settings panel is available.

All communication is encrypted with TLS (HTTPS). Form data is stored in encrypted temporary storage with automatic erasure after 7–30 days depending on the document purchased, or after 90 days with the archiving add-on. Access to the data is limited to technically necessary persons. Payment details never pass through our servers.

You have the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.