Privacy policy
How I handle the personal data of site visitors and clients, under the GDPR and Czech Act No. 110/2019.
This is a working draft. Have it reviewed by a lawyer before relying on it.
Data controller
Filip Šimkovič
simkovic@drilex.cz
Controller details have not been filled in yet in the site admin.
What data I process
For an enquiry I process what you send me by email: name, email address, optionally a phone number and a description of your project. For clients with access to the client area I additionally process billing details, project information, invoices, documents and support conversations. The website itself collects nothing through forms; contact happens by email.
Purpose and legal basis
Enquiry data is processed on the legitimate interest of replying to you and negotiating a contract. Client data is processed to perform the contract and to meet legal obligations, in particular tax and accounting ones. Traffic statistics are processed only with your consent, which you can withdraw at any time.
Analytics and cookies
The site uses Microsoft Clarity for anonymous traffic statistics. The script loads only after you give consent. If you decline or withdraw consent, no analytics data is sent at all. Details are in the cookie policy.
Who receives the data
The site and its database run on my own server inside the European Union; there is no third-party hosting partner. I may use an accounting service for invoicing and an SMTP provider for sending email. If you consent to analytics, anonymous statistics are processed by Microsoft, which may transfer data outside the EU under standard contractual clauses.
How long I keep it
Enquiries that do not lead to work are deleted within twelve months. Contract and invoice data is kept for the period required by law, which is ten years for accounting records. Analytics data has a retention period of at most thirteen months.
Your rights
You have the right of access to your data, and to rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. You can withdraw analytics consent at any time. Email the contact address below and I will respond within thirty days. If you are not satisfied you may complain to the Czech Data Protection Authority at uoou.cz, or to your own national supervisory authority.
Security
All traffic runs over HTTPS only. Passwords are stored solely as Argon2id hashes, never in readable form. Client data is separated in the application so that no client can ever see another client's records. The database is backed up daily.