Legal
Privacy policy
What data I keep about you, why and for how long.
Terms of personal data processing on zsf.cz under Regulation (EU) 2016/679 (GDPR).
I. Controller
The controller is Filip Novák, DiS., Company ID 73943118, registered office at Palackého třída 2630/131, Brno – Královo Pole, 612 00, Czech Republic, registered in the Czech Trade Register. Contact: info@zsf.cz or the contact form.
The controller has not appointed a data protection officer, as the conditions for mandatory appointment under Art. 37 GDPR are not met.
II. What data I process and why
| Data | When it arises | Legal basis | How long |
|---|---|---|---|
| First name, last name, email | registration or order | performance of a contract (Art. 6(1)(b)) | for as long as the account exists |
| Phone | if you fill it in on your account, an order, or a quiz | performance of a contract; for quizzes, consent expressed by filling in an optional field | for as long as the account exists |
| Date of birth | if you enter it during registration or in your account, always optional | consent given by filling in an optional field (Art. 6(1)(a)) | until you delete it, at most for as long as the account exists |
| Zásilkovna pickup point | order of the printed book | performance of a contract | part of the order, see documents |
| Company ID, VAT ID, company name, registered office | purchase as a company | legal obligation (Art. 6(1)(c)) | 10 years, as a tax document |
| Orders and tax documents | purchase | legal obligation | 10 years under the Czech VAT Act |
| Subscription payment details | club membership | performance of a contract | the card is held exclusively by Stripe and never reaches me |
| Password | registration | performance of a contract | only a hash is stored, never the password itself |
| Service inquiry: name, email, phone, inquiry content | submitting the inquiry form | steps prior to a contract (Art. 6(1)(b)) | 3 years from submission |
| Quiz result and IP address | completing a quiz | legitimate interest: quiz operation and abuse protection (Art. 6(1)(f)) | the result is not linked to a person until you enter an email; IP address 30 days |
| Email with a quiz result | if you request the analysis by email | performance of a contract: you asked for the analysis | for as long as the contact exists |
| Email address for the newsletter | subscription form or a checkbox during purchase | consent (Art. 6(1)(a)), confirmed by clicking in an email (double opt-in) | until you unsubscribe |
| Subscription requests (address and IP) | submitting the subscription form | legitimate interest: protecting the form against abuse | 7 days |
| Email delivery and open records | sending a message from the site | legitimate interest: provability and mailing hygiene | 3 years from sending |
| IP address and browser at sign-in | every sign-in attempt | legitimate interest: account protection (Art. 6(1)(f)) | 90 days |
| IP address and browser with consents | granting consent | legal obligation: provability | for as long as the consent is valid |
| Club content: posts, comments, reactions, video and audio messages | your activity in the club | performance of a contract | remains after membership ends, see VI. |
| Attendance at a online course (time of joining and leaving the room) | entering the online course room | performance of a contract | 3 years after the course |
| Recording of online course teaching (video and audio) | attending a course with the camera or microphone on | legitimate interest: evidence of how the teaching took place (Art. 6(1)(f)) | 3 years after the course |
| Profile: bio, city, website, links, photo | if you fill it in | consent (Art. 6(1)(a)) | until you delete it |
| System operational events | errors and security reports | legitimate interest: site operation | 180 days |
Birthday and name day greetings. The date of birth is optional and serves only so that I can send you my wishes. It is not displayed anywhere, I do not calculate your age from it and I do not pass it on to anyone. You can delete it at any time in your account settings. I do not store the name day anywhere, I derive it from your first name using the calendar. Greetings go only to those who have the newsletter turned on, and you can unsubscribe with one click as from any other email.
Online courses. I record the whole teaching and the room says so the entire time. You turn your camera and microphone on yourself. The recording serves as evidence of how the teaching took place; I do not publish it and do not pass it on to anyone other than participants of the same course.
III. Who receives the data
Processors without whom the site cannot run. I have data processing terms in place with all of them, and I provide data to none of them for their own marketing:
- Websupport, s. r. o. (Slovakia): website and database hosting.
- Resend, Inc. (USA): email sending. Transfers to the USA rest on standard contractual clauses.
- ComGate Payments, a. s. (Czech Republic): payment gateway for one-off purchases (book, e-book, online course). You enter card details directly with them and they never reach me.
- Stripe (Ireland/USA): club membership subscription payments including automatic renewals. You enter card details directly with Stripe and they never reach me; transfers to the USA rest on standard contractual clauses.
- Zásilkovna s. r. o. (Packeta) (Czech Republic): delivery of the printed book. I hand over the name, email, phone, and chosen pickup point.
- Solitea, a. s. (Czech Republic): iDoklad, issuing tax documents.
- BunnyWay d. o. o.: storage and CDN for images, video, and audio in the club. The provider is based in Slovenia; the data sits in Frankfurt with a replica in Prague, and no location outside Europe is enabled.
- LiveKit Incorporated (USA): real-time transmission of video and audio in the online room of the club and of online courses. Transfers to the USA rely on the EU–US Data Privacy Framework or, where applicable, on standard contractual clauses.
- Google Ireland Ltd.: Google Analytics traffic measurement. Without your consent it runs anonymously and cookie-free; details in the cookie policy.
- Cloudflare, Inc. (USA): Turnstile, verification that a form isn't submitted by a robot. It doesn't track users across websites.
In the site's admin area, an account shows a city derived from the last sign-in IP address; the lookup is provided by ip-api.com, which receives only the IP address itself, and the lookup is kept for at most 30 days.
When a password is created, it's checked against known data breaches via Have I Been Pwned. Only the first five characters of the password's hash are sent, never the password or the full hash, so it's impossible to tell which password was being checked.
IV. What is not done
- Without your consent I store no analytics cookies; measurement runs anonymously (see the cookie policy) and I use no advertising systems at all.
- I don't sell or rent personal data to third parties.
- There is no automated decision-making or profiling with legal effects.
V. Security
- The site runs exclusively over HTTPS.
- Passwords are stored as a hash (bcrypt), never in readable form. They can't be read back and I won't disclose them to anyone.
- Password reset and email change links are stored in the database as hashes too, with limited validity.
- Sign-in has a limited number of attempts; the admin account is additionally protected by a second factor.
- Club media load via signed URLs with limited validity, so a link can't simply be forwarded.
- Only I have access to the data.
VI. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time; withdrawal doesn't affect the lawfulness of processing up to that point.
You can handle most of this yourself in account settings: correcting data, unsubscribing from the newsletter, and closing your account. The newsletter can also be cancelled via the link in the footer of every mailing, without signing in.
Closing your account removes contact details, i.e. email, phone, company details, website, and social links, and ends sign-in, on the web and in the ZSF klub app on Google Play, which is just another way into the same account. Your posts and comments in the club remain signed with your name, because they're part of discussions others replied to. If you want those removed too, write to me and I'll handle it manually. Orders and tax documents must be kept for 10 years by law.
You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
VII. Changes
If a service that processes personal data differently is ever added to the site, this text will change before it launches.