Privacy policy

1. Data controller

The controller is HDM s.r.o., Company ID 176 27 711, registered office at Školská 689/20, 110 00 Prague 1, Czech Republic, operator of the WebFunguje brand.

Privacy requests can be sent to stepan.svarc@hdm.black. No data protection officer has been appointed.

2. Data we process

• identity and contact details, company, email and enquiry content;
• contract, invoicing and customer-support data;
• Stripe transaction identifiers and payment status; we never receive or store full card details;
• technical usage and consent data when you enable the relevant measurement;
• pseudonymous first-party events such as page, interaction, language and viewport. We do not store IP addresses in our analytics database.

3. Purposes and legal bases

• handling enquiries and pre-contractual steps — Article 6(1)(b) GDPR;
• performing a contract and providing services — Article 6(1)(b);
• accounting, tax and legal duties — Article 6(1)(c);
• service protection and fraud prevention — legitimate interests under Article 6(1)(f);
• analytics and advertising measurement — consent under Article 6(1)(a), withdrawable at any time.

4. Recipients

Data may be processed by hosting and database providers, Stripe, our accountants and contracted IT suppliers. With consent, recipients also include Google (Analytics and Ads) and Seznam.cz (Sklik/SEM).

Stripe processes card data in its own environment. We receive only the identifiers and status required to match the payment.

5. International transfers

Where a supplier processes data outside the EEA, the transfer relies on an adequacy decision, Standard Contractual Clauses or another mechanism under Chapter V GDPR.

6. Retention

• unsuccessful enquiries: up to 12 months after the last communication;
• contract records: for the relationship and generally 3 years afterwards, unless longer retention is needed;
• tax and accounting documents: generally 10 years;
• first-party analytics events: up to 13 months, then aggregate outputs only;
• Google Analytics data: up to 14 months;
• consent choice: generally 6 months.

7. Your rights

You may request access, correction, deletion, restriction, portability, object to legitimate-interest processing and withdraw consent without affecting prior lawful processing.

You may also complain to the Czech Office for Personal Data Protection, uoou.gov.cz, or the competent authority in your country.

8. Security and automated decisions

We apply proportionate technical and organisational security, limited access, encrypted transfer and regular maintenance. We do not make solely automated decisions producing legal or similarly significant effects.