Privacy Policy
Updated 17 September 2026Version 2026-09-17
This page explains which personal data this website processes, why, for how long, and what rights you have. We wrote it to be read in full. It applies to the website at https://ekvio.cz (the “website”). The platform behind the “Sign in” button has its own terms and a data processing agreement that we sign before any data changes hands.
1. Who the controller is
The controller of your personal data is the operator of the Ekvio website, e-mail jakub@ekvio.cz (“we”).
Contact for data protection matters: jakub@ekvio.cz. We have not appointed a data protection officer — we do not meet the conditions of Article 37 of Regulation (EU) 2016/679 (the “GDPR”).
2. The principles we follow
- We collect only what a given purpose needs. Every form field has a reason listed in the table below; anything not required is marked optional.
- No cookies, no cross-site tracking. The website stores nothing in your browser (see section 4 and the Cookies page).
- Form data never goes into logs or analytics. An e-mail address in a server log is the same leak as an e-mail address in a marketing tool.
- We do not sell data or pass it on for third-party marketing.
- People decide, not machines. We do no automated decision-making or profiling within the meaning of Article 22 GDPR.
3. What we process and why
The website currently has no forms — you can reach us by e-mail. What happens with your e-mail is in the table below.
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Replying to your e-mail | what you write to us and your address | reply to you | legitimate interest, Art. 6(1)(f) GDPR; or steps prior to a contract | 12 months after the matter is closed |
| Running and securing the website | IP address, time, requested page and browser type in the hosting provider's technical logs | keep the website running and resist abuse | legitimate interest, Art. 6(1)(f) GDPR | a matter of days, per the hosting provider's settings |
| Traffic measurement | see section 5 | know which pages people read | legitimate interest | aggregate figures not tied to a person, kept indefinitely |
What we do not collect through the website. The website does not allow file uploads. We never receive payroll exports or any employee data through it — that happens only in the platform, after a data processing agreement is signed. We do not want special-category data (Article 9 GDPR) and no form asks for it.
4. Cookies and browser storage
The website stores no cookies in your browser and nothing in browser storage (localStorage, sessionStorage) — not even “technical” ones. The language is part of the address (/cs, /en), so we do not need to remember it. An automated test verifies this every time the website is deployed. Details are on the Cookies page.
Should this change in the future — for example by deploying a tool that requires browser storage — we will first update this page and, where Section 89(3) of the Czech Electronic Communications Act (Act No. 127/2005 Coll.) requires it, ask for your consent beforehand.
5. Traffic measurement
We do not currently measure website traffic with any tool. When we deploy one, it will be a tool without cookies and without identifying people, and this section will change before it starts measuring.
6. Protecting forms against bots
We protect the forms against abuse by limiting the number of submissions on the server (section 3). We do not currently use a third-party service for this; when we deploy one, we will describe it here before it starts working.
7. Who processes data on our behalf
We run no servers of our own. The providers below process data for us, each only for the stated purpose and under a data processing agreement pursuant to Article 28 GDPR:
| Provider | Purpose | Where it runs | Transfer outside the EU |
|---|---|---|---|
| Vercel Inc. data processing agreement | hosting and running the website, technical logs | functions and form data in an EU region; public pages via a global CDN USA | EU-U.S. DPF (certified), standard contractual clauses |
We pass data to no one else. The exceptions are a legal obligation (for example a request from a public authority entitled to make it) and the protection of our rights in court or administrative proceedings.
8. Transfers outside the European Union
Data is stored in data centres in the European Union. Some providers listed above are based in the USA and may access data from there, typically for support or service administration. Such transfers rely on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework (2023/1795) for providers certified under it, and on the Commission's standard contractual clauses (2021/914) as a fallback mechanism. We will provide a copy of the relevant safeguards on request.
9. Your rights
Under the GDPR you have the right:
- of access to the data we hold about you, and to a copy of it (Art. 15);
- to rectification of inaccurate data (Art. 16);
- to erasure (Art. 17) — for form data we carry it out without undue delay and within 30 days at most, unless the law requires us to keep the data;
- to restriction of processing (Art. 18);
- to portability of data you gave us on the basis of consent or a contract (Art. 20);
- to object to processing based on legitimate interest (Art. 21) — we then stop unless we can show compelling grounds that override your interests;
- to withdraw consent at any time (Art. 7(3)).
Just write to jakub@ekvio.cz. We reply within one month; if we need more time, we will tell you why. To avoid handing data to the wrong person we may ask you to verify your identity — writing from the address the request concerns is usually enough.
You also have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. We would appreciate hearing from you first, but that is not a condition.
10. How we protect data
The connection to the website is encrypted (TLS). E-mails you send us are read in an ordinary mailbox and are not copied anywhere else. Only people who need it to handle your request have access. Test and development environments do not work with real data. The database is backed up by its provider within the same region.
11. Children
The website is intended for employers and their representatives, not for children. We do not knowingly process data of persons under 15; if we learn that we have, we delete it.
12. Changes to this policy
The policy version is shown in the page header and stored with every consent. We will flag any substantial change on this page; previous versions are available on request. This version (2026-09-17) replaces the versions of 10, 11 and 16 September 2026: the sections on forms and their processors are shown only when forms are actually running on the website.