Privacy policy

Who processes your data

The controller of your personal data is EffiStream s.r.o., Company ID (IČO) 24617865, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, entered in the Commercial Register kept by the Regional Court in Brno under file no. C 150354 (the “controller”).

Contact for data protection matters: info@effistream.eu, phone +420 732 974 927. We have not appointed a data protection officer, as our activities do not require one.

What data we process

In connection with running the website and providing our services, we process these categories of data:

• Identification data: name, company name.
• Contact data: email address, phone number.
• Communication data: the content of messages sent through the contact form and any follow-up correspondence.
• Technical data: IP address, browser type and details of your visit, such as where you came to the website from.

Why we process data

• Communicating with you: replying to questions from the contact form, arranging meetings.
• Providing services: performing contracts, managing client accounts, technical support.
• Information for clients: news about the services you use from us.
• Website security: server access logs (IP address, time, requested page, browser) that help us detect attacks and errors.
• Server statistics: a basic overview of traffic to evaluate operations and improve the website. Details below.
• Google Analytics: if enabled, it only runs with your consent.
• Legal obligations: accounting and tax obligations.

Legal basis for processing

• Performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR): replying to your enquiry and providing services to clients.
• Legitimate interest (Art. 6(1)(f) GDPR): website security, informing existing clients about related services and basic server traffic statistics. You can object to processing based on legitimate interest by writing to our contact email.
• Consent (Art. 6(1)(a) GDPR): measurement with Google Analytics. You give consent in the cookie banner and can withdraw it at any time.
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax obligations.

Filling in the contact form is voluntary. Without your name, email and message, however, we cannot reply. We do not use automated decision-making or profiling.

Basic server statistics

When a public page is fully loaded, we record its path without parameters, the domain of the referring website and the device category. To estimate daily visitors, the server derives an identifier from the IP address and browser details using a random key that changes every day. We do not store the raw IP address or the full browser details in the statistics. We do not link visits across days, to the contact form or to advertising profiles.

The counter runs on our server, uses no cookies or local storage and runs no tracking script in your browser. We keep records for at most 90 days; daily keys are deleted after the end of the following day during hourly maintenance. For requests with a Do Not Track or Global Privacy Control signal, we only increase the aggregate daily count of page loads for that page. We create no identifier for them and store no IP address, browser details, source or device in that count. These requests are not included in the unique visitor estimate. We do not share the data with advertising platforms.

Who we share data with

We do not sell data. To run the website we use these processors, who only handle data according to our instructions:

• Google Workspace (Google Ireland Limited, Ireland): company email and the spreadsheet that receives messages from the contact form. Any transfer outside the EU is governed by the EU-US Data Privacy Framework (European Commission decision 2023/1795).
• Google Analytics (Google Ireland Limited, Ireland): traffic statistics, only with your consent, with advertising features switched off. Any transfer outside the EU is governed by the EU-US Data Privacy Framework.
• CRM provider: records of clients, projects and communication with them. If the provider is based outside the EU, the transfer is governed by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
• Accounting services: bookkeeping and tax administration, limited to clients' billing details.
• Hukot.net (SecurityNet.cz s.r.o., Žamberk, Czechia): the servers the website runs on. Data stays in the EU.

We may also share data with public authorities where the law requires us to.

How long we keep data

• Contact form: while your enquiry is being handled, at most 1 year.
• Client data: for the duration of the contract and 3 years after it ends.
• Accounting records: 5 years, annual financial statements 10 years, under the Czech Accounting Act.
• Server logs: at most 15 days, then deleted automatically.
• Analytics data: in Google Analytics for at most 14 months, after which Google deletes it automatically.

Your rights

Under the GDPR you have these rights:

• Right of access: to find out what data we process about you.
• Right to rectification: to ask us to correct inaccurate or incomplete data.
• Right to erasure: to ask us to delete data that is no longer needed.
• Right to restriction of processing: in the cases set out in the GDPR.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to processing based on legitimate interest.
• Right to withdraw consent: at any time, without affecting the lawfulness of earlier processing.

You can exercise your rights by email at info@effistream.eu. We reply within one month at the latest.

You can object to receiving news about our services at any time. Just click the unsubscribe link in any such email or write to us, and we will stop immediately.

Right to lodge a complaint

If you believe our processing of your data breaches the GDPR, you can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

Data security

We have taken appropriate technical and organisational measures to protect data. Data is transferred encrypted (HTTPS), the website runs on servers in the EU and only authorised people have access to the data.

How the website uses cookies is described separately on the cookies page.