Privacy Policy

1. Who is the controller of your data

The controller of personal data is Medici Analytica s.r.o., company ID (IČO): 11704934, with its registered office at Příkop 843/4, Zábrdovice, 602 00 Brno, registered in the Commercial Register maintained by the Regional Court in Brno („Medici Analytica“). You can contact us on personal data matters via the contact form. We will add a company mailbox once it is set up.

2. What personal data we process

We process only the data you voluntarily provide to us, specifically:

• identification data: first and last name, company name and company ID, job title;
• contact data: email, phone;
• content of communication: a description of your enquiry, the brief generated by the interactive form, and any attachments you send us;
• basic technical data associated with running the website (e.g. IP address and browser type stored in the hosting operational logs) — see point 9.

3. Purpose and legal basis of processing

We process personal data for the following purposes:

• handling an enquiry and pre-contract negotiation — under Article 6(1)(b) GDPR (steps taken before entering into a contract at your request);
• communication outside contract negotiations (e.g. a general question) — based on the controller's legitimate interest in handling a received message, Article 6(1)(f) GDPR;
• performance of a concluded contract for the provision of services — Article 6(1)(b) GDPR;
• compliance with legal obligations (e.g. accounting and tax documents) — Article 6(1)(c) GDPR.

We do not use personal data for automated decision-making or profiling that would have legal effects for you.

4. Where we obtain the data

All processed personal data comes directly from you — from the interactive form on the Contact page, from email communication, or from any phone arrangement.

5. Who we share the data with

We generally do not share your data with third parties, except for the technical processors that enable us to operate the website and email communication:

• the web hosting provider (Vercel Inc.), on whose infrastructure the site runs;
• the email provider (Google / Google Workspace), through which we receive and send email communication.

A data processing agreement under Article 28 GDPR will be concluded with any further processors (e.g. accountant, CRM). We do not sell personal data or share it with third parties for marketing purposes.

6. Transfers to third countries

Some of the processors listed above (e.g. Vercel Inc., Google LLC) are based or have servers outside the European Economic Area, in particular in the USA. Transfers to these countries are secured by the European Commission's Standard Contractual Clauses, or by the processor's participation in the EU–US Data Privacy Framework, so that an adequate level of protection of your data is maintained.

7. Retention period

We keep data from an enquiry or question for the duration of the cooperation talks, but no longer than 12 months from the last contact, unless a contractual cooperation begins. Where a contract is concluded, we keep the related data for the duration of the contractual relationship and then for the period required by law (e.g. accounting and tax documents typically for 10 years).

8. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encrypted data transmission (HTTPS) and restricting access to the mailbox and internal systems to authorised persons only.

9. Cookies and technical data

This website currently uses no analytics, marketing, or otherwise non-essential cookies — we do not track your behaviour on the site and do not use third-party advertising or tracking tools. As part of normal operation, the hosting platform may briefly store technical operational logs (e.g. IP address) necessary for the security and functioning of the site. If we deploy analytics tools in the future (e.g. to measure traffic), we will update this policy and, where relevant, add an appropriate consent mechanism.

10. Your rights

In connection with the processing of personal data, you have the right:

• to access your personal data (Article 15 GDPR);
• to rectification of inaccurate or incomplete data (Article 16 GDPR);
• to erasure of data (the „right to be forgotten“) where the conditions are met (Article 17 GDPR);
• to restriction of processing (Article 18 GDPR);
• to data portability (Article 20 GDPR);
• to object to processing based on legitimate interest (Article 21 GDPR);
• to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

You can exercise your rights via the contact form. We will respond to your request without undue delay, and no later than within one month.

11. Changes to this policy

We may update this policy to a reasonable extent, in particular in connection with changes to the scope of services provided or the tools used. The current version is always available on this page and the date of the last update is shown in its header.