This document sets out what personal data I process about you, why, for how long and what you can do about it. I have tried to write it so that it can actually be read, rather than merely clicked through.

Note on language. This is a translation for convenience. The Czech version is the authoritative text; if the two ever differ, the Czech wording prevails.

1. Who processes the data

The data controller is:

PhDr. Mgr. Šimon Růžička
Absolonova 635/12, Komín, 624 00 Brno, Czech Republic
Company no. (IČO) 17483824, not registered for VAT
Phone 725 802 729, email it.pomocnik.brno@gmail.com

I trade as a sole trader under the name IT Pomocník. I have not appointed a data protection officer — as an individual I am not required to. For anything to do with personal data, contact me directly.

2. What data I process

I process only what you tell me yourself. I do not look anything else up.

When you fill in the contact form or write to me:

your name
your phone number or email — whichever you give me
the area you need help with
your description of the problem and anything else you put in the message

When you order a service, additionally:

invoicing details including your address, and company and VAT numbers if applicable
details of the service provided and its price

During remote help: I see your computer screen for the duration of a session that you confirm yourself and can end at any time. I do not record the screen, take screenshots of it, or save anything from it.

The website collects nothing automatically — it has no analytics and no visitor tracking. The hosting provider keeps the usual technical access logs (IP address, time, page requested), which serve to run and secure the server.

3. Why I process it, and on what basis

Answering your enquiry. Without a name and a way to reach you, I have no way of replying. The legal basis is your consent under Article 6(1)(a) GDPR, which you give by ticking the box in the form. You may withdraw consent at any time, with no consequences for you.

Agreeing and providing the service. Once we are discussing a specific job, I process the data in order to deliver what we agreed — Article 6(1)(b) GDPR, performance of a contract and steps taken before entering into it. Consent is not required here, and withdrawing it does not end this processing.

Issuing invoices and bookkeeping. The legal basis is compliance with my legal obligations under Article 6(1)(c) GDPR. I have to keep this data even if you would rather I did not.

Protecting my rights. In exceptional cases, for example a dispute over payment, I may process data on the basis of legitimate interests under Article 6(1)(f) GDPR. You may object to such processing.

4. How long I keep it

An enquiry that does not turn into a job — one year at most, then I delete it
Data about a completed job — for the duration of our dealings and three years afterwards, in case of complaints or disputes
Invoices and accounting records — for as long as tax and accounting legislation requires
Data processed on the basis of consent — until that consent is withdrawn

Once these periods pass, I delete or anonymise the data.

5. Who else sees the data

I do not sell personal data, do not pass it on for advertising, and do not share it with anyone who does not need it. Technically, however, it passes through the services I use to run the business. These act as processors and are bound by confidentiality and security obligations:

Netlify, Inc. — website hosting and processing of submitted forms
Google Ireland Ltd. — the mailbox your enquiries arrive in
My accountant or tax adviser — if an invoice is issued
Public authorities — where the law requires it

Transfers outside the European Union. Netlify is a US company and some processing may take place on servers outside the EU. The providers I use have appropriate safeguards in place for this — either standard contractual clauses approved by the European Commission under Article 46 GDPR, or certification under the EU–US Data Privacy Framework. Their current terms are available in those providers’ own documentation.

6. Cookies and tracking

This website uses no cookies and no analytics tools whatsoever. There is no Google Analytics, and no advertising or tracking scripts. That is also why there is no cookie banner — there is nothing to consent to.

The one exception is playing videos in the portfolio. The YouTube player loads only at the moment you click a video — until then, nothing is sent to Google’s servers. I use the youtube-nocookie.com variant, which limits tracking, but the player will still store something in your browser. If you do not play a video, nothing happens.

7. Your rights

In relation to your personal data, the GDPR gives you these rights:

Right of access — you can ask what data I hold about you and receive a copy of it
Right to rectification — if something is wrong or incomplete, I will correct it
Right to erasure — I will delete the data if it is no longer needed, or if you withdraw consent and there is no other reason to keep it
Right to restriction of processing — while a disputed point is being resolved, I may only store the data and otherwise leave it alone
Right to data portability — I will give you the data you provided in a machine-readable form
Right to object — to processing based on legitimate interests
Right to withdraw consent — at any time, without giving a reason and without consequences. Withdrawal does not affect the lawfulness of processing before it.

Just write to it.pomocnik.brno@gmail.com or call 725 802 729. I will deal with it within one month at the latest. I may check that you are who you say you are — so that I do not hand your data to a stranger.

8. Complaints

If you think I am not handling your data properly, please come to me first — most things can be sorted out straight away. You are, however, fully entitled to go directly to the supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
uoou.gov.cz

9. Do you have to provide the data

No. You do not have to fill in the form and nothing happens if you do not. Without a name and a contact, though, I have no way of getting back to you. For a job already agreed, providing invoicing details is a legal requirement — without them I cannot issue a document.

10. Automated decision-making

There is none. No automated system evaluates your data, I do not profile anyone, and nothing about you is decided by machine.

11. Security

The site runs exclusively over encrypted HTTPS connections. Access to the mailbox and to the site’s administration is protected by strong passwords and two-factor authentication. I do not keep the data on paper or on portable drives. If a breach did nevertheless occur that posed a high risk to you, I would tell you about it.

12. Changes

If the way I process data changes, I will update this document and put the new effective date at the top. It is worth looking in here occasionally.

How I handle your personal data