Privacy Policy
PlainlySmart respects your privacy. This policy explains what personal data we collect when you visit our website or contact us, why we process it, how long we keep it and what rights you have.
The controller is Jakub Heidtke, IČO 87128250, operating under the PlainlySmart brand. The registered business address is shown below and on our Legal Information page. For questions or to exercise your rights, use the privacy email below.
Effective date:
Last updated:
- Legal business name
- Jakub Heidtke
- IČO
- 87128250
- Registered address
- Edvarda Beneše 1731/12, 301 00 Plzeň, Česká republika
- Business registry
- Fyzická osoba zapsaná v živnostenském rejstříku
Privacy contact: [email protected]
Information we collect
When you contact us, we process your name, email address and message, and any optional telephone number you provide. Our API also accepts an optional company name. We process related correspondence, your chosen language and information reasonably needed to respond.
Hosting and security providers process technical information such as IP addresses, browser and device characteristics and request metadata. If you separately enable campaign attribution, campaign parameters can accompany your inquiry. Please avoid sending sensitive personal information unless necessary and specifically requested.
Purposes and legal bases
We choose the legal basis according to the purpose of each processing activity. Legitimate interests must not override your rights and freedoms. You may object to processing based on legitimate interests.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Requested steps towards cooperation | Contact details, inquiry and correspondence | Article 6(1)(b) GDPR, only where necessary for pre-contractual steps at your request. |
| Other business correspondence | Contact details and correspondence | Article 6(1)(f): legitimate interest in answering and managing business communications. |
| Website and API security | Technical signals, verification result and request metadata | Article 6(1)(f): legitimate interest in protecting the website, infrastructure and communications from abuse and spam. |
| Optional campaign attribution | Campaign parameters linked to your inquiry | Prior permission for optional browser storage and consent under Article 6(1)(a) for related personal-data processing. Consent is optional and withdrawable. |
| Applicable legal obligations | Relevant contractual, accounting or tax records | Article 6(1)(c), only where a specific obligation applies to the record. |
Contact form and communications
We use your inquiry to respond, discuss possible cooperation and arrange a consultation where appropriate. The form requires your name, email address and message; telephone and company information are optional. Without the required information, we cannot process the form submission. You can also contact us by email.
Submitting an inquiry does not subscribe you to marketing. Newsletter signup is not currently offered on this website. We send an automatic receipt confirmation as a transactional communication, without a marketing subscription.
Service providers and recipients
Amazon Web Services (AWS) operates the contact API, serverless processing and application/API logs. Brevo stores inquiry contact records, including the message and any submitted campaign parameters, and delivers the notification to our business inbox and the confirmation to you. Contact records do not have an automatic expiry in this integration.
Cloudflare Turnstile protects the contact form against automated abuse. It processes technical signals when the configured form opens. Cloudflare acts as a processor for protecting this website and as a controller for improving its bot detection, as described in its notice. Website hosting and business email providers also process website requests and correspondence. Depending on the service and applicable terms, providers act as processors or independent controllers. We do not sell personal data.
Transfers outside the EEA
Our technology providers operate internationally. Cloudflare, Inc. is based in the United States; its privacy policy describes international processing and transfer safeguards, including standard contractual clauses and adequacy mechanisms where applicable. Brevo describes database hosting in France, Germany and Belgium; this does not establish that all service activities take place exclusively in the EU.
International transfers require an applicable GDPR mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Contact our privacy email for information about the safeguards applicable to your data and how to obtain a copy.
How long we keep information
We keep personal data only as long as necessary for the purposes described here. Inquiry records and related correspondence are kept while we handle the request and any follow-up, and are reviewed for deletion or anonymisation when no longer needed. Relevant client and project communications are kept during the relationship and subsequently where necessary to comply with specific legal obligations or establish, exercise or defend legal claims.
Accounting and tax documents are kept for the statutory period applicable to the document concerned. Application and API log groups are configured for 30 days. Provider delivery logs and backups have their own retention processes; deletion from active records does not imply immediate erasure from backups. Browser storage lifetimes are listed below.
Cookies and browser storage
We use browser storage to remember requested language, appearance and privacy choices. Optional campaign attribution stays disabled until you accept it. Rejecting attribution does not affect browsing or submitting an inquiry. Change your choice at any time through Privacy preferences in the footer.
Withdrawal clears stored campaign information in this tab and prevents its inclusion in future inquiries. It does not erase campaign information already submitted; contact us to request deletion of that data. We do not use advertising pixels or behavioural analytics in this website implementation. Turnstile uses technical security signals; its provider notice explains the processing.
| Storage | Purpose / provider | Category | Lifetime |
|---|---|---|---|
| theme | Appearance preference / PlainlySmart | Requested preference | localStorage: until changed or cleared; no configured expiry |
| preferredLocale | Language preference / PlainlySmart | Requested preference | localStorage: until changed or cleared; no configured expiry |
| plainlysmart.attribution-consent.v1 | Remember attribution choice / PlainlySmart | Privacy preference | localStorage: until changed or cleared; no configured expiry |
| plainlysmart.utm | Campaign parameters / PlainlySmart | Optional attribution, only after acceptance | sessionStorage: tab session, or earlier withdrawal. Browsers may restore a session. |
Your rights
Subject to GDPR conditions and limitations, you have the rights listed below. Contact our privacy email to exercise them. We may verify your identity proportionately.
We respond without undue delay and normally within one month. Where GDPR permits an extension, we will inform you within that month and explain why. Withdrawal of consent does not affect processing lawfully carried out before withdrawal.
- Access your personal data.
- Correct inaccurate data.
- Request erasure.
- Request restriction of processing.
- Receive or transfer data where portability applies.
- Object to processing based on legitimate interests.
- Withdraw consent at any time where processing relies on consent.
- Lodge a complaint with a competent supervisory authority.
Supervisory authority
If you believe your data has been processed unlawfully, you may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), or another competent supervisory authority.
Automated decision-making
We do not use information collected through this website for solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you. Automated bot checks protect the form against abuse.
Updates to this policy
We may update this policy to reflect changes in our services, processing or applicable requirements. The latest version is published on this page with its last update date.