Privacy Policy

1. Data Controller

The controller of your personal data is:

2. What personal data we process

Depending on how you use our services, we may process the following personal data:

Data from the contact form

• First and last name
• Email address
• Phone number (optional)
• Company name
• Google business profile URL
• Message content

Data arising from service provision

• Billing information (name/company name, address, company number)
• Order and payment records (card numbers are never stored — processed exclusively by Stripe)
• Google Maps URL and publicly available business ratings
• Email correspondence

Technical data

• IP address (anonymised)
• Browser and operating system type
• Date and time of visit
• Cookies (see separate Cookie Policy)

3. Purpose and legal basis for processing

We process your personal data only for specific, explicitly stated and legitimate purposes:

4. How long we retain data

• Contact enquiries — 3 years from last contact
• Contractual documentation and invoices — 10 years (statutory requirement)
• Orders and payment records — 5 years
• Marketing emails — until consent is withdrawn or objection raised
• Logs and technical records — 90 days

5. Who we share data with

We do not sell or rent your personal data to third parties. We share it only with trusted processors who are contractually bound to protect it:

• Stripe, Inc. — payment gateway; processing payment transactions. US-based (EU–US DPF). Stripe Privacy Policy
• Resend, Inc. — sending transactional emails. US-based (Standard Contractual Clauses). Resend Privacy Policy
• Cloudflare, Inc. — hosting and security (CDN, DDoS protection). US-based (EU–US DPF).

All transfers to third countries are covered by appropriate safeguards pursuant to Art. 46 GDPR.

6. Your rights

As a data subject, you have the following rights, which you may exercise by emailing [email protected]:

• Right of access — you may request an overview of the data we hold about you at any time.
• Right to rectification — if your data is inaccurate, we will correct it.
• Right to erasure ("right to be forgotten") — subject to the conditions of Art. 17 GDPR.
• Right to restriction of processing — where the accuracy or lawfulness of processing is in dispute.
• Right to data portability — we will provide your data in a machine-readable format.
• Right to object — in particular against processing for marketing purposes.
• Right to withdraw consent — consent to cookies or marketing may be withdrawn at any time.

We will respond to your request within 30 days. You also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

7. Data security

All communication between your browser and our server is encrypted using TLS (HTTPS). Access to personal data is restricted to authorised staff bound by confidentiality obligations. Payment data (card number, CVV) is never seen or stored by us — it is processed exclusively within Stripe's secure environment.

8. Automated decision-making and profiling

We do not carry out automated decision-making or profiling with legal or similarly significant effects. Personalised offers are prepared manually on the basis of publicly available information about your Google profile.

9. Updates to this policy

This policy may be updated from time to time. We will notify you of material changes by email or via a notice on the website. The current version is always available at www.googfix.com/gdpr.