Privacy Policy and Use of Cookies

1Data controller

The controller of your personal data is:

2Enquiry form and other communication

When you contact us through the form on the website, we process the data you enter:

• first name and surname,
• e-mail address,
• phone number, if you provide it,
• the text of your message or enquiry and any other information you choose to include,
• the language version of the website from which you sent the form.

The content of the form is delivered to us by e-mail to info@gtd.cz. We process your data in the same way if you contact us by e-mail, by phone or via WeChat. When you communicate with us via WeChat, the content of your messages is also processed by the provider of that service (Tencent) under its own terms.

We use the data to handle your enquiry and for related communication. If your request concerns entering into or performing a contract, the legal basis is taking steps prior to entering into a contract or performing a contract under Article 6(1)(b) GDPR. For general enquiries, the legal basis is our legitimate interest in communicating with website visitors under Article 6(1)(f) GDPR.

If you have allowed both analytics and marketing cookies in the cookie bar, after the form has been sent successfully we also pass your e-mail address and phone number to Google in hashed form (see section 9). We never pass your name or the text of your message to Google.

We keep the data for as long as necessary to handle your request and for a reasonable period for follow-up communication and the protection of our legal claims, usually no longer than 3 years from our last communication. If a contractual relationship arises between us or a longer period is required by law, we keep the relevant data for that longer period.

Providing your data is voluntary. Without your name, e-mail address and message, however, we cannot handle your request.

3Protecting the form against abuse

We protect the form with ALTCHA verification, which runs entirely on our own server. When you start filling in the form, your browser solves a short computational task in the background and sends the result together with your message. No third-party service is involved, no cookies are stored and we do not try to identify you.

The form also contains a hidden field that only automated programs fill in, and it limits the number of messages from one IP address (no more than 5 messages in 10 minutes). For this we do not store your IP address; we only record a fingerprint of it created with a secret key (HMAC-SHA256), which is deleted automatically within one hour at the latest.

The legal basis is our legitimate interest in protecting the website and the form against spam and abuse under Article 6(1)(f) GDPR.

4Operational and security data

When you visit the website, technical data needed for its operation and security may be processed automatically, in particular:

• IP address,
• date and time of the request,
• the page or file requested,
• browser type, operating system and device,
• server error, operational and security logs.

We use this data to ensure the website works correctly and securely, to detect technical problems and to protect against abuse. The legal basis is our legitimate interest in the secure and reliable operation of the website under Article 6(1)(f) GDPR. We keep the logs only for as long as necessary for these purposes; in the event of a security incident, for as long as needed to investigate it.

5Cookies and local storage

Cookies are small data files that a website stores in your browser. The website may also use your browser's local storage (localStorage). Unlike cookies, its content is not sent to the server automatically, but from a privacy perspective it can serve a similar purpose.

By purpose, we distinguish:

• essential technologies, which we use without consent to the extent permitted by law (section 6),
• analytics cookies for measuring traffic (sections 7 and 9),
• marketing features of Google services (section 9).

We activate analytics and marketing technologies only after you give your consent. The website does not embed third-party content such as maps or videos, and it loads its fonts from our own server.

6Essential technologies

We use essential technologies only to make the website work and to remember choices you have made yourself. Under Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications, no consent is required for them.

7Google Analytics 4

With your consent, we use Google Analytics 4, which is loaded onto the website by Google Tag Manager. It helps us understand how visitors use the website. In particular, we obtain information about:

• the number of visits and visitors,
• the pages visited and the course of the visit,
• the type of device and browser,
• the approximate geographic area,
• the source from which you came to the website,
• interactions with the website.

Measured events

In addition to page views, we record that you clicked on our phone number or e-mail address (only which of our contacts you clicked is recorded) and that you successfully submitted the enquiry form (the type of form and the language version of the website are recorded). We never send your name or the text of your message to Google Analytics. We pass the e-mail address and phone number from the form in hashed form only if you have also consented to marketing cookies (section 9).

Google Analytics 4 does not store full IP addresses. An IP address may be used technically to determine the approximate area and is then deleted by Google in accordance with the rules of the service.

The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by other Google group companies, including Google LLC in the USA, which is certified under the EU–US Data Privacy Framework. Where this mechanism does not apply, other appropriate safeguards under the GDPR are used.

We keep user and event data for the period set in the service, no longer than 14 months. This setting may not apply to aggregated statistical reports.

8Cookie consent

We use analytics and marketing technologies only on the basis of your prior consent under Article 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications.

On your first visit, these technologies are not active. Neither Google Tag Manager nor Google Analytics is loaded, and no request is sent to Google's servers until you give your consent.

In the cookie bar, you can choose:

• Accept all – you allow analytics cookies and marketing features,
• Settings – you allow analytics cookies only, or analytics together with marketing (marketing features do not work without analytics),
• Essential only – you reject everything optional and the website uses essential technologies only.

Withdrawing or changing consent

You can change or withdraw your consent at any time using the Cookie settings link in the footer of every page. As soon as you withdraw consent, we stop the measurement immediately and delete the Google Analytics cookies (_ga, _ga_…, _gid, _gat) from your browser, and for marketing features also _gcl… and _gac…. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Validity of your choice

Your choice is valid for 6 months; after that, the cookie bar is shown again. The choice is tied to a specific browser and device; after clearing your browser data or in a private window, the cookie bar is shown again.

Record of your choice

To be able to demonstrate which choice you made, we store on our server the date and time of the choice, a random identifier stored in your browser, the option you selected, the version of the cookie bar, the page on which you made the choice and a general description of the browser and system (for example "Chrome / Windows"). We do not store your IP address in this record. To protect the server against overload, we limit the number of records from one IP address; for this we store only a fingerprint of it created with a secret key, which is deleted within one hour at the latest.

We record later changes or withdrawal of consent in the same way, so the sequence of your choices can be seen. The record is not publicly accessible, is not used for profiling or marketing, and we process it on the basis of our legitimate interest in demonstrating compliance with legal obligations under Article 6(1)(f) GDPR. We keep it for 3 years, after which the server deletes it automatically.

9Analytics and marketing cookies

Once you consent to analytics cookies, the following cookies may be stored:

Marketing features

If you consent to both analytics and marketing cookies, we may use the following Google Analytics features:

• Google signals – Google may link visit data with the Google accounts of signed-in visitors who have ad personalisation turned on. This gives us aggregated cross-device statistics and approximate demographic data; we cannot identify individual people from them.
• User-provided data – after the enquiry form has been sent successfully, we pass the e-mail address and phone number you entered to Google. While still in your browser, they are converted into a one-way code (SHA-256 hash) from which the original value cannot be read. Google uses them to match visits and enquiries more accurately. We do not pass your name or the text of your message.
• Ad effectiveness measurement – if we connect the website with Google advertising services (such as Google Ads), we will evaluate whether a visit or enquiry came from an ad. In that case, the _gcl_au cookie may be stored for 90 days.

The legal basis is your consent under Article 6(1)(a) GDPR. We keep the data for the period set in Google Analytics, no longer than 14 months; for transfers outside the EEA, the same applies as in section 7. You can withdraw consent to marketing features separately without affecting analytics cookies.

The website does not use Meta Pixel, Sklik or any other advertising tools. If we start using them in the future, we will update the cookie bar and this information before activating them.

10Recipients of personal data

The following may have access to personal data to the extent necessary:

• our web hosting provider,
• the supplier of technical website administration,
• our e-mail and IT service provider,
• Google Ireland Limited and other Google group companies in connection with Google Analytics and Google Tag Manager, if you have given consent,
• Tencent, if you communicate with us via WeChat,
• other suppliers where necessary for the operation, administration or security of the website.

Suppliers who process data on our behalf do so only to the extent necessary for the service in question and on the basis of a contract. We do not sell personal data or pass it to third parties for their own marketing.

11Your rights

Under the conditions laid down by the GDPR, you have the right to:

• request information about the processing of and access to your personal data,
• request correction of inaccurate or incomplete data,
• request erasure of your data,
• request restriction of processing,
• data portability, where the conditions of Article 20 GDPR are met,
• withdraw consent at any time where processing is based on consent,
• object to processing based on legitimate interest,
• lodge a complaint with the supervisory authority.

You can exercise your rights by e-mail at info@gtd.cz.

The supervisory authority is:

12Updates to this information

We may update this information, for example when legislation or the tools used on the website change. The current version is always published on this page.

Last updated: 22 September 2026