Privacy Policy (GDPR)
This policy explains what personal data we process in connection with the operation of this website, why we do so, how long we keep it, and what rights you have towards us. Information about cookies and the tools we use on the website can be found in the separate cookie notice.
Who is the controller of your data?
The controller is StringData, s.r.o., with its registered office at Na Švihance 1549/8, Vinohrady, 120 00 Prague 2, Czech Republic, Company ID: 49680331, registered with the Municipal Court in Prague under file no. C 21764. The contact address of our offices is Antala Staška 510/38, 140 00 Prague 4.
For all matters concerning the protection of personal data you can reach us at gdpr@stringdata.cz.
What data do we process, and on what basis?
We obtain personal data directly from you – from the forms you fill in on the website, from the e-mails you send us, and from your decision in the cookie bar. We do not buy any data about you, nor do we obtain it from public databases.
| Purpose of processing | What data | Legal basis | Retention |
|---|---|---|---|
| Handling your request for a no-obligation consultation | name, e-mail, company name, consultation topic | consent (Art. 6(1)(a) GDPR), given by ticking the box below the form | 24 months |
| Giving you access to the webinar recording you asked for | name, e-mail, webinar identification | consent (Art. 6(1)(a) GDPR) | 24 months |
| Replying to a message from the contact form | e-mail, phone, message text | consent (Art. 6(1)(a) GDPR) | 24 months |
| Demonstrating your cookie decision (Art. 7(1) GDPR) | shortened (anonymised) IP address, browser type, cookie bar language and version, consent state | legal obligation to demonstrate consent (Art. 6(1)(c) GDPR) | 3 years |
| Measuring traffic, the effectiveness of our advertising campaigns and displaying embedded video | data from cookies – see the cookie notice for detail; for advertising measurement also the fact that a form was submitted, without its contents | consent (Art. 6(1)(a) GDPR) | per individual cookie, see the cookie notice; event data in Google Analytics is retained for 14 months |
| Operating and securing the website, protecting forms from abuse | IP address in the server log | legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR) | we do not store the IP address with individual form submissions; it remains only in the server log, which is rotated continuously |
| Handling an e-mail you send us (including a reply to a job posting at hr@stringdata.cz) | data contained in the message and its attachments, typically name, e-mail, phone, CV | legitimate interest in replying to your message, and for job applicants steps prior to entering a contract (Art. 6(1)(f) and (b) GDPR) | for as long as necessary to handle your matter |
Providing your data is voluntary. You have no statutory or contractual obligation to give it to us. Without your e-mail, however, we cannot reply to you, and without the form we cannot give you access to a webinar recording.
Any consent you have given us can be withdrawn at any time – simply write to gdpr@stringdata.cz. Withdrawal does not affect the lawfulness of processing carried out before it. Cookie consent is more conveniently withdrawn via the "Cookie settings" link in the website footer.
How long do we keep the data?
We keep form data for 24 months from the date the form was submitted. Cookie-consent records are kept for 3 years from the moment they are created – we need this longer period so that we can demonstrate consent retroactively in the event of an audit or dispute.
Once these periods elapse, the data is deleted automatically and irreversibly. This is not a manual clean-up: the deletion is carried out by a scheduled automated task, so it cannot be forgotten.
Who do we share the data with?
Form data is processed by us alone, on infrastructure we operate ourselves. It is accessible only to our employees who need it in order to handle your enquiry.
Besides us, the providers of the cookies and analytics tools have access to the data those tools produce, always only to the extent of the category you allowed:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Google Analytics, Google Ads (measuring advertising effectiveness) and the YouTube player. Google Privacy Policy
- Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland – Microsoft Clarity. Microsoft Privacy Statement
Data from these services may also be made available to their parent companies Google LLC and Microsoft Corporation in the United States of America. The transfer relies on the standard contractual clauses approved by the European Commission and on both companies' certification under the EU-US Data Privacy Framework, for which the European Commission issued an adequacy decision. The current certification status can be verified in the Data Privacy Framework list.
We do not sell your personal data and we do not pass it on to anyone else for their own purposes.
Automated decision-making
We do not carry out automated decision-making or profiling based on your data that would produce legal effects concerning you or similarly significantly affect you.
What are your rights?
In connection with the processing of personal data you have the following rights:
- right of access – you may ask whether and what data we process about you, and request a copy;
- right to rectification – if the data is inaccurate or incomplete;
- right to erasure (the "right to be forgotten") – where we no longer need the data, you have withdrawn consent, or we process it unlawfully;
- right to restriction of processing – instead of erasure, we can merely "freeze" the data;
- right to data portability – data you provided on the basis of consent will be given to you in a machine-readable format, or passed to another controller;
- right to object to processing based on legitimate interest;
- right to withdraw consent at any time, without affecting the lawfulness of processing so far;
- right to lodge a complaint with a supervisory authority.
Rights are exercised by e-mail at gdpr@stringdata.cz. We will handle your request within one month; in complex cases we may extend this by a further two months, of which we will inform you. To avoid disclosing data to the wrong person, we may ask you to verify your identity.
If you are requesting erasure of, or access to, the data associated with your cookie consent, please provide your consent ID – you will find it in the "Cookie settings" window in the website footer.
If you believe that our processing of your data breaches the law, you may lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.
How do we protect the data?
We have adopted appropriate technical and organisational measures to secure personal data in a manner proportionate to the risk. The website runs exclusively over an encrypted HTTPS connection, access to the administration is protected by authentication, and form data is available only to authorised employees. For cookie-consent records we store only a shortened IP address – we never store the full IP address.
When we process data for our customers
As a supplier of IT solutions, the opposite role also arises in our customers' projects: there we process personal data as a processor, following the instructions of the customer, who is the controller. In that case we declare that we process the data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in particular Article 28(3) thereof, and that we have adopted all appropriate technical and organisational measures to ensure its security. This policy does not apply to such processing – information about it is provided by the relevant controller.
Changes to this policy
We may update this policy from time to time, for example when we start using a new tool or the scope of processing changes. The current version is always available on this page.
This policy was last updated on 4 August 2026.