Privacy Policy

1. Data Controller

The data controller is Karel Huk, sole proprietor, ID: 08581835, VAT ID: CZ9412192537, with its registered office at Ke Stříbrnému dolu 50, Jiřetín pod Jedlovou, 407 56, Czech Republic (hereinafter "controller").

For questions regarding data protection: [javascript nutný pro zobrazení e-mailu]

The controller has not appointed a Data Protection Officer (DPO) as this is not required under Article 37 GDPR.

2. What Data I Process

Contact form on the website:

• Full name
• Email address
• E-shop URL (if provided)
• Message content

Product feed enrichment service (page /en/enrich-product-feed-google-ads):

• Email address
• E-shop URL
• Uploaded CSV/XML file with product data
• Generated Google Sheet with enriched data
• IP address and technical logs (security, abuse prevention)

The service does not process any special categories of personal data within the meaning of Article 9 GDPR.

3. Purpose of Processing

Contact form data is processed for:

• Responding to your inquiry
• To establish a business relationship
• Sending a price quote

Feed enrichment service data is processed for:

• Generating the enriched product feed and delivering the result
• Any follow-up communication about your results (only if you request it)
• Security and abuse prevention (rate limiting, anomaly detection)

4. Legal Basis for Processing

• Consent given by submitting the form (Art. 6(1)(a) GDPR) for the contact form and by checking the consent box on the service upload form
• Performance of contract (Art. 6(1)(b) GDPR) for the generation and delivery of the enriched feed
• Legitimate interest of the controller (Art. 6(1)(f) GDPR) for service security and responding to inquiries

5. Data Retention Period

Contact form: a maximum of 3 years from the last contact, unless a business relationship is established.

Feed enrichment service: uploaded CSV/XML, email address, and e-shop URL are automatically deleted after 30 days by a daily server job. The generated Google Sheet remains on your Google account if you copied it or attached it as a supplemental feed in Google Merchant Center. I revoke sharing of the Sheet after 30 days, but I do not delete the Sheet itself to avoid breaking a supplemental feed connected to your Google Ads.

IP addresses and technical logs are retained for a maximum of 60 days for security purposes, then automatically deleted.

6. Data Recipients (Processors)

To operate the feed enrichment service, I use the following processors:

• Anthropic, PBC (USA): processing of product description texts via the Claude API. Privacy policy.
• Resend (Resend Inc., USA): delivery of transactional emails. Privacy policy.
• Google LLC (EU, USA): hosting the resulting Google Sheets and traffic measurement via Google Analytics 4. Privacy policy.
• Vercel Inc. (EU, USA): application hosting. Privacy policy.
• Convex (Convex Inc., USA): backend database for enrichment task state and transactional logs. Privacy policy.
• Cloudflare (Cloudflare Inc., USA): bot protection on the upload form via Turnstile. Privacy policy.

All listed processors have Standard Contractual Clauses (SCC) approved by the European Commission in place, ensuring an adequate level of protection when transferring data outside the European Economic Area.

Data is not transferred to any other third party beyond the processors listed above, except where required by law or by order of a public authority.

7. Your Rights

You have the following rights regarding the processing of your personal data:

• Right of access: you have the right to know what data I process about you (Art. 15 GDPR).
• Right to rectification: you have the right to request correction of inaccurate data (Art. 16 GDPR).
• Right to erasure: you have the right to request deletion of your data, the "right to be forgotten" (Art. 17 GDPR).
• Right to restrict processing (Art. 18 GDPR).
• Right to data portability: to obtain your data in a machine-readable format (Art. 20 GDPR).
• Right to object to processing based on legitimate interest (Art. 21 GDPR).
• Right to withdraw consent at any time, without providing a reason (Art. 7(3) GDPR).
• Right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz), Pplk. Sochora 27, 170 00 Prague 7.

To exercise any right, email me at [javascript nutný pro zobrazení e-mailu]. I will process your request within 30 days. For the feed enrichment service, data is automatically deleted after 30 days without any request, but I can delete it sooner at your request.

8. Data Security

I have adopted appropriate technical and organizational measures to protect data:

• Encrypted transport (HTTPS / TLS) for all communication with the service.
• Encrypted data storage within the processors' infrastructure (Convex, Google).
• Access to data is restricted to the controller on a need-to-know basis.
• Regular automated data deletion after the retention period expires.
• Bot and abuse protection via Cloudflare Turnstile and rate limiting at the email, IP address, and e-shop URL level.

9. Cookies

This website uses the following types of cookies:

• Strictly necessary cookies: ensure basic site functionality, e.g. remembering your cookie decision. Do not require consent.
• Analytics cookies: help me understand how visitors use the site (Google Analytics 4, Microsoft Clarity). Only activated with your consent.
• Marketing cookies: used for ad personalization and remarketing (Google Ads). Only activated with your consent.

I use a custom cookie banner to manage consent. The banner runs only in your browser, stores your decision locally (localStorage), and does not transfer any data to third parties. After your choice, the banner updates the Google Consent Mode v2 signal, which governs the firing of GA4 and Microsoft Clarity in Google Tag Manager.

You can change your consent at any time via the "Cookie settings" link in the footer, or by clearing cookies and localStorage in your browser.

10. PPC Campaign Management Tools

I use a proprietary internal tool for PPC campaign management and reporting connected to the Google Ads API. No data from this API is shared with third parties or stored outside a secure local environment.