Privacy policy

The data controller is GIFTORA s.r.o., Company ID 17746094, VAT ID CZ17746094, with its registered office at V Olšinách 2300/75, Strašnice, 100 00 Prague 10, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 375978, and operator of Chci Deskovku! (the “Controller”).

• Office and registered address: V Olšinách 2300/75, Prague 10
• info@giftora.cz
• +420 724 548 155
• Mon–Fri 9 am–5 pm, Sat–Sun closed

This policy is issued under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on Personal Data Processing, to fulfil the Controller’s information obligations. The Controller has not appointed a data protection officer. Please use the contact details above for all enquiries.

Personal data is any information that can identify an individual. We process data you provide, typically through an enquiry form, by email, or by phone, and data generated while fulfilling a project.

We do not carry out automated decision-making or profiling that would have legal effects on you.

• Handling enquiries and preparing quotes — legal basis: steps towards a contract or our legitimate interest in responding to your enquiry (Article 6(1)(b) and (f) GDPR).
• Performing a contract — designing, producing, and delivering a custom game, project correspondence, and handling complaints (Article 6(1)(b) GDPR).
• Legal obligations — accounting and tax records (Article 6(1)(c) GDPR).
• Commercial messages and newsletters — we do not currently send commercial messages or newsletters. If we introduce them, we will obtain your separate consent (Article 6(1)(a) GDPR) and provide an unsubscribe option at any time. Accepting the terms and conditions on a form does not constitute consent to marketing.
• Traffic statistics — measuring aggregate website traffic only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.
• Third-party content — the embedded Google Maps map loads only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• Security and website operation — protecting the website and forms against automated abuse, including the Cloudflare security cookie (Article 6(1)(f) GDPR, our legitimate interest).

Providing contact details in an enquiry is voluntary, but we cannot respond or prepare a quote without them.

• Enquiries that do not lead to a working relationship: 2 years from the last communication.
• Contractual relationship data: throughout the relationship and then for 10 years to meet accounting, tax, and archiving obligations.
• Cookie preferences and cookie records: no longer than 12 months.
• Traffic statistics: the cookie session-id is stored in the browser for 30 minutes. We have not yet received confirmation of how long the hosting provider retains aggregate statistical data on its servers. We have requested this information and will add it here.

After these periods, we delete or anonymise the data. Deletion takes place as part of project administration, rather than automatically on an exact calendar date.

Both website forms require your name, email, phone number, company name, and brief. They cannot be submitted without these details, which we need to reply and prepare a quote. These requirements are also checked on our server.

We store enquiry form data in our own database on our technical provider’s cloud infrastructure, in the European Union data region (Frankfurt am Main). Enquiries cannot be read through the public website or public browser access. They are accessible only through our administration area after signing in. We send notifications of new enquiries and any confirmations by email.

When a form is submitted, we also record technical information: an irreversible hash of the IP address and the browser identifier (user agent). These are used solely to protect the form against spam and abuse, based on our legitimate interest (Article 6(1)(f) GDPR). Enquiries that do not lead to a working relationship are deleted after 2 years.

The detailed enquiry form allows an optional reference image or PDF upload (max. 10 MB). The attachment is stored privately without public internet or browser access and is used solely as a reference for your brief. It is deleted with the enquiry, no later than after 2 years.

We share data only to the extent necessary with the following categories of processors and recipients:

• the hosting and technical website provider, including the enquiry database, which also provides traffic statistics on our behalf; these start only with your consent to analytics cookies,
• Cloudflare, Inc., which provides the network through which the website is available and protected against automated attacks,
• email and office infrastructure providers,
• production, printing, and logistics partners involved in fulfilling a project,
• accounting, tax, and legal advisers,
• Google Ireland Ltd. / Google LLC for the embedded Google Maps map, which loads only with your consent to marketing cookies and third-party content.

Our technical provider stores the enquiry database and uploaded attachments in the European Union data region (Frankfurt am Main). Cloudflare and Google services may involve processing outside the European Economic Area under standard contractual clauses approved by the European Commission. We share data with public authorities only where required by law.

The website uses encrypted HTTPS connections and the Cloudflare security network. Enquiries are stored in a private database with no public website or browser access. They can be read only through our administration area after signing in. Attachments are in private storage without public internet access.

Ordinary email correspondence cannot be guaranteed to be fully encrypted at both ends. Please avoid emailing sensitive data that we do not need to handle your enquiry.

• Right of access (Article 15) — confirmation of whether we process your data and a copy of it, including information about purposes, categories, recipients, and retention periods.
• Right to rectification (Article 16) — correction of inaccurate data or completion of incomplete data.
• Right to erasure (Article 17) — where no other lawful basis for processing remains.
• Right to restriction of processing (Article 18).
• Right to data portability (Article 20) — for data processed on the basis of consent or a contract.
• Right to object (Article 21) — to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — at any time, without affecting processing carried out before withdrawal.

You can exercise your rights by contacting info@giftora.cz or writing to our registered address. We will respond within one month at the latest.

You also have the right to complain to the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.cz.

A detailed overview of cookies, categories, and storage periods is available in our cookie policy. Without consent, we store only technically necessary cookies, under the opt-in requirements of Section 89(3) of Act No. 127/2005 Coll.

We want this policy to reflect how things work, so we also identify information our providers have not yet confirmed:

• how long the hosting provider retains traffic statistics on its servers, which is separate from the 30-minute browser storage period,
• the complete list of additional processors used by the hosting provider.

We have requested this information and will add it once we receive written confirmation. If you need a particular detail sooner, please email info@giftora.cz.

We may update this policy, for example when introducing new tools or following changes in legislation. The current version is always available on this page with its effective date. The terms governing our work together are set out in the terms and conditions.