Privacy policy

Full text

Who processes the data

The controller of your personal data is me, Tomáš Ross, Company ID (IČO) 87884020, a sole trader registered in the Czech Republic and not registered for VAT. You can reach me at tomas@ross-automation.cz.

I have not appointed a data protection officer, because I do not meet the statutory conditions for having to.

What data I process and why

Contact form and email

When you write to me through the form on this website or by email, I process the data you send me: your name (optional), an email address or phone number, and the text of your message. The address of the page you sent the form from is stored along with the message, so that I know what brought you to the enquiry.

Purpose: to reply to you and possibly agree on working together.
Legal basis: steps taken at your request prior to entering into a contract under Article 6(1)(b) GDPR; for general questions, my legitimate interest in replying under point (f).
Retention: for the duration of our correspondence and as a rule no longer than 24 months from the last contact. If a contract is concluded, the retention period follows tax and accounting legislation.

Running the website

The website runs on Cloudflare infrastructure, which processes the technical data needed to deliver the page and to protect it against attacks, including your IP address. I also use the IP address to limit how many times the form can be submitted from one address. The legal basis is my legitimate interest in running the website securely and reliably.

Cloudflare may store a technical cookie in your browser that is necessary to tell a human from an automated client and to protect the site. It does not serve advertising or tracking, and the protection would not work without it, so consent does not apply to it.

Protecting the form against abuse

The contact form may be protected by Cloudflare Turnstile, which distinguishes a human from an automated client. To do so it evaluates technical signals from the browser and the IP address; it does not track you across websites and does not use advertising identifiers. The legal basis is my legitimate interest in the form not being usable for bulk sending.

Cookies and analytics

The website uses no advertising or marketing cookies and does not track you across websites. I do not use Google Analytics. Cloudflare Web Analytics may be enabled for basic traffic statistics. It measures without cookies, stores no identifier in your browser and builds no profile of you across websites, so the obligation to obtain consent does not apply to it.

Who receives the data

I do not sell your data and do not pass it on for marketing purposes. For technical processing I use these suppliers:

Cloudflare (hosting and delivery of the website, traffic protection, traffic statistics)
Resend (delivery of the form message to my mailbox)
Google Workspace (the mailbox where the correspondence ends up)
n8n (my automation system, in which the enquiry is recorded and prepared for handling; it runs on a server operated by a third party in the Czech Republic)
Anthropic (the language model that helps me assess the enquiry, described below)

Assessing the enquiry

I record the enquiry in my own system automatically and add publicly available information about the company to it, typically from the Czech commercial and trade registers, so that I know who I am dealing with. The system assigns the enquiry an order in which I will handle it. The decision on whether to offer to work together is always mine, never the system's. The legal basis is my legitimate interest under Article 6(1)(f) GDPR.

A language model from Anthropic helps me with the assessment. I send it the text of your message and the company data from the public register. If you later reply to my questionnaire about how your operation works, I send it that reply as well, so that I can extract the figures from it. I do not send it your name, email address, phone number, or the company ID of a sole trader: those are removed from the text before sending and replaced with placeholders. Anthropic does not train its models on this data and processes it in the United States.

Some of these suppliers are established outside the European Union. In that case the transfer relies on the European Commission's standard contractual clauses, or on another safeguard under Chapter V of the GDPR.

Your rights

In relation to your personal data you have the right:

of access to the data and to a copy of it,
to have inaccurate data corrected,
to erasure, where there is no longer a reason for the processing,
to restriction of processing,
to data portability,
to object to processing based on legitimate interest.

Just write to tomas@ross-automation.cz. I will reply within one month at the latest. If you believe I am processing your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection, or with the supervisory authority in the EU member state where you live.

Security

Data transfer on this website is encrypted (HTTPS). My access to the systems is protected by two-factor authentication. I am the only person with access to the messages from the form.

Client data during a project

When I build an automation or a website for you, I may come into contact with data that you process. In that case I act as a processor and we conclude a data processing agreement under Article 28 GDPR. The scope of access is always agreed in advance and I keep it to what the work requires.

Changes

I may amend this policy when the way I process data changes. The current version is always at this address, with the date it was last updated.

Language versions

This is an English translation of the Czech privacy policy. In the event of any discrepancy between the two versions, the Czech version prevails.