ALTAGORA / DATA AND PRIVACY

Your data.
Clear information.

What this website stores, why it needs it and how to exercise your rights.

Updated:

Altagora Company s.r.o. is the controller of personal data from this company website and its enquiry form. This notice does not cover Finapp accounts or financial records, which have separate privacy information in the app. We do not link enquiries to those records.

What we collect

  • When you submit an enquiry, we receive your name, email, project type, estimated budget, intended start, description and choice of whether we should call you. Company and attachments are optional. A phone number is required only if you request a call. We use this choice and your number to handle this enquiry. Without a call request, we reply by email.
  • You can attach up to 3 files in PDF, PNG, JPEG, WEBP or TXT format, each no larger than 5 MiB and no more than 15 MiB in total. We store the file contents and information needed to display and download them, such as their names, types and sizes. Include only material needed to assess the project.
  • We add the language, receipt time, enquiry identifier and reference, status, a hash of the submitted content and the privacy notice version.
  • We need the required fields to receive and assess the enquiry. You can indicate that the budget is undecided. Providing data is not a statutory duty, but the form cannot be submitted without its required fields. You can contact us by email instead.

We do not save the draft text in browser storage or send it to the server as you type. Selected files are transferred when you submit the enquiry. A downloadable copy of the brief is created in your browser. After confirmation, the current tab history keeps only the enquiry reference and your call preference, without contact details or the brief.

Why we use your data

  • Assessing your project and taking steps you request before entering a contract: GDPR Article 6(1)(b), when you would be a party to that contract.
  • Communicating with a contact person representing another company: our legitimate interest in discussing a business enquiry, Article 6(1)(f).
  • Protecting the form and website against abuse: our legitimate interest in a secure, available website, Article 6(1)(f).
  • Optional measurement of visits and website use: your consent, GDPR Article 6(1)(a). Recording your choice and withdrawal also allows us to demonstrate and respect consent under Article 7.
  • Operational totals of received enquiries: our legitimate interest in evaluating the service, Article 6(1)(f), where this activity involves personal data.

Submitting sends a no-obligation enquiry; it does not place an order or create a payment obligation. The required acknowledgment confirms that you have read this notice. It is neither marketing consent nor the legal basis for handling your enquiry. Submitting does not subscribe you to marketing. We do not use data for automated decision-making, including profiling, that has legal or similarly significant effects on you. Spam checks can temporarily reject submissions; you can then contact us by email.

Our own statistics and your choice

Statistics are off by default. On a first visit, we offer a choice: refuse, allow or choose individual categories. Closing the initial notice leaves both categories off and remembers that choice for 180 days. Statistics settings in the footer or on this page let you change it at any time. Only after consent do we measure page views, clicks toward contact and form starts. The server creates a random browser identifier after you agree. We do not create or store it beforehand. The website and enquiry form work without consent.

We store the identifier’s hash, domain, consent time and version, expiry and any withdrawal. The consent version also records any explicit choice made with Do Not Track enabled. For page views, we store the day, page, language and identifier hash. We do not identify visitors by IP address or browser fingerprint, store URL query parameters or referring pages, or link statistics to enquiries.

Unique visitors means consenting browser identifiers, not people. Another browser or device, clearing storage or granting new consent can create another identifier. Identifiers are not shared between altagora.cz and altagora.net; visiting both can count you twice. Script blockers and automated visits can also affect the figures.

You can withdraw consent at any time in statistics settings. Sending stops immediately. When the server receives the withdrawal, it revokes the identifier and deletes linked page-view records. If the connection fails, the browser temporarily keeps a token only to retry the deletion request. The consent and withdrawal record remains until its original expiry; totals without identifiers remain for their stated period. Withdrawal does not affect the lawfulness of earlier processing.

Do Not Track keeps statistics off unless you make a new, explicit choice for that category on this website while it is enabled. We save that specific choice with your consent; a general earlier allowance is not enough. We do not change browser settings. Under this website’s policy, Global Privacy Control keeps both optional categories off and withdraws earlier consent. The server separately keeps daily operational enquiry counts without a visitor identifier; it does not increase these counts for an enquiry with Do Not Track or Global Privacy Control. Declining statistics does not prevent an enquiry from being received.

Google Analytics — a separate choice

We use Google Analytics 4 to understand page visits only with your separate consent under GDPR Article 6(1)(a). Consent to Altagora’s own statistics does not enable it. It is off by default; you can choose it in statistics settings. The first-visit notice lets you refuse, allow or choose individual categories. Closing it does not grant permission. Until you consent, the Google tag does not load and this integration sends nothing to Google.

Once enabled, Google receives browser and session identifiers, the page visited, language and technical device and browser information. We send the page address without query parameters or fragments, and no referring page, form contents, contact details, attachments or enquiry reference. Google also receives the IP address through the network connection. Google states that EU visitors’ IP addresses are used to derive approximate location and are then not stored.

We disable Google Signals and advertising personalisation in this integration. We do not link identifiers across altagora.cz, altagora.net and Finapp. Google Analytics counts only visits with this consent and can differ from our own statistics.

You can withdraw consent at any time in the same settings. We stop further measurement and remove this integration’s cookies from the current website. With Do Not Track enabled, a new explicit site choice for Google Analytics is required. Global Privacy Control always disables it under this website’s policy. Withdrawal or clearing cookies does not automatically erase data already sent to Google; email us to request deletion. Withdrawal does not affect the lawfulness of earlier processing.

How long we keep data

We remove enquiries and their attachments older than 180 days from receipt from the active database and file storage during the next automatic cleanup. You can request earlier deletion by email; we assess requests under the GDPR.

The identifier and consent record for our own statistics expire 90 days after consent; visits do not extend this period. Linked page views are deleted on withdrawal or during cleanup after identifier expiry, and are subject to a 90-day retention threshold at most. A revoked consent record is removed during cleanup after its original expiry.

We remove daily aggregate statistics on our server older than 365 days from the day they describe during the next automatic cleanup.

To limit spam, we use SHA-256 to hash the IP address together with the current hourly period. The record includes this hash, an attempt count and the period end. Once that hourly period ends, it no longer limits new attempts and is removed during the next cleanup. We do not store the raw IP address in this database. We do not treat the hash as guaranteed to be anonymous.

Automatic cleanup runs when the server service starts and every hour thereafter. It removes data in bounded batches. A backlog, service outage or storage error can extend these periods until later successful cleanup.

These periods do not cover separate email correspondence, later contractual records or providers’ backups and technical logs. Their retention follows the relevant purpose, configuration and service terms.

Google Analytics is set to retain both event and user data for 2 months. Resetting retention on new activity is off. Google deletes the affected data in a monthly cycle; this setting does not apply to standard aggregate reports. Retention periods for our own server statistics do not apply to Google Analytics. Expiry of consent or a cookie does not itself erase history at Google.

Cookies and browser storage

We do not use advertising cookies. Our own statistics use local storage only with your consent; your chosen language and a record of refusal are separate preferences.

Google Analytics has separate consent and its own analytics cookies, described below.

Your chosen language
Manually switching language saves your choice on this device for 180 days. A later switch renews that period. The language and expiry date are stored in localStorage under altagora.language; the current tab also uses sessionStorage. Expired persistent choices are removed on your next visit.
Our own statistics choice — altagora.analytics
localStorage holds your choice, notice version and expiry, plus a random identifier for 90 days after consent and any explicit choice made with Do Not Track enabled (observedDnt). Refusal is remembered for 180 days without a visitor identifier. Measurement after expiry requires fresh consent.
Withdrawing our own statistics and removing records
Use statistics settings so your withdrawal also reaches the server. If it is unavailable, a token is temporarily kept only to retry deletion. A fallback record in sessionStorage, under altagora.analytics.withdrawal, preserves withdrawal across page navigation if persistent storage fails. It is removed after the server confirms deletion. Clearing browser data alone does not send a deletion request to the server; its records then follow the retention periods above.
How to clear it
Clear this website’s data in your browser settings. Browser storage is under your control and is not shared between different domains. Language links still work when storage is blocked.
Google Analytics choice — altagora.googleAnalytics
localStorage holds your permission or refusal, notice version, measurement ID and expiry; a grant also records its time and any explicit choice made with Do Not Track enabled (observedDnt). Consent lasts a fixed 90 days from the time you grant it; visits do not renew it. Refusal is kept for 180 days. If storage fails, altagora.googleAnalytics.withdrawal in sessionStorage preserves refusal. This choice is separate from altagora.analytics.
Google Analytics cookies — altagora_ga and altagora_ga_<id>
After consent, these distinguish browsers and sessions. They apply only to the current website hostname, not its subdomains. They expire no later than the 90-day consent; automatic renewal is disabled. We remove them on withdrawal. They are not shared with Finapp or between altagora.cz and altagora.net.

Without a saved choice, the entry page may select a language from your browser settings and time zone. This selection happens in your browser; we do not request your location.

Where data is stored and who can access it

We run the website and server service on Altagora’s own server. Enquiries, our own statistics and their consent records are stored in a separate PostgreSQL database; attachments are kept in private file storage on that server. The public gateway to the website runs in Oracle Cloud.

Authorised company administrators can access data according to their role. Attachments are not public and downloads require authorisation. This administration does not provide access to Finapp financial records.

Hosting and infrastructure providers may process IP addresses and other technical information, and maintain operational logs, to operate and secure their services under their terms and the applicable configuration. Not storing a raw IP address in our database does not mean the network infrastructure never processes it.

Oracle’s terms also describe international processing of technical data and safeguards for it. This notice does not guarantee that all infrastructure processing stays in Czechia or the EEA. You can request information about the specific location and applicable transfer safeguards at our contact email.

Company email uses Seznam.cz Email Profi, which processes messages under that service’s terms. When an enquiry is received, we email our team its reference, receipt time, service type, language and callback preference. Contact details, the brief and attachments are not copied into the notification; the team accesses them after signing in to the administration panel. Deleting an enquiry in the panel does not automatically delete delivered emails; we manage their retention separately. The form does not send you an automatic confirmation email.

Google Analytics is provided by Google Ireland Limited. Data is sent to Google and may be processed outside the EEA, including in the United States. We do not guarantee processing only in Czechia or the EU. Google’s terms govern transfers and the relevant safeguards, including standard contractual clauses where applicable. You can request information and a copy of applicable safeguards at our contact email.

Your rights and contact

You can request access and correction, and erasure or restriction where GDPR conditions apply. You can object to processing based on legitimate interests on grounds relating to your particular situation. Data portability is available where its legal conditions are met.

Email the address below and explain your request; including the enquiry reference helps. If we have reasonable doubts, we may take proportionate steps to verify your identity. We will inform you of action taken without undue delay and within one month. Complex or numerous requests may require up to two additional months; we will explain any extension within the first month.

You can complain to the Czech Office for Personal Data Protection or another competent supervisory authority, particularly where you habitually live, work or believe an infringement occurred.

company@altagora.net

Czech Office for Personal Data Protection (ÚOOÚ)

Go to contact