Privacy Policy
This document explains how we handle personal data. It is written to describe the actual operation of the service, not a general template.
1. Who is responsible for processing
Bc. Xinchi Jiang, independent contractor (OSVČ), ID: 21591202, Jindř. Lukeše 244, 273 08 Pchery, Czech Republic.
Contact for any questions regarding personal data: partner@recenzik.cz
We do not have an appointed Data Protection Officer; the service is operated by one person. If you write to us, the provider answers you directly.
2. In two different roles
It is important to distinguish two situations:
a) We are the controller. For data whose processing we decide ourselves: service prospects, business communication, contracts, invoices, and the operation of this website.
b) We are the processor. For personal data contained in the reviews and materials of our client, which we process according to their instructions and for their purpose. The client is then the controller. The terms are described in the Data Processing Agreement.
The rest of this document applies to situations where we are the controller.
3. Visiting this website
The website is static and informative.
- We do not use any analytical tools or tracking codes.
- We do not use cookies for tracking. The website does not store any identifier in your browser for analytics or advertising purposes.
- We have no advertising or remarketing scripts.
During normal website operation, the hosting provider processes technical data created during each connection (IP address, time, browser type). This serves to deliver the page and protect against attacks. Details about providers can be found in the Subprocessors document.
Fonts used on the website are part of the web bundle and load directly from our hosting. Because of fonts, the visitor does not connect to a third-party service.
4. When you contact us or order the service
What data: first and last name of the contact person, email, phone (if you give it to us), company name, ID and registered office, content of our communication, the wording of the offer and your consent, billing data, and payment history.
Why:
| Purpose | Legal Basis |
|---|---|
| Negotiation of a contract and its performance | Performance of a contract, or steps prior to entering into a contract — Art. 6(1)(b) GDPR |
| Issuance and record-keeping of tax documents | Compliance with a legal obligation — Art. 6(1)(c) GDPR |
| Proof that you accepted the offer | Our legitimate interest in proving the content of the agreement — Art. 6(1)(f) GDPR |
| Defense or exercise of legal claims | Our legitimate interest — Art. 6(1)(f) GDPR |
If the contact person is a client's employee who is not a party to the contract themselves, we process their professional contact data based on our legitimate interest in conducting standard business communication.
At the beginning of our cooperation, we may ask you to fill out an onboarding form (Google Forms in our Google Workspace account). We process the contact data from it according to this article. The materials for replies, such as style and verified facts about the premises, are processed for you as a processor according to the Data Processing Agreement.
How long:
- unsuccessful inquiry that did not result in a contract: 90 days from the last substantive message,
- contractual and business communication: for the duration of the service and 3 years thereafter (general limitation period),
- tax documents and accounting records: for the period specified by tax and accounting regulations.
5. Business outreach
We approach potential clients by phone. We obtain data about businesses for this from publicly available sources and from a commercial dataset we previously acquired from a supplier (see Subprocessors).
What data: name and address of the premises, field, website, publicly listed phone and email, public profile rating. For self-employed individuals (OSVČ), this data may also be personal data.
Legal basis: our legitimate interest in offering our service to entrepreneurs for whom it is relevant — Art. 6(1)(f) GDPR.
How long: a maximum of 12 months from the last contact, unless the outreach results in a business relationship or if you ask us for earlier deletion.
Preparation of a sample. In order to show what a reply to a specific review might look like, we transfer the text of a public review, its rating, possible author designation, and premises data to the technical text processing provider, whom we list in the Subprocessors document. The result is always reviewed by a member of the Recenzík team. We do not publish it anywhere — it serves only as a sample in the offer.
The following always applies:
- If you say you do not wish to be contacted, we will note it down and will not contact you again. For this purpose, we must retain a minimal record to honor the explicit objection.
- We send commercial communications by email only where permitted by Section 7 of Act No. 480/2004 Coll., and always with the option to unsubscribe.
- We do not use data obtained within a client's order to reach out to other companies.
6. Who we transfer data to
We do not sell data and do not transfer it for third-party marketing.
Access to it may be granted to technical service providers and processors whom we necessarily use for operation — technical text processing, email inbox and onboarding forms, website hosting, optionally an accountant. The complete and current list is in a separate document [Subprocessors](/subdodavatele), including which specific data is transferred to whom and the situation regarding transfers outside the EU.
We further transfer data if the law requires us to do so or if it is necessary to exercise legal claims.
7. Your rights
You have the right to:
- access your data and obtain a copy,
- rectification of inaccurate data,
- erasure, if there is no reason for processing,
- restriction of processing,
- portability of data processed on the basis of a contract,
- object to processing based on a legitimate interest — especially against business outreach. If you object to outreach, we will always stop contacting you.
Just write to partner@recenzik.cz. We will reply within one month at the latest. To ensure we do not release data to the wrong person, we may verify who we are dealing with.
You also have the right to file a complaint with the supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
8. Security
We process data on our own devices and through approved suppliers. Only the provider has access to our accounts and systems; no other staff operates the service, and neither clients nor third parties have their own access to our systems.
We keep only what we need for the order, and upon its conclusion, we remove the materials according to the periods specified above.
We do not require or store passwords to clients' Google accounts or other access credentials to their systems.
We exchange materials with each other by email, or via the onboarding form. Email is not a fully secure channel; please do not send us passwords, payment data, or sensitive personal data via email or the form. We do not need them.
9. Automated decision-making
We do not perform automated decision-making or profiling that would have legal or similarly significant effects for you.
Every text that leaves us undergoes human review.
10. Changes
We may update this document. We always list the version number and effective date here. We will notify clients by email of any material change that affects ongoing cooperation.