Version 1.0 (draft) · effective from 2026-05-07

Privacy Policy

In this document, we—VICTA DIGITAL s.r.o.—describe how we handle the personal data of visitors to our website. We take data protection seriously, so we've written this policy to be specific, readable, and compliant with the GDPR and Czech Act No. 110/2019 Coll. on the processing of personal data.

1. Website operator and data controller

The data controller within the meaning of Art. 4(7) GDPR is VICTA DIGITAL s.r.o., Company ID 28859511, registered at Haškova 1238/8, 500 02 Hradec Králové—Pražské Předměstí, Czech Republic. For any questions about personal data protection, please contact us at privacy@victaagency.com or by post at our registered office, Haškova 1238/8, 500 02 Hradec Králové, Czech Republic.

2. Purpose of processing and legal basis

For every activity in which we process personal data (contact form, newsletter, booking a consultation, analytics, lead management), the full version of this document states the specific purpose and legal basis under Art. 6(1) GDPR. We only ever process data that's necessary for that purpose.

3. Categories of data processed

Identification data (name, company, email, phone), communication data (message content), technical data (hashed IP, user agent, locale), behavioral data (only with your consent, in Google Analytics), and billing data where we have an active business relationship.

4. Recipients and processors

To run the website, we use vetted providers under a signed data processing agreement (DPA)—Vercel, Supabase, Resend, Cal.com, Cookiebot, Upstash, Sentry, Cloudflare, Google and Namecheap. For transfers outside the EU, we rely on Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework. Operational data is processed in the EU Frankfurt region.

5. Retention period

We keep data only as long as strictly necessary: contact form and bookings for 24 months, newsletter until unsubscribe, a lead in our internal database for a maximum of 36 months of inactivity, audit logs for at least 36 months, GA4 for 14 months.

6. Your rights

You have the right to access, correct, erase, restrict processing of, port, object to, and withdraw consent for your data (Art. 15–22 GDPR). You can submit a request to privacy@victaagency.com—we handle it within 30 days. You can file a complaint with the Czech Office for Personal Data Protection (uoou.cz).

7. Security

Encryption in transit (TLS 1.2+) and at rest (AES-256), IP hashing, pseudonymization, a server-side proxy for API keys, row-level security in the database, 2FA on admin accounts, rate limiting and bot defense, regular security review.

8. Cookies

Our website uses cookies for functionality, statistics (with consent) and marketing (with consent). Details are in our separate Cookie Policy document.

This is a summarized public version. We'll update the full version—with detailed tables of processors, retention periods and supervisory-authority contacts—after legal review; for the full version, contact us at privacy@victaagency.com.