Document
Privacy and cookies
Translation of the Czech document for information. If this translation differs from the Czech text, the interpretation more favourable to you applies.
Controller
CENTRUM BEZPEČNOSTI A OCHRANY s.r.o., Company ID 24958409, Kurzova 2222/16, Stodůlky, 155 00 Praha 5. Privacy contact: skillkitlab.contact@gmail.com. Data protection officer: [proposal pending decision: none appointed; Article 37(1) GDPR does not oblige us to appoint one].
What data and why
| Purpose | Data | Legal basis |
|---|---|---|
| Concluding and performing the contract, delivering the package | e-mail and other details you enter in the form (for example name and billing address, if required), order number, consent to immediate delivery, payment status, download record in SimpleShop | contract, Art. 6(1)(b) GDPR |
| Accounting and tax | invoice data | legal obligation, (c) |
| Record of consent to immediate delivery and of the documents sent | consent wording, order, date, copies of the e-mails we send you about the order (including attachments) | legitimate interest, (f): proving that the conditions for loss of the right of withdrawal and the information duties were met |
| Support and questions | e-mail, name, text of the question, attachments, download records | contract and legitimate interest, (b) and (f): answering you and proving performance of the contract in a possible dispute |
| Complaints and withdrawal from the contract | statement, order number, e-mail, bank account for the refund, way of handling; for online withdrawal also your name, the order e-mail, the e-mail for the confirmation, the date and time sent and the reference number | contract, legal obligation and legitimate interest, (b), (c) and (f) |
| Handling your GDPR requests | request, identity check, reply | legal obligation, (c) |
| Running and securing the website | IP address and technical access logs at the hosting provider | legitimate interest, (f): keeping the website available and secure |
| Receiving a bank-transfer payment | payer name, account number, variable symbol, amount | contract and legal obligation (accounting), (b) and (c) |
| Notices of necessary updates to the purchased content | e-mail from the order | contract, (b) |
Data marked as mandatory in the form is needed to conclude the contract and issue the invoice; without it the order cannot be completed. The consent to immediate supply under consumer law is not consent to the processing of personal data under the GDPR; we process data on the basis of the contract, legal obligations and our legitimate interest. If an employee or other contact person acts for a business buyer, we process their name and e-mail on the basis of our legitimate interest in concluding and performing the contract with the buyer ((f)).
We do not process card details; card payments are not active yet; once connected, you will enter your card only on the payment gateway's page. Purchase is not conditional on newsletter or marketing consent; this version runs no newsletter.
The online withdrawal form (the “Withdraw from contract” link in the footer of every page) stores your name, order number or order e-mail, the e-mail for the confirmation, the content of your statement, the date and time sent, a reference number, the form language, the document version, the status of the confirmation e-mail and a record of manual handling in Cloudflare Durable Objects storage (Cloudflare, Inc., processor) and sends the confirmation of receipt to the e-mail you enter via Cloudflare Email Service. Our support mailbox receives a copy of each submission whose automatic confirmation was sent (for at most 20 submissions a day) and, once a day, an overview of new and open submissions (reference number, date and time, name, order number or order e-mail, e-mail for the confirmation, confirmation status). A submission in which the hidden field for catching robots is filled in is stored and reviewed; a submission from a real customer is confirmed manually. A submission that exceeds one of the daily limits for automatic e-mails is stored and its receipt is confirmed manually; this does not affect the validity of the withdrawal. The prepared confirmation text for manual sending is kept only until the submission has been handled. To prevent the form from being misused to send e-mails, we keep the number of automatic confirmations sent to one address only under a hash of the address and delete it within 3 days at the latest; so that we do not record and confirm the same statement twice when it is sent again (for example after reloading the page), we keep a hash of its details for at most 2 days (legitimate interest, (f)). The form adds no IP address or browser data to the record and sets no cookies; the hosting provider may keep technical access logs as described below. The purpose is to receive and confirm the withdrawal and to document how it was handled (contract, legal obligation and legitimate interest, (b), (c) and (f)). We need the details in the form to match your withdrawal to the right order and confirm receipt; you do not have to use the form and can also withdraw by e-mail or letter. The record in the form storage is deleted automatically 1185 days after it was sent (roughly 3 years after the withdrawal was handled); copies and daily overviews in the support mailbox follow the retention period for complaints and withdrawals.
Who receives the data
- Redbit s.r.o., Company ID 24197190 – sales form, orders, invoices, sending e-mails and download links (processor).
- The GoPay payment gateway is planned; it is not connected yet and receives no data. Once connected, we will state its operator and role here.
- The payer's bank and the seller's bank – bank transfer (each as an independent controller).
- Other recipients – website hosting, the support mailbox provider, the archive mailbox provider and the accountant: [proposal pending decision: the website hosting provider Cloudflare, Inc. (processor; IP addresses and technical access logs); our support mailbox runs on Gmail provided by Google Ireland Limited under its terms – Google also processes the mailbox content for its own purposes, such as protection against spam and malware, under its privacy policy; the provider of the company archive mailbox (processor; copies of order e-mails; name to be added before launch); our accountant (processor; accounting documents; name or firm to be added before launch)]
- Cloudflare, Inc. – storage for the online withdrawal form (Durable Objects) and sending of confirmations, copies and daily overviews (Cloudflare Email Service) (processor; transfers outside the EEA see below).
Transfers outside the European Economic Area: [proposal pending decision: Cloudflare, Inc. and Google LLC (USA): based on the European Commission adequacy decision (EU–U.S. Data Privacy Framework; both companies are certified), for Cloudflare also standard contractual clauses. Redbit s.r.o. uses further processors for SimpleShop, listed in its privacy policy (https://www.simpleshop.cz/ochrana-osobnich-udaju/, section Third parties); some of them are established outside the European Economic Area (USA, Canada). Redbit states that such transfers rely on a European Commission adequacy decision or on standard contractual clauses approved by the Commission.] We will provide information on the safeguards on request.
How sales and delivery work
We do not run our own delivery server. Orders, invoices, payment e-mails and download links are handled by SimpleShop, which also records file downloads in the order history. Which technical data (such as IP addresses) it stores and for how long is governed by its operator's terms and settings. Support questions are handled from the mailbox skillkitlab.contact@gmail.com. The website has no user accounts; its only form of its own is the online withdrawal form described above; the website runs on Cloudflare Pages (Cloudflare, Inc.), whose operator may keep technical access logs according to its settings. Cloudflare also instructs your browser to report network connection errors (Network Error Logging); the browser keeps this instruction for up to 7 days and, if a connection fails or a response has an error status code, sends Cloudflare a technical report (including the page address, type of error, server IP address and status code; Cloudflare also receives your device's IP address).
How long we keep data
[proposal pending decision: We keep invoices and other accounting records for 5 years from the end of the accounting period to which they relate (Section 31 of Act No. 563/1991 Coll.); records needed for tax administration are kept until the tax assessment period expires (Section 148 of Act No. 280/2009 Coll.), if that is longer. We keep data on the order, the consent to immediate supply and the making available of the package, including copies of the e-mails we send you about the order, for 5 years after it was made available, so that we can prove delivery: a defect that appears within 2 years of making available can be claimed within the 3-year limitation period. We keep orders where the package was never made available (unpaid or cancelled) for 1 year after the due date, or after cancellation if that came first; in the case of a withdrawal for 3 years, like other withdrawals. We keep complaints, withdrawals and handled GDPR requests for 3 years after they are handled, and other enquiries for 1 year. We use the order e-mail to announce necessary updates for as long as we provide updates under Article 11 of the terms, and no longer than we keep the order data. Technical access logs are kept by the hosting provider for the period set by it (to be added once verified); we do not analyse them. The language-choice cookie lasts 1 year.]
Your rights
You have the right of access, rectification, erasure, restriction of processing and portability. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest ((f)). Send your request to skillkitlab.contact@gmail.com; we will reply without undue delay and at the latest within one month (in complex cases the period can be extended by up to two further months, and we will tell you so, with reasons, within one month). To avoid disclosing data to the wrong person, we may ask you to confirm the request from the e-mail address in your order. Requests are free of charge.
Erasure or restriction cannot be applied to data we must keep by law (accounting records) or need to establish, exercise or defend legal claims; during the retention period we use it for no other purpose. We take no automated decisions and do no profiling. You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or with the supervisory authority in the country where you live.
Security
We do not store customer data on a server of our own; it is held by the processors and providers named above. Records of the online withdrawal form are kept by its provider in our Cloudflare account (Durable Objects). The website is served over encrypted HTTPS connections. If a security breach were likely to result in a high risk to you, we would inform you as required by the GDPR.
Persons under 18 and third-party data
The package is intended for adults; a person under 18 may order only with the consent of their legal representative. We do not base processing on consent to the processing of personal data; whether a minor can validly conclude the contract is governed by civil law. If we learn that we received a child's data without authority, we will handle a legal representative's erasure request as described in the previous section.
Do not send us personal data of your clients, customers or other people (names, e-mails, screenshots with customer data); an anonymised sample is enough to solve a problem. If such data nevertheless reaches us, we will use it only to answer your question; afterwards we remove it from the attachments or make it illegible and keep only what we need to document how the question or complaint was handled.
Cookies and language choice
This website uses no analytics or advertising cookies and loads no tracking scripts. [proposal pending decision: When you switch the language (CZ/EN), we store your choice in the wg_lang cookie in your browser for one year, so that the home address opens in your chosen language. Only the chosen language is stored.] This is technical storage necessary for a function you requested, so we do not need your consent under Section 89(3) of Act No. 127/2005 Coll. The home address opens the language version according to your saved choice, otherwise according to your browser language, otherwise English; we do not use the country derived from your IP address to choose the language. Both versions are always available through the CZ/EN switch. [proposal pending decision: The order form is loaded from form.simpleshop.cz (Redbit s.r.o., our processor) only after you click Show order form. Redbit then receives your IP address and browser technical data and stores the technical cookies SID (24 hours) and _nss (until you close the browser), which the form needs to work and to protect the submission. This storage is necessary for a service you requested (Section 89(3) of Act No. 127/2005 Coll.).]
The product and your Claude account
The package contains no telemetry and its scripts do not send the content of your projects on their own; only the website-checking tools open connections, to the address you enter (usually a local server at 127.0.0.1). You use Claude in your own account; material you put into it is processed by its provider under your terms.