Legal

Privacy Policy

This page explains what data krisisnew.xyz processes, why, how long I keep it and what you can do about it. Version 0.2 (draft), effective from 7 September 2026. This is a courtesy translation; in case of any discrepancy the Czech version prevails.

Who processes the data

The controller is Kristian Koutek, company ID (IČO) 21802441, registered office Sibiřská 134, 460 10 Liberec, Czech Republic. Contact: security [at] krisisnew.xyz.

What I process and why

Inquiries from the contact form — name, e-mail, message text. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR); for general questions, a legitimate interest in handling the communication (point (f)). Retention: 2 years from the last communication.

User account — e-mail, password (only its hash is stored), time of registration, active login sessions. Legal basis: performance of a contract (point (b)). Retention: for as long as the account exists; a deleted account is removed within 30 days, except for data I have to keep because of orders (see below).

Orders and payments — name, e-mail, purchased product, price, date, payment identifier and, for memberships, the subscription status. Legal basis: performance of a contract (point (b)) and the legal obligation to keep tax records (point (c)). Retention: 10 years from the end of the year in which the payment was made.

Newsletter — e-mail address, time and IP address of the double opt-in confirmation. Legal basis: consent (point (a)), which you withdraw via the link in every e-mail. Retention: until withdrawal. I keep the record of giving and withdrawing consent (e-mail, time, IP) for a further 3 years after withdrawal as proof that I did not write to you without consent (legitimate interest, point (f)).

Server operational logs — IP address, user agent, requested URL, time; on the mail server additionally the sender and recipient addresses and the result of the anti-spam check. No message content. Legal basis: legitimate interest in security and operation (point (f)). Retention: 90 days.

Backups — all the data above is in backups that rotate; daily backups are kept for 7 days, weekly ones for 4 weeks. I restore them only after a failure, so deleted data may survive in a backup for at most 4 more weeks.

I have the data only from you. I do no automated decision-making or profiling.

Cookies and analytics

The site contains no tracking script: no in-browser analytics, no ad tracking, no heatmaps, no session recording.

I use only strictly necessary cookies, which do not require consent:

Operational statistics (request counts, country, browser type) are produced only in aggregate at the Cloudflare network-protection layer, without visitor identifiers. That is why there is no cookie banner — there is nothing to consent to.

Who has access to the data

The data is stored on a server in the EU. Processors and other recipients:

• vpsFree.cz z.s. (Czech Republic) — server hosting.
• Own mail server in the EU — sending transactional e-mails and the newsletter.
• Cloudflare, Inc. (USA) — network protection and CDN; it sees the IP address and request metadata. Transfers outside the EU are covered by Standard Contractual Clauses and the Data Privacy Framework.
• Stripe Payments Europe, Ltd. (Ireland) — card payment processing. It is an independent controller; card details are seen only by the gateway and never reach me.

I have a contract under Art. 28 GDPR with every processor.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Write to security [at] krisisnew.xyz; I reply within one month at the latest. You may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

Changes

When the policy changes I update the date at the top; I notify registered users of material changes by e-mail.

Draft — will be reviewed by a lawyer before launch.