Legal

Privacy Policy.

What happens to your data when you write to us through the form, e‑mail, or start working with us. Written for the person who actually wants to understand, not as a labyrinth of paragraphs.

Effective May 13, 2026 Version 1.0 Controller Cordinel, s.r.o. · ID 245 33 025

In case of any discrepancy between the Czech and English version, the Czech version prevails.

Who Is the Controller
What Data We Process
Purposes and Legal Bases
Recipients of the Data
Transfers Outside the EU
Retention Period
Your Rights
Cookies and Similar Technologies
Marketing Communications
Data Security
Changes to the Policy
Contact and Complaints

I. Who Is the Controller

1.1The controller of personal data is Cordinel, s.r.o., ID No. 245 33 025, with its registered office at Varnsdorfská 334/11, Střížkov, 190 00 Prague 9, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 442860 (the Controller or we).

1.2The Controller has not appointed a Data Protection Officer (DPO). This is not an obligation under Article 37 GDPR for our type and scale of activity.

1.3Contact for any data protection questions: info@cordinel.cz.

1.4This Policy covers processing of personal data of visitors of the cordinel.cz website, prospects (contact form, e‑mail enquiries) and clients. Processing of data of our clients' clients (e.g. data of a law firm's clients) is governed by a separate Data Processing Agreement (DPA) we conclude with the client.

II. What Data We Process

2.1From the contact form. When you send us a question or request an initial consultation, we process:

(a)first name and surname,
(b)e‑mail address,
(c)phone number (optional),
(d)type of your practice (lawyer, tax advisor etc.),
(e)the content of your message and notes.

2.2From e‑mail correspondence. If you write to us directly by e‑mail, we process the data you provide — typically your name, e‑mail address, employer, job position and the content of the conversation.

2.3From the business relationship (clients). For clients with whom we conclude a contract, we additionally process billing data (Company ID, VAT ID, address, bank account), contact persons, their job positions, and data necessary to perform the contract (e.g. meeting notes, e‑mail threads).

2.4Technical data (server logs). During a visit to the website, our hosting provider briefly records standard technical data — IP address, browser type, time of access, requested URL. This serves operational and security purposes.

2.5What we do not process. The website does not use analytics tools like Google Analytics, Plausible or similar. We do not have advertising pixels (Meta, LinkedIn Insight Tag, TikTok). We do not pass non-essential data to third parties.

III. Purposes and Legal Bases

3.1Responding to your enquiry. When you write to us via the form or e‑mail, we process the data in order to answer your question and prepare an offer. Legal basis: steps prior to entering into a contract under Article 6(1)(b) GDPR.

3.2Performance of the contract with a client. For clients we process data in order to deliver services, invoicing and ongoing communication. Legal basis: performance of a contract under Article 6(1)(b) GDPR.

3.3Compliance with legal obligations. Some data we are required to retain by law — in particular accounting documents under Act No. 563/1991 Coll. on accounting (10 years), and tax documents under Act No. 235/2004 Coll. on VAT (10 years). Legal basis: legal obligation under Article 6(1)(c) GDPR.

3.4Commercial communications to existing clients. If you become our client, we may occasionally send you commercial communications about our similar services (e.g. a new training session on Claude for Word). Legal basis: legitimate interest under Article 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Coll. You can opt out at any time (see Article IX).

3.5Website operation and security. We process server logs to ensure security, detect attacks and resolve technical issues. Legal basis: legitimate interest under Article 6(1)(f) GDPR.

3.6Protection of legal claims. To a limited extent, we process data to establish or defend against legal claims. Legal basis: legitimate interest.

No consent required. None of the above purposes requires your consent. If we introduce processing based on consent in the future (e.g. a public newsletter, analytics cookies), we will request it separately and update this Policy.

IV. Recipients of the Data

4.1We share personal data only to the extent necessary for processing, with the following categories of recipients and processors:

(a)Form service provider: Formspree, Inc. (USA) — operation of the contact form on the website. Form submissions reach our mailbox via the Formspree infrastructure.
(b)E‑mail mailbox provider: Seznam.cz, a.s. (Czech Republic) — operation of the info@cordinel.cz mailbox.
(c)Website hosting provider: a reputable hosting provider in the EU (specific provider will be added after deployment); processes only server logs, not communication content.
(d)Font provider: Google Ireland Limited (EU) — Google Fonts service for loading fonts on the website. When you visit the site, your browser connects to Google's servers, which may briefly record the IP address.
(e)Public authorities: only where required by law (e.g. tax authority, court, law enforcement).

4.2We do not sell personal data and do not pass them to third parties for their marketing purposes.

4.3If you would like an up-to-date list of processors including names, please write to info@cordinel.cz.

V. Transfers Outside the EU

5.1We process your personal data primarily in the European Union. The only regular transfer outside the EU concerns the Formspree service (USA), which handles contact form submissions.

5.2This transfer takes place on the basis of:

(a)Standard Contractual Clauses of the EU Commission under Article 46(2) GDPR, and/or
(b)the adequacy decision of the EU Commission for the USA (EU-US Data Privacy Framework), where Formspree is certified.

5.3If we decide to limit this transfer (e.g. by migrating to a European form service provider), we will update this Policy.

VI. Retention Period

6.1We retain personal data only for as long as necessary:

(a)Non-binding enquiries (form, e‑mail enquiry that did not result in a contract): up to 12 months from the last communication.
(b)Client data from the business relationship: for the duration of the contract and a further 4 years after its termination, for the protection of legal claims (limitation period under Section 629 of the Civil Code).
(c)Accounting and tax documents: 10 years from the end of the accounting period under Section 31 of the Accounting Act, resp. Section 35 of the VAT Act.
(d)Server logs: up to 30 days, unless a longer period is necessary to investigate a security incident.
(e)Records of consents given/withdrawn and objections (e.g. unsubscribe from commercial communications): for as long as necessary to demonstrate compliance with GDPR, typically 5 years.

6.2After the retention period expires, we securely delete or anonymise the data.

VII. Your Rights

7.1In relation to your personal data, GDPR grants you the following rights:

(a)Right of access (Article 15) — confirmation that we process your data and a copy thereof.
(b)Right to rectification (Article 16) — correction of inaccurate or incomplete data.
(c)Right to erasure (Article 17, "right to be forgotten") — where we no longer have a legal ground to process the data.
(d)Right to restriction of processing (Article 18) — in defined cases.
(e)Right to data portability (Article 20) — where data is processed based on consent or a contract by automated means.
(f)Right to object (Article 21) to processing based on legitimate interest, including the right to refuse commercial communications at any time.
(g)Right not to be subject to automated decision-making (Article 22) — we do not carry out any such decision-making.

7.2You can exercise the rights by e‑mail at info@cordinel.cz. We will respond within 30 days; in more complex cases the period may be extended by another 2 months, of which we will notify you.

7.3If we consider a request to be unfounded or excessive (e.g. repeated requests with identical content), we may refuse it or charge a reasonable fee — always with reasons.

7.4To verify your identity we may request additional information. The aim is to avoid passing data to the wrong person.

VIII. Cookies and Similar Technologies

8.1The cordinel.cz website does not use analytics or marketing cookies. We have no cookie banner because there is no reason for one.

8.2During a visit, only the following may appear in your browser:

(a)Technical files necessary for the operation of the site — if the hosting provider uses them for load balancing or security. These cookies do not require consent under Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications.
(b)Third-party requests for loading fonts from Google Fonts. These requests generally do not transmit cookies, however Google may briefly see the IP address as part of the HTTP request (see Article IV).

8.3If we deploy analytics or other non-essential cookies in the future, we will add a cookie banner with accept/reject options and update this Policy.

IX. Marketing Communications

9.1We never send unsolicited marketing. To people who contact us via the form or e‑mail, we do not send any marketing e‑mails unless they subscribe themselves.

9.2To existing clients we may occasionally send commercial communications about our similar services (new training, new tool features, relevant practical tips). We rely on Section 7(3) of Act No. 480/2004 Coll., on certain information society services.

9.3Unsubscribe. You can unsubscribe at any time:

(a)by clicking the Unsubscribe link in the footer of any commercial communication,
(b)by e‑mail to info@cordinel.cz with a request to unsubscribe.

9.4After unsubscribing we will no longer send you commercial communications. However, you may continue to receive operational messages (invoicing, organisational matters for ongoing cooperation) — these are not commercial communications.

X. Data Security

10.1We adopt appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or misuse. In particular:

(a)Encryption in transit (TLS 1.2 and above) on all public interfaces.
(b)Strong passwords and two-factor authentication for tools where it makes sense.
(c)Principle of least access — access to data only for those who need it for their work.
(d)Regular review of processors — we only select reputable providers with appropriate safeguards.
(e)Confidentiality — all team members and collaborators are bound by confidentiality obligations.

10.2Incident. If a personal data breach occurs with risk to your rights and freedoms, we will notify the affected persons and the Office for Personal Data Protection without undue delay, no later than within 72 hours (Articles 33 and 34 GDPR).

10.3A detailed description of technical measures for client implementation projects (in particular for law firms) is available on the Security page.

XI. Changes to the Policy

11.1We may amend this Policy if the way we process personal data, our tools, or relevant legal regulations change.

11.2The updated version will be published on this page with a new effective date. If the change is material (e.g. a new purpose of processing, a new processor outside the EU), we will notify clients and affected recipients of commercial communications by e‑mail.

11.3The current version is always the binding one, not the version you may have seen in the past. We recommend checking back occasionally.

XII. Contact and Complaints

12.1For any question about the processing of personal data, exercising your rights, a DPA request or any other matter, please contact info@cordinel.cz.

12.2If you disagree with the way we process your data or with our response to a request, you have the right to lodge a complaint with the supervisory authority — the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, web uoou.cz/en.

12.3Before lodging a complaint, we prefer that you contact us directly — most matters can be resolved faster and to your satisfaction.

Controller identification: Cordinel, s.r.o., ID No. 245 33 025, with its registered office at Varnsdorfská 334/11, Střížkov, 190 00 Prague 9, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 442860, contact: info@cordinel.cz.

Something about your data you'd like to know?

GDPR is good at one thing and bad at another — bad at being readable. If you want to know how something specifically works at Cordinel, or exercise any right, write to us. We respond quickly and without template phrases.

Get in touch

Privacy Policy.

Contents

Something about your data you'd like to know?