Legal

Privacy policy

Personal data processing under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 on personal data processing.

1. Data controller

The data controller within the meaning of Art. 4(7) of the GDPR is me personally:

Martin Ševr
Self-employed sole trader
Registered seat: Pod Kesnerkou 2404/46, 150 00 Praha 5, Smíchov, Czechia
Reg. no.: 87639114
Field of business: Goldsmithing and jewellery
Email: zlatnikmartin@email.cz
Phone: +420 774 598 181

I haven't appointed a Data Protection Officer. Czech law doesn't require it in my case. For all data-protection matters, contact me directly.

2. What data I process and why

2.1 Contact form, email, phone and WhatsApp

If you contact me about a custom piece, a question or a consultation, I process:

  • First and last name
  • Email address
  • Phone number (if you provide one)
  • The content of your message and any attached reference photos

Purpose: answering your enquiry, preparing a quote, arranging a consultation, coordinating the making of a piece.
Legal basis: pre-contractual negotiations (Art. 6(1)(b) GDPR), or legitimate interest in communicating with you (Art. 6(1)(f) GDPR).
Retention: for the duration of our communication and a maximum of 3 years from the last contact. If a commission is concluded, data is retained for the period required by accounting and tax law (10 years).

2.2 Accounting and tax data

If you order a piece from me, I issue an invoice. For that I process:

  • Name, surname, address
  • For businesses, the Reg. no. and VAT no.
  • Bank details (if paying by transfer)

Purpose: performance of the contract and compliance with statutory obligations (issuing invoices, archiving records).
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR: Czech Act No. 563/1991 on Accounting, Act No. 235/2004 on VAT).
Retention: 10 years from the end of the tax period under accounting and tax law.

2.3 Website analytics: Google Analytics 4

If you grant consent in the cookie banner, I use Google Analytics 4 to statistically measure traffic on this website. It helps me understand which pages interest people and improve the site.

Google Analytics processes:

  • Anonymised IP address (last octet truncated)
  • Device type, browser, operating system
  • Country / city based on IP
  • Pages visited, time on site, traffic source
  • Anonymous session identifier (cookies _ga, _ga_*)

Purpose: statistical analysis and improving the website's content.
Legal basis: your consent (Art. 6(1)(a) GDPR), granted by clicking "Agree" in the cookie banner. You can withdraw consent at any time (see section 5).
Retention: 14 months in Google Analytics, then automatically deleted.
Processor: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its parent company Google LLC (USA).
Transfer outside the EU: Google may process data in the USA. The transfer is covered by EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

2.4 Website usage analysis: PostHog

If you consent in the cookie banner, I also use PostHog. It shows me where people click, how far they read, where they leave and how fast the pages load. I use this to make the site easier to find your way around.

PostHog processes:

  • Pages visited, clicks and scroll depth
  • Device type, browser, operating system and window size
  • Approximate location (country, city) derived from your IP address
  • Page load speed and errors the page reports in your browser
  • A recording of how you move through the page (movement, scrolling and clicks); what you type into form fields is never recorded
  • A random visitor and session identifier (ph_* entries in browser storage)

PostHog does not store the IP address itself, and I do not link this data to your name or email.

Purpose: improving the website's content and usability.
Legal basis: your consent (Art. 6(1)(a) GDPR), the same as for Google Analytics. You can withdraw consent at any time (see section 5).
Retention: page recordings 90 days, other data no longer than 7 years.
Processor: PostHog Inc. (2261 Market St., #4008, San Francisco, CA 94114, USA). Data is stored in the EU (Germany). Traffic goes through the subdomain k3z.zlatnik-martin.cz, which Cloudflare operates for PostHog.
Transfer outside the EU: PostHog may exceptionally process data in the USA (support, subprocessors). The transfer is covered by EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

2.5 Anonymous visit counts without consent

Without consent, that is when you keep essential only or have not decided yet, I send PostHog only an anonymous record of a page view and of a click on the phone, WhatsApp, email, map or the site's main buttons, and of a form submission. The record contains the page address without parameters and the domain of the site you came from. It never contains what you wrote in the form.

I use no cookies or browser storage for this, I do not read properties of your device, I create no identifier or browser fingerprint and I do not link individual records together. PostHog does not store the IP address or derive a location from it. The result is only aggregate visit counts for this website. I do not combine them with other data and do not share them with anyone else. This anonymous measurement serves only visit statistics, which is why I do not ask for consent for it.

3. Cookies

Cookies are small text files that the website stores in your browser. I use only two types:

3.1 Necessary cookies (technical)

No consent required: used for basic site function and to store your cookie decision (cookie-consent-2 in localStorage). Without them, the site would ask you again on every visit.

3.2 Analytics cookies (Google Analytics and PostHog)

Only with consent. Set only after you click "Allow" in the cookie banner. If you don't consent, no analytics cookies are set (Consent Mode v2 blocks their activation) and the PostHog library is not loaded at all; only the anonymous count described in section 2.5 is sent. PostHog uses no cookies; it keeps its ph_* entries in browser storage (localStorage).

I don't use advertising cookies, retargeting, or any other marketing tracking.

4. Recipients of your data

I do not share your personal data with third parties for their own purposes. I do, however, use the following processors who help me operate:

  • Hostinger International Ltd (Cyprus): web and email hosting
  • Google Ireland Limited / Google LLC: only if you consent to analytics cookies
  • PostHog Inc. (USA, data in the EU): full analytics only with your consent to analytics cookies, without consent only the anonymous counts described in section 2.5
  • Accountant: for bookkeeping

I may share data with public authorities (tax office, courts, police) if required by law.

5. Your rights

As a data subject, you have the following rights under the GDPR:

  • Right of access (Art. 15): you can request information about what data I process and a copy of it.
  • Right to rectification (Art. 16): you have the right to correct inaccurate or complete incomplete data.
  • Right to erasure / "to be forgotten" (Art. 17): you can request that your data be deleted if it isn't needed and I have no legal basis to keep it.
  • Right to restriction (Art. 18): you can ask that I only store your data without further processing.
  • Right to data portability (Art. 20): you have the right to obtain your data in a structured, machine-readable format.
  • Right to object (Art. 21): to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7(3)): you can withdraw consent to analytics cookies at any time with the "Cookie settings" button in the site footer and choosing "Essential only". This deletes the Google Analytics and PostHog entries from your browser. Withdrawal does not affect processing that took place before withdrawal.
  • Right to lodge a complaint with a supervisory authority: Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7.

To exercise any of these rights, contact me at zlatnikmartin@email.cz. I'll reply within 30 days at the latest.

6. Data security

I protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), secure email storage, access limited to me. WhatsApp communication is end-to-end encrypted.

7. Automated decision-making

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Children

The website and my services do not deliberately process data of persons under 16. If I find that I've accidentally obtained a child's data without parental consent, I will delete it immediately.

9. Changes to this policy

I may update this policy. The current version is always available on this page. I will notify you of material changes by email if we are in active contact.

Effective: 14 October 2026