Privacy policy

This privacy policy is effective as of 5 August 2026.

1. Data controller

The controller of personal data processed through the website https://xctech.cz(the "website") is:

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing. We have not appointed a data protection officer as we are not required to do so. For any privacy matters, contact us at the e-mail address above.

2. What data we process, why and for how long

2.1 Inquiry and contact forms

When you submit an inquiry through a form on the website, we process the data you fill in: name, e-mail, optionally phone number, your message, an optional attachment (e.g. a photo of a fault) and the page the form was sent from.

• Purpose: handling your inquiry, follow-up communication and preparing a quote.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in follow-up business communication (Art. 6(1)(f) GDPR).
• Retention: 3 years from the last communication (our chosen period). If a contract is concluded, related records are kept for the periods required by law (accounting and tax regulations in particular).

2.2 Newsletter

If you subscribe to our newsletter, we process your e-mail address. You confirm the subscription by clicking a link in a verification e-mail (double opt-in). We use Mailchimp to send the newsletter (see sections 3 and 4).

• Purpose: sending XC tech s.r.o. news and commercial communications.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Retention: until you withdraw your consent, at most 3 years from the last activity (our chosen period). You can unsubscribe at any time via the link in every e-mail or by e-mailing obchod@xctech.cz.

2.3 Server logs

When you visit the website, the server automatically records operational data: IP address, date and time of the request, the URL visited and the browser identification (user agent).

• Purpose: operating and securing the website, protection against attacks and diagnosing technical issues.
• Legal basis: our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR).
• Retention: as a rule no longer than 6 months (our chosen period), after which logs are deleted or anonymised.

2.4 Cookies

The website stores technical cookies necessary for its operation (e.g. a short-lived token unlocking the calculation tools, or the record of your cookie banner choice). Under Section 89(3) of Czech Act No. 127/2005 Coll., on electronic communications, these may be stored without consent. Analytics cookies (Google Analytics 4, PostHog) are deployed only with your prior opt-in consent given in the cookie banner; accepting and rejecting are equal choices and you can change your decision at any time via the "Cookie settings" link in the website footer. Without consent we measure traffic only anonymously (PostHog in cookieless mode): nothing is stored on your device and the measurement uses no persistent visitor identifier. We do not deploy marketing cookies. See the Cookie policy (EU) for details.

3. Recipients of personal data

We primarily process personal data ourselves. To the extent necessary, the following processors and recipients may access it:

• Webglobe, s.r.o. - server infrastructure (hosting) provider and the mailbox used to send form messages (EU).
• The Rocket Science Group LLC (Mailchimp), an Intuit Inc. company- newsletter delivery; processes subscribers' e-mail addresses (USA, see section 4).
• Cloudflare, Inc.- the Turnstile service protecting forms against bots; processes the visitor's IP address on form submission (USA, see section 4).
• Google Ireland Ltd. - Google Analytics 4 (only with consent to analytics cookies).
• PostHog, Inc. - EU-hosted traffic analytics (anonymous and cookieless without consent; persistent cookies only after opt-in).

We have data processing agreements in place with our processors, or the processing is governed by their standard data processing terms. We do not sell personal data; we share it with other third parties only where required by law.

4. Transfers to third countries

Most processing takes place within the European Union. Transfers to the USA occur for the following services, always with an appropriate safeguard under the GDPR:

• Mailchimp (Intuit Inc.) - certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Cloudflare, Inc. - certified under the EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses (Art. 45 and 46 GDPR).
• Google Analytics 4 - Google LLC (USA) under the EU-U.S. Data Privacy Framework, only with consent to analytics cookies (Art. 45 GDPR).

5. Automated decision-making and profiling

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

6. Your rights

In relation to the processing of your personal data, you have the following rights:

• right of access to personal data (Art. 15 GDPR),
• right to rectification of inaccurate data (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on legitimate interest (Art. 21 GDPR),
• right to withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before it.

You can exercise your rights by e-mailing obchod@xctech.cz. We respond to requests without undue delay, at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

7. Security

We have adopted appropriate technical and organisational measures to protect personal data, in particular encrypted data transfer (HTTPS), restricted access to the data and storage on servers within the EU.

8. AI-generated visual content on the website

Some of the illustrative visuals on this website (in particular video loops and background imagery in page headers) were created using generative artificial intelligence tools. This is illustrative content: it does not depict real people, specific cinema auditoriums or real events. Photographs from our installations and photographs of our team members are genuine and were not created by AI. The website does not use any AI system that interacts with visitors or makes decisions about them; the calculation tools on the website are deterministic calculators. We provide this information in the interest of transparency with reference to Regulation (EU) 2024/1689 on artificial intelligence (the AI Act).

9. Changes to this policy

We may update this policy from time to time, for example when new website features are deployed. The current version is always available on this page.