Privacy policy

This privacy policy is effective as of 4 August 2026.

1. Data controller

The controller of personal data processed through the website https://xctech.cz(the "website") is:

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing. We have not appointed a data protection officer as we are not required to do so. For any privacy matters, contact us at the e-mail address above.

2. What data we process, why and for how long

2.1 Inquiry and contact forms

When you submit an inquiry through a form on the website, we process the data you fill in: name, e-mail, optionally phone number, your message, an optional attachment (e.g. a photo of a fault) and the page the form was sent from.

• Purpose: handling your inquiry, follow-up communication and preparing a quote.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in follow-up business communication (Art. 6(1)(f) GDPR).
• Retention: 3 years from the last communication (our chosen period). If a contract is concluded, related records are kept for the periods required by law (accounting and tax regulations in particular).

2.2 Newsletter

If you subscribe to our newsletter, we process your e-mail address.

• Purpose: sending XC tech s.r.o. news and commercial communications.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Retention: until you withdraw your consent (our chosen period). You can unsubscribe at any time, most easily by e-mailing obchod@xctech.cz.

2.3 Server logs

When you visit the website, the server automatically records operational data: IP address, date and time of the request, the URL visited and the browser identification (user agent).

• Purpose: operating and securing the website, protection against attacks and diagnosing technical issues.
• Legal basis: our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR).
• Retention: as a rule no longer than 6 months (our chosen period), after which logs are deleted or anonymised.

2.4 Cookies

The website currently stores only technical cookies necessary for its operation (e.g. a short-lived token unlocking the calculation tools). Under Section 89(3) of Czech Act No. 127/2005 Coll., on electronic communications, these may be stored without consent. Analytics or marketing cookies would only be deployed with your prior opt-in consent. See the Cookie policy (EU) for details.

3. Recipients of personal data

We primarily process personal data ourselves. To the extent necessary, our processors may access it: the server infrastructure (hosting) provider and the e-mail delivery provider. We have data processing agreements in place with our processors. We do not sell personal data or share it with other third parties, except where disclosure is required by law.

4. Transfers to third countries

We do not transfer personal data outside the European Union or the European Economic Area.

5. Automated decision-making and profiling

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

6. Your rights

In relation to the processing of your personal data, you have the following rights:

• right of access to personal data (Art. 15 GDPR),
• right to rectification of inaccurate data (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on legitimate interest (Art. 21 GDPR),
• right to withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before it.

You can exercise your rights by e-mailing obchod@xctech.cz. We respond to requests without undue delay, at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

7. Security

We have adopted appropriate technical and organisational measures to protect personal data, in particular encrypted data transfer (HTTPS), restricted access to the data and storage on servers within the EU.

8. Changes to this policy

We may update this policy from time to time, for example when new website features are deployed. The current version is always available on this page.