Privacy Policy

Last updated: 15 October 2026

This policy explains how personal data is processed when you use websites, apps and services operated by Petr Chlíbek, trading as itnetic.com (the "Services"). It applies under the EU General Data Protection Regulation (GDPR).

1. Controller

Petr Chlíbek, trading as itnetic.com, a sole trader registered in the Czech Republic. Business ID (IČO): 21210756. Not a VAT payer (neplátce DPH). Registered address as listed in the public ARES register. Contact for all privacy matters: chlibekp@gmail.com.

2. Data I may process

• Account data: email, username, password hash, profile details you provide.
• Content you submit: messages, files, form entries, settings.
• Technical data: IP address, device/browser type, timestamps, request logs, error and security logs.
• Usage data: basic, aggregated usage statistics.
• Communications: messages you send me, e.g. support emails.
• Payment data (only if a Service takes payments): payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and affiliates), which acts as an independent controller for payment and fraud-prevention data under its own privacy policy. I receive transaction status, not full card details.

Which data a specific Service collects depends on what it does; I collect only what is needed for it.

3. Why and on what legal basis

• Provide and operate the Services, including accounts — contract (Art. 6(1)(b)).
• Security, abuse prevention, blocking violators, debugging — legitimate interests (Art. 6(1)(f)).
• Legal and tax obligations — legal obligation (Art. 6(1)(c)).
• Optional features, non-essential cookies, newsletters — consent (Art. 6(1)(a)), withdrawable any time.

4. Hosting and location

Services are hosted on Railway (Railway Corporation) using infrastructure in the EU region. Railway acts as my processor. Because Railway is a US-based company, limited remote access or support-related transfers outside the EEA may occur; these rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Static assets may be served via Cloudflare, which acts as a processor and may process IP addresses for delivery and security. Payments are handled by Stripe (see section 2).

5. Sharing

I do not sell personal data. I share it only with processors needed to run the Services (hosting, CDN, email delivery, payments, error monitoring), with authorities when legally required, or to protect rights and security. Processors act on my instructions under data processing agreements.

6. Retention

• Account data: while your account exists, then deleted within a reasonable period after closure.
• Server and security logs: typically up to 90 days.
• Block/abuse records (e.g. blocked IPs or accounts): kept as long as needed to keep the block effective.
• Records required by law (e.g. invoices): as legally required.

7. Blocking and automated decisions

I may block accounts, IP addresses or devices to protect the Services (see the Terms). This may use simple automated rules, such as rate limits, but no decision with legal or similarly significant effect on you is made solely by automated means without a way to contact me for human review.

8. Cookies and local storage

Services use only what is strictly necessary (e.g. session, security, preferences) unless a Service states otherwise and asks for your consent first.

9. Your rights

You have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent. Email me to exercise them; I will respond within one month. You may complain to the Czech supervisory authority, the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz), or to the authority in your country of residence.

10. Security

I use reasonable technical and organisational measures (TLS, access control, hashed passwords). No system is perfectly secure. Where required, I will notify authorities and affected users of breaches.

11. Children

Services are not directed at children under 16. If you believe a child provided data, contact me and I will delete it.

12. Changes

I may update this policy; the date above shows the latest version.