Privacy Policy
This policy informs data subjects about the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), and pursuant to Act No. 110/2019 Coll., on personal data processing (Czech Republic).
1. Controller
The controller of personal data is David Cina, company identification number 05728177, with registered address at Polívkova 814/6, 779 00 Olomouc, a natural person carrying on business and registered in the Czech Trade Licensing Register (the “Controller”).
Contact address for all matters concerning personal data protection: hello@lindacinova.com.
The Controller has not appointed a data protection officer, as no such obligation arises under Article 37 GDPR.
2. Categories of data, purposes and legal bases
| Category of data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Identification and contact data of a business from public sources — trade name, premises address, telephone number, website, public rating, social media profile link | Assessing whether to offer services and contacting with an offer | Legitimate interest of the Controller in promoting its own business under Article 6(1)(f) GDPR | 24 months from last contact |
| Contact email address | Sending an offer, communication regarding enquiries and performance | Legitimate interest under Article 6(1)(f) GDPR; upon conclusion of a contract, performance of the contract under Article 6(1)(b) GDPR | 24 months from last contact; for clients, for the duration of the contractual relationship |
| Photographs and other visual material provided by the client | Production of an audiovisual work according to the client's brief | Performance of the contract under Article 6(1)(b) GDPR | Duration of the contractual relationship and 12 months thereafter |
| Email address used to sign in to the client area | Passwordless user authentication (sign-in link) | Performance of the contract under Article 6(1)(b) GDPR | Duration of the contractual relationship |
| Payment data — customer and subscription identifiers, history of issued documents. The Controller does not process payment card data. | Subscription administration, invoicing, accounting and compliance with tax obligations | Performance of the contract under Article 6(1)(b) GDPR and compliance with a legal obligation under Article 6(1)(c) GDPR | For the period required by tax and accounting legislation, not exceeding 10 years from the end of the tax period in which the document was issued |
| Data from interactions on Instagram — username and the content of a public comment or a message sent to the Controller | Handling and responding to the enquiry; recording expressed interest in the service | Legitimate interest under Article 6(1)(f) GDPR | 24 months |
Provision of data is neither a statutory nor a contractual requirement; however, the service cannot be provided without the data set out in rows 3 to 5.
3. Sources of personal data
The Controller obtains personal data (i) directly from the data subject, (ii) from publicly available sources, in particular the Google Maps service and the website of the business concerned, and (iii) from the Instagram platform interface, to the extent of interactions directed at the Controller's profiles.
4. Processors and other recipients
The Controller engages the processors listed below, to the extent necessary for the given purpose and on the basis of agreements pursuant to Article 28 GDPR:
| Processor | Subject of processing | Location |
|---|---|---|
| Cloudflare, Inc. | Website operation, database, and storage of image and video files | EU, USA |
| Stripe, Inc. | Payment transaction processing and subscription administration | EU, USA |
| Google LLC | Provision of public business data (Places API) | USA |
| Meta Platforms, Inc. | Content publishing, reach statistics, message transmission on Instagram | USA |
| ElevenLabs, Inc. | Speech synthesis and background music | USA |
| Higgsfield AI, Inc. | Automated processing of provided photographs into image sequences | USA |
Photographs provided by the client are transferred to the processor Higgsfield AI, Inc. for the purpose of automated processing into image sequences. The work cannot be produced without this transfer. The Controller does not transfer visual material to any other recipients and does not make it available to third parties for their own purposes.
Personal data may further be disclosed to public authorities where the Controller is obliged to do so by law.
5. Transfers to third countries
Processing by the processors listed in Article 4 involves the transfer of personal data to the United States of America. Such transfers are carried out on the basis of a European Commission adequacy decision pursuant to Article 45 GDPR where one applies to the recipient concerned, and otherwise on the basis of standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR. A copy of the safeguards applied will be provided by the Controller upon request.
6. Automated processing and profiling
In respect of the data referred to in Article 2, row 1, the Controller carries out automated evaluation (a numerical score) which determines the order in which businesses are approached with an offer. This processing has no legal effect on the data subject and does not otherwise significantly affect them within the meaning of Article 22(1) GDPR; it does not constitute a decision based solely on automated processing.
7. Cookies
The Controller's website stores a single cookie, namely a strictly necessary session cookie set upon sign-in to the client area and serving to maintain the session. Its storage does not require consent under Section 89(3) of Act No. 127/2005 Coll., on electronic communications.
The Controller does not use analytics, marketing or other tracking cookies and does not deploy third-party audience measurement tools.
8. Rights of the data subject
The data subject has the right:
- of access to personal data under Article 15 GDPR,
- to rectification of inaccurate data under Article 16 GDPR,
- to erasure under Article 17 GDPR,
- to restriction of processing under Article 18 GDPR,
- to data portability under Article 20 GDPR,
- to object to processing based on legitimate interest under Article 21 GDPR, including processing for direct marketing purposes.
Where the data subject objects to processing for direct marketing purposes, the Controller shall cease such processing without further action and remove the personal data from its records.
Requests are to be submitted to hello@lindacinova.com. The Controller shall respond without undue delay and no later than one month from receipt; this period may be extended by two months in the cases set out in Article 12(3) GDPR, of which the data subject will be informed. No fee is charged.
9. Right to lodge a complaint
The data subject has the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. The supervisory authority in the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.
10. Amendments
The Controller is entitled to amend this policy unilaterally, in particular in response to changes in legislation or in the scope of processing. The current version is always available at this address; the effective date is stated in the heading.