Privacy Policy

1.1. The controller of your personal data is PPC ONE s.r.o., Company ID 05931631, with its registered office at Korunní 2569/108, 101 00 Prague 10, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 272749. In the rest of this text, we refer to ourselves as "we".

1.2. You can contact us about personal data protection in three ways: through our contact form, by replying to our work communication, or by post to the address of our registered office. To exercise your rights, you do not have to order a service or give us details about a project that have nothing to do with your request. We have not appointed a data protection officer.

1.3. This policy describes the processing in which we are the controller. It concerns visitors to our website and to our profiles on Facebook, Instagram and LinkedIn, prospective clients for our services, job applicants, contact persons of our clients and suppliers, and people featured in our client testimonials.

1.4. This policy does not cover personal data that we process on behalf of our clients, for example the data of a client's customers when we manage their campaigns. In those cases the client is the controller, and we follow the client's instructions and our contract with the client. This applies even when the client sends us the data by email, in a message, as a screenshot or as an attachment. The mere fact that such data is stored in our communication archive does not change our role.

2.1. Mandatory fields are marked in our forms; we ask for the data we need in order to deal with your request, and the rest is optional. We ask for billing details to the extent our legal obligations require. Without the contact details we need we cannot reply to an enquiry, and without the data necessary to conclude and perform a contract we may not be able to provide the service. Not giving us optional data, and refusing or withdrawing consent to analytics, advertising or the publication of a testimonial, has no effect on your ability to order and use our services.

2.2. The retention periods also apply to working copies in our communication systems and in our other systems. For copies entered into AI, the rule in part 5 applies: only for as long as the specific task requires. We overwrite the backups of our systems in a regular cycle, within 90 days at the latest, and they serve only to restore operation after a failure. When we restore a backup, we take steps to prevent data that was erased or restricted earlier from returning to ordinary use. Retention at AI providers is governed by point 5.5, not by the rules for our backups.

2.3. For client testimonials we agree in advance on the specific content, on where it will be published and on how long it will be used. Consent can be withdrawn through the contact details in part 1. We do not treat the mere publication of a review on someone else's platform as consent to republishing it, together with your personal data, on our website. Company data that does not identify an individual is not personal data; its use is governed by our agreement with the client and by the other applicable rules.

3.1. We obtain most of the data directly from you. In the case of business contacts we may obtain data from public sources (the Commercial Register, a company's website, professional networks) or from a client who named you as a contact person. Where we have a duty to inform you under Article 14 GDPR, we provide the information within one month of obtaining the data at the latest; if we communicate with you for the first time before that, we provide it in that first communication; and if we first pass the data to another recipient before that, we provide it when we do so at the latest. The mere availability of this page does not replace the provision of that information. We will tell you the specific source of your data on request.

4.1. We pass data only to those who need it for the purpose concerned.

4.2. The cookie consent bar (Cookies správně) runs in your browser. It is operated by CRS a.s., Company ID 28387741, with its registered office at Klapkova 546, Prague 8. It sends the following to cookies-spravne.cz: a visitor identifier, information that the bar was displayed, and your choice for each consent category.

4.3. Independent controllers: public authorities to the extent of our legal obligations; our legal and tax advisers; and banks when payments are made.

4.4. Depending on the nature of the work, external marketing specialists, content creators and IT support suppliers may also have access to the data they need. We limit their access to the data needed for their task and make that access conditional on a confidentiality undertaking. Where a supplier processes data on our behalf, we conclude a contract with them under Article 28 GDPR. For data that we process on behalf of a client, bringing in a further processor (a sub-processor) is also governed by the client's prior written authorisation and by the relevant data processing agreement. Part 6 applies to any transfers outside the EEA.

4.5. Data included in a published testimonial is accessible, to the extent agreed, to visitors to our website or to another publication channel we have agreed on. Public content can be indexed by search engines. Removing it from the places we manage does not in itself guarantee that every copy held by third parties is erased immediately; this is without prejudice to any further obligations under GDPR.

4.6. Social networks and statistics. When we communicate and manage content on our profiles, we are responsible for the processing that we decide on. For Facebook Page Insights and LinkedIn Page Insights, joint controllership covers the processing carried out to create page statistics, not automatically all processing across the whole platform. The essential allocation of responsibilities is set out in Meta's Page Insights Controller Addendum and LinkedIn's Page Insights Joint Controller Addendum. For statistics on our Instagram profile we follow Meta's current terms; where those terms result in joint controllership, the same applies to them as to Facebook Page Insights. The operator of the platform carries out the processing of the underlying data for the statistics and deals with related rights to the extent of the arrangement, and we provide the necessary cooperation. You can also exercise your rights with us; we will pass the relevant request on to the platform. The processing that takes place when you use Facebook and Instagram is described further in the Meta Privacy Policy, and for LinkedIn in the LinkedIn Privacy Policy. Public comments can be seen by other users; we do not publish private messages. The fact that we run a social profile does not in itself mean that we use that network's advertising pixel or any other tracking on our website.

5.1. In our work we use artificial intelligence tools: Claude and Claude Code (Anthropic) and ChatGPT and Codex (OpenAI).

5.2. Accounts and the providers' role. We use individual accounts with these services. The providers process the content we enter under their own policies, including for their own purposes, for example ensuring security and preventing misuse.

5.3. What goes into AI. Materials for our work; aggregate data on campaign performance that does not identify particular people; and selected parts of ordinary work communication with clients and suppliers. These can contain a name, work contact details and the text of a message. We limit personal data to the part that is necessary for the specific task.

5.4. Excluded inputs. We do not put the following into AI: communication from job applicants; enquiries from individuals before a contract is concluded; personal data of our clients' end customers; login and payment details; birth numbers (national identification numbers); and special categories of personal data, for example health data. This restriction also applies to automatic retrieval from our communication archive and from connected sources.

5.5. Training and retention. In our work accounts we have turned off the use of content to train models. We keep conversations that contain personal data only for as long as the specific task requires. Retention by the providers, including any longer retention for security and legal reasons, is governed by their rules: Anthropic's data retention information, Anthropic's privacy policy and OpenAI's EU privacy policy.

5.6. Legal basis and objection. Where we support our ordinary work communication, we rely on our legitimate interest under Article 6(1)(f) GDPR in preparing replies, working with materials and organising how we work together. You can object to this use under part 8.

5.7. Decisions about people. AI helps with analysis and suggestions, and a person decides. We do not use AI for decisions based solely on automated processing that produce legal effects or similarly significant effects under Article 22 GDPR.

5.8. Content created with the help of AI. We check content prepared with the help of AI before we publish it. We label its artificial origin where the law requires us to, in particular Regulation (EU) 2024/1689 (AI Act).

5.9. AI and our clients' data. The use of AI when working with data that we process on behalf of clients is governed by our contracts with them and by their instructions (see point 1.4). This is without prejudice to the restrictions in point 5.4 and to our obligations when a further processor is brought in under point 4.4.

6.1. Some recipients also process data outside the EEA, in particular in the USA. For recipients that participate in the EU-U.S. Data Privacy Framework, the transfer rests on a European Commission decision under Article 45 GDPR, to the extent of their certification. We state this for those recipients in part 4.

6.2. For the AI services listed in part 4, the European providers are companies in Ireland. The providers then also process the content outside the EEA, including in the USA, and their policies describe how they use adequacy decisions or standard contractual clauses under Article 46(2)(c) GDPR. You can ask for information about a specific safeguard through the contact details in part 1. Links to the providers' policies are in point 5.5.

6.3. If the mechanism on which a specific transfer outside the EEA rests were to cease to apply, for example the decision on the EU-U.S. Data Privacy Framework or the relevant certification, we will check for another valid safeguard and for any supplementary measures. Without them we will suspend the transfers concerned.

7.1. Cookies are short text files that a website stores in your browser.

7.2. Without consent we use only the technologies that are necessary to transmit a communication or to provide a service that you have asked for:

7.3. Our forms are protected by Cloudflare Turnstile, which evaluates technical signals in order to tell a person apart from automated traffic (the Cloudflare security cookie cf_clearance, with a lifetime of up to 365 days). We process the personal data needed for security on the basis of our legitimate interest (part 2).

7.4. With your consent we use:

7.5. You can refuse the optional analytics and advertising technologies in the first layer of the bar. You can change your choice at any time through the cookie consent bar. When you withdraw consent, we stop any further processing based on that consent. Three things need to be kept apart: the lifetime of a cookie in your browser; the retention period for data in analytics and advertising systems (part 2); and the validity of your consent (until you withdraw it or until cc_cookie expires). The legal basis is Section 89(3) of Act No. 127/2005 Coll. and Article 6(1)(a) GDPR.

7.6. With your consent we pass data about your behaviour on the website, linked to a pseudonymous identifier, to advertising systems. We currently do not use customer lists built from our own data, nor enhanced conversions with contact details. If we change this, we will update this policy and, for data that requires consent, we will ask for it in advance.

7.7. You can also delete or block cookies in your browser settings, for example by following the instructions for Chrome, Firefox, Safari on Mac, Safari on iPhone and Edge. Blocking necessary cookies can limit how the website works. To withdraw consent to our analytics and advertising technologies, use the settings in our cookie bar; simply deleting cookies does not replace changing your consent, and it can also remove the choice you have stored. For supported browsers and Google Analytics implementations you can also use the Google Analytics Opt-out Browser Add-on. This add-on does not switch off Microsoft Clarity or advertising technologies, and it does not replace consent management on our website.

8.1. You have the right of access to your data and to a copy of it (Article 15); the right to rectification (Article 16); the right to erasure (Article 17); the right to restriction of processing (Article 18); the right to the portability of the data you have given us and that we process by automated means on the basis of consent or a contract (Article 20); and the right to withdraw consent at any time, without this affecting the lawfulness of the processing carried out before the withdrawal (Article 7(3)).

8.2. Right to object. You can object to processing based on legitimate interest through the contact details in part 1. We will always comply with an objection to direct marketing. We will tell you about the measures we have taken without undue delay and within one month at the latest. For other processing based on legitimate interest, including the use of your communication in AI tools, we will not continue after an objection unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims under Article 21 GDPR.

8.3. You can lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

8.4. You exercise your rights through the contact details in part 1. We deal with requests free of charge. We can charge a reasonable fee that reflects our administrative costs, or refuse to act on a request, only where the request is manifestly unfounded or excessive. When we assess whether a request is excessive, we can also take into account the fact that it is repetitive. We have to demonstrate that these conditions are met (Article 12(5) GDPR). We will tell you how we have dealt with your request without undue delay and within one month of receiving it at the latest. Taking into account how complex the requests are and how many there are, this period can be extended by a further two months; we will tell you about the extension and the reasons for it within one month. If we do not comply with a request, we will give you the reasons within the same basic period and tell you that you can lodge a complaint and seek a judicial remedy. If we have reasonable doubts about your identity, we will ask only for the data we need to verify it.

8.5. We will notify any rectification, erasure or restriction we carry out to the recipients to whom we have disclosed the data, unless this proves impossible or would involve disproportionate effort. We will tell you about those recipients on request. We keep only the necessary record of a request and of how it was dealt with, in line with part 2.

9.1. We protect data with technical and organisational measures: encrypted transmission (HTTPS), access control, protection of the website and its forms (Cloudflare, Turnstile), backups, and internal rules for working with AI tools and with client data.

9.2. Only authorised people have access to personal data, and only to the extent they need it for their work. We bind our employees and external collaborators to confidentiality and require them to follow our rules for working with data. When our cooperation changes or ends, we adjust or remove access accordingly.

9.3. Personal data breaches. We document an incident, assess its scope and its risks, and take measures to limit its consequences. Unless it is unlikely to result in a risk to the rights and freedoms of individuals, we report it to the Office for Personal Data Protection without undue delay and, where feasible, within 72 hours of the moment we become aware of it. Where an incident is likely to result in a high risk, we inform the people concerned without undue delay, unless a statutory exemption applies; we set out in clear terms what happened, its likely consequences, the measures we have taken, what we recommend you do, and a contact point for further information. If an incident affects data that we process on behalf of a client, we inform the client without undue delay.

10.1. We update this policy in line with changes to our services, our tools and the law. The current version, with its effective date, is always on this page. Before we process data for a new purpose, we will tell you about that purpose and about the related changes in an appropriate way. If new consent is needed, we will ask for it in advance.