This notice explains how we process personal data relating to website visitors, prospective clients, newsletter subscribers, job applicants, and contacts at our clients and business partners.
1. Who controls your personal data
The controller is MIND 4 FLOW s.r.o., Company Identification No. (IČO) 17743923, VAT ID CZ17743923, with its registered office at Školská 689/20, Nové Město, 110 00 Praha 1, Czech Republic. The company is registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 375234.
For privacy questions or to exercise your rights, email info@mind4flow.cz or call +420 777 751 454. These details are also our contact point for privacy matters.
2. What we process, why, and for how long
| Context and data | Purpose and legal basis | Retention |
|---|---|---|
| Enquiries and correspondence: your name, email address, optional telephone number, company, message, and subsequent correspondence. If you allow analytics, this also includes the visit source, campaign parameters, landing page, and referring page. | Responding to you and discussing a potential engagement: steps taken at your request before entering into a contract under Article 6(1)(b) GDPR; for general correspondence, our legitimate interest under Article 6(1)(f). | A website enquiry is retained for up to 12 months after submission. Subsequent correspondence is retained for up to 12 months after our last contact if no engagement follows. If we enter into a contract, relevant data becomes part of the client record. |
| Clients and partners: identity, contact, contractual, billing and payment details, records of services and correspondence. | Performance of a contract, compliance with accounting and tax obligations, and our legitimate interest in establishing, exercising or defending legal claims. | For the duration of the engagement and generally 3 years afterwards for legal claims; accounting and tax documents for 5 to 10 years as required by applicable law. |
| Newsletter: email address and correspondence documenting your subscription request or withdrawal. | Sending updates on the basis of your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by emailing info@mind4flow.cz. | Until you withdraw consent. Correspondence documenting your request may be retained for up to 3 years afterwards so that we can demonstrate compliance. |
| Recruitment: your name, contact details, role applied for, CV, cover letter and application correspondence. | Steps taken before potentially entering into an employment contract and our legitimate interest in conducting the selection process. | For the recruitment process and up to 6 months after it ends. We would ask for separate consent before retaining your details in a candidate pool for longer. |
| Website operation: IP address, request date and time, page address, browser and device information, and security logs. | Keeping the website secure and reliable on the basis of our legitimate interest under Article 6(1)(f) GDPR. | Operational logs are generally retained for no more than 30 days, unless needed for a specific security incident or legal claim. |
| Google Analytics 4: online identifiers, pages viewed, events, approximate location, and browser and device details. Google discards the full IP address after deriving approximate location data and does not log or store it. | Measuring traffic and improving the website, solely with your consent under Article 6(1)(a) GDPR. The analytics script is not loaded unless you consent. | Consent for up to 12 months, analytics cookies for up to 12 months, and user-level and event-level Analytics data for up to 14 months, depending on the Analytics property setting. |
See our Cookie Notice for details of browser storage and analytics technologies.
3. Sources and required information
We obtain most personal data directly from you, from our correspondence, and from your use of the website. For business contacts, we may also use information from public registers, professional networks, or your employer's website.
Providing data for an enquiry, newsletter subscription, or job application is voluntary. We cannot process your request without the information marked as required. Refusing analytics cookies does not restrict access to the website or our services.
4. Recipients and processors
Depending on the context, personal data may be processed by:
- Vercel Inc., which provides website hosting, content delivery, and operational security services;
- Neon, LLC, which provides the database infrastructure used to store enquiries;
- Google Ireland Limited and other Google group companies for business email, enquiry management in Google Sheets and, only with consent, Google Analytics;
- our accounting, tax, legal, and IT advisers where necessary;
- public authorities where disclosure is required by law.
We do not sell personal data. LinkedIn, Instagram, and WhatsApp links lead to services operated by separate controllers; your browser sends data to them only after you open the relevant link.
5. Transfers outside the European Economic Area
Some technology providers operate in the United States or use global infrastructure. Transfers outside the EEA rely, as applicable, on the European Commission's adequacy decision for organisations certified under the EU–US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses together with supplementary safeguards. You may request information about the safeguards by contacting us.
6. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.
7. Your rights
Subject to the conditions in the GDPR, you may:
- request access to your personal data and obtain a copy;
- have inaccurate data corrected or incomplete data completed;
- request erasure or restriction of processing;
- object to processing based on legitimate interests;
- receive portable data where processing is automated and based on consent or a contract;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
We will respond without undue delay, normally within one month, and may take reasonable steps to verify your identity. You may also lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, or with your local supervisory authority.
8. Security and changes to this notice
We use appropriate technical and organisational safeguards, including encrypted transmission, access controls, administrator authentication, and regular updates. We may revise this notice when our services or legal requirements change. The current version and its effective date will always be published on this page.