Privacy Policy

Under the name Krutý Studio, three separately self-employed people work together. Krutý Studio is not a legal entity in its own right and cannot be a data controller – the controllers are the following self-employed individuals registered in the Czech trade register:

Contact e-mail for all data protection questions: info@kruty.studio

Our role differs depending on the type of processing:

• Website operation and traffic measurement – the sole controller is Pavel Navrátil, who operates the domain, hosting and the Google Analytics account (sections 2.4 and 2.5 of this policy).
• Inquiries and communication received at info@kruty.studio or by phone – we act as joint controllers under Art. 26 GDPR, because all three of us have access to the shared inbox and decide together how to proceed (section 2.1).
• A specific project once assigned – once we agree who will lead a project, that person becomes the sole controller for the contract, project-related communication, invoicing and bookkeeping, and invoices under their own business ID (sections 2.2 and 2.3).

We have not appointed a data protection officer – we are not required to. For any questions regarding personal data, please contact us directly at the address above.

1.1 Substance of the joint-controller arrangement

To the extent we act as joint controllers, we have agreed on the following:

• We receive inquiries and questions in a shared mailbox that all three of us can access. We decide together, based on the nature of the project and our capacity, who takes it on.
• We jointly fulfil our information duty towards you through this policy. Pavel Navrátil is responsible for publishing and updating it.
• Pavel Navrátil is responsible for securing the shared mailbox, managing access, and deleting data once the retention period has expired.
• The single point of contact for exercising your rights is info@kruty.studio. You may also exercise your rights against any one of us, and against each of us in full; we will then handle the request jointly.
• Regardless of this internal division, we are jointly and severally liable to you for processing carried out under joint controllership.

2.1 Communication and inquiries (e-mail, phone)

We do not have a contact form on the website. If you e-mail or call us, however, we process the data you provide to us. At this stage we act as joint controllers – all three of us have access to the shared inbox info@kruty.studio.

Providing your data is voluntary, but without contact details we cannot reply to you.

If an inquiry turns into a project, one of us takes it on and from that point processes your data as a sole controller – see section 2.2. This assignment is a normal part of our collaboration and does not constitute a disclosure of data to a third party outside the group of controllers listed in section 1.

2.2 Concluding and performing the contract

A project is always led and invoiced by one specific one of us under their own business ID. That person is the sole controller for the processing described below and is named in the proposal, the contract, and the invoice.

2.3 Accounting and tax records

2.4 Website operation and security

2.5 Traffic analytics

You can withdraw your consent at any time – see section 6.3.

2.6 Advertising and measuring its effectiveness (Google Ads)

We advertise through Google Ads, a service of Google Ireland Limited. For this we use the Google tag on the website, which allows us to measure conversions and show you our advertising on Google's websites and services even after you leave our site (remarketing).

Google's role. For conversion measurement, Google acts for us as a processor under the Google Ads data processing terms. At the same time, Google also processes some data for its own purposes – in particular to improve its advertising services and to measure performance across websites – and to that extent acts as a separate, or joint, controller. Details are available in Google's Privacy Policy and in information on how Google uses data from partner sites.

Data may be transferred outside the EU/EEA – see section 4.

Opting out of personalised advertising. Besides withdrawing consent in our cookie settings, you can turn off ad personalisation directly with Google in your ad settings or through the tools at youronlinechoices.com.

2.7 Commercial communications

We may send our own clients commercial communications about similar services on the basis of a legitimate interest (Section 7(3) of Act No. 480/2004 Coll.). You can unsubscribe at any time via the link in every message or by e-mailing info@kruty.studio. We send commercial communications to anyone else only on the basis of consent.

We do not sell personal data to anyone. We share it only to the extent necessary with the following recipients:

We each use the invoicing services Fakturoid and iDoklad separately – the specific system depends on which of us is leading and invoicing the project. For billing data, the processor is therefore always only the provider used by the relevant controller under section 2.2.

We have data processing agreements with our processors under Art. 28 GDPR.

Some of our suppliers (VEDOS, Seznam.cz, RAYNET, Fakturoid, Seyfor) are based in the Czech Republic and process data within the EU. Outside the European Economic Area, in particular in the USA, data may be transferred in connection with the services of Vercel Inc. (website hosting) and Google (analytics and advertising). In such cases the transfer is safeguarded by one of the mechanisms under Chapter V GDPR:

• an adequacy decision of the European Commission – for companies certified under the EU-U.S. Data Privacy Framework (this includes, among others, Google LLC and Vercel Inc.), or
• standard contractual clauses approved by the European Commission, supplemented with additional technical and organisational measures.

We will provide you with a copy of the safeguards used upon request.

Where we get your data from. Exclusively from you – from e-mails, phone calls, contracts, and your activity on the website. We do not buy data or obtain it from public databases, except for verifying the billing details of businesses in the Commercial and Trade Register and the VAT payer register.

Automated decision-making and profiling. We do not carry out any automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

Security. We have implemented appropriate technical and organisational measures to protect data – including encrypted data transmission (HTTPS), a limited circle of people with access to the data, access protected by strong passwords and two-factor authentication, and regular updates of the systems we use.

Cookies are small files stored in your browser when you visit the website. We use them to ensure the website's basic functions and – only with your consent – to measure traffic.

6.1 Categories of cookies we use

Necessary cookies – the website would not work without them. Under Section 89(3) of the Act on Electronic Communications, your consent is not required for these, because they serve exclusively to provide a service you have explicitly requested.

We distinguish the site's language version (Czech / English) by the page address, not by a cookie. We do not store any other necessary cookie.

Analytics cookies – stored only with your consent.

Marketing cookies – stored only with your consent.

6.2 How consent works

We activate analytics (and, where applicable, marketing) cookies only once you give consent in the cookie banner. Declining must be just as easy as consenting – the "Reject All" button is on the same level as "Accept All". Consent is not a condition of accessing the website's content.

6.3 How to change or withdraw consent

Click Cookie settings in the website footer at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can also manage or delete cookies directly in your browser settings. Please note that blocking necessary cookies may break the website's functionality.

6.4 Google Analytics

We measure traffic using Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google processes data for us as a processor under the Google Ads data processing terms. IP addresses in GA4 are processed only temporarily and are not stored. Data may be transferred to the USA – see section 4.

You can prevent measurement by withdrawing consent in the cookie settings or by installing the Google browser add-on.

In connection with the processing of your personal data, you have the following rights:

• Right of access – you may request confirmation of whether we process your data and a copy of that data.
• Right to rectification – we will correct inaccurate data and complete incomplete data.
• Right to erasure – we will delete data in the cases set out in Art. 17 GDPR. We cannot do so where retention is required by law (e.g. tax records).
• Right to restriction of processing – e.g. while we verify the accuracy of data.
• Right to data portability – for data processed on the basis of consent or a contract in an automated way, we will provide it to you in a machine-readable format.
• Right to object – to processing based on legitimate interest (sections 2.1, 2.2, 2.4 and, where applicable, 2.7). You can object to processing for direct marketing purposes at any time, and we will stop such processing without further ado.
• Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz

You can exercise your rights by e-mailing info@kruty.studio – the single point of contact for all three controllers listed in section 1. To the extent we act as joint controllers, you may exercise your rights against any one of us in full. If your request concerns a project that has already been assigned, it will be handled by whichever of us is leading that project; we will forward the request to them.

We will respond within one month at the latest; in complex cases we may extend this by a further two months, of which we will notify you. We may ask you for additional information to verify your identity, so that we do not disclose data to the wrong person.

We may update this policy, for example when deploying new tools or when the law changes. The current version is always available on this page with its effective date shown. We will inform you of any substantial changes in an appropriate manner.