Privacy Policy

1. Controller

The data controller is Viktor Vítovec. Full identification, registered office and contact details appear in the operator panel on this page. No data protection officer has been appointed because the statutory conditions requiring one do not apply.

2. Data we process

• Inquiry and business contact data: name, employer or company, work email, phone, website, role, industry and the contents of communications. The website inquiry form specifically asks for your name, company, work email and message.
• Scoping data you choose to provide: systems of interest, business context, desired services and broad information about data lifetimes. Do not send credentials, private keys, secrets or unnecessary sensitive personal data.
• Technical connection data: IP address, request time, requested URL, user agent and security or delivery logs processed by the hosting and network providers when the site is accessed.
• Anti-abuse verification data: Cloudflare Turnstile processes limited browser and connection signals, such as IP address, user agent, TLS characteristics, site key and origin, and returns a verification result used to protect the inquiry form.
• Contract and billing data if an engagement proceeds, handled under the applicable contract and legal record-keeping duties.

3. Contact form behavior

When you submit the contact form, its fields and the Turnstile verification token are sent to the PQC Radar server endpoint. The server verifies the token with Cloudflare and, after successful validation, transmits your message through Resend to info@pqc-radar.com.

The application code does not write inquiries to a dedicated website database. Resend and the receiving email providers nevertheless process and may retain the message, delivery metadata and related logs under their applicable terms and retention settings.

4. Purposes and legal bases

• Responding to inquiries, preparing a proposal and taking requested pre-contract steps: Article 6(1)(b) GDPR.
• Operating, securing and improving the website; preventing abuse; and managing ordinary B2B relationships: legitimate interests under Article 6(1)(f) GDPR.
• Performing an agreement: Article 6(1)(b) GDPR.
• Accounting, tax, legal and regulatory duties: Article 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims: legitimate interests under Article 6(1)(f) GDPR.
• Marketing messages are not sent merely because you visited the site. Any electronic marketing will follow applicable consent and opt-out rules.

5. Recipients and international transfers

Personal data may be processed by service providers necessary to run the business, including Vercel for website hosting and delivery, Cloudflare Turnstile for bot and abuse prevention, Resend for contact-form email delivery, receiving email and productivity providers, and professional accounting or legal advisers. It may also be disclosed to public authorities where required by law. Data is not sold.

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful safeguard. Details of an applicable safeguard are available on request.

6. Retention

• Unsuccessful or inactive inquiries: normally deleted or anonymized within 12 months after the last substantive contact, unless needed for a legal claim or you ask us to retain the discussion.
• Engagement communications and working business records: normally retained for the engagement and up to 3 years afterward, unless a longer period is necessary for claims, security or contractual obligations.
• Accounting and tax records: retained for the periods required by Czech law, commonly 5 or 10 years depending on the record.
• Technical, Turnstile and delivery logs: kept only for the operational, security, delivery and abuse-prevention periods configured by the relevant provider.

7. Your rights

Subject to the GDPR conditions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent; withdrawal does not affect prior lawful processing. You have an unconditional right to object to direct marketing.

Send requests to viktor@vvitovec.com. We may need to verify your identity. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ) or the supervisory authority where you live or work.

8. Required data and automated decisions

Providing inquiry data is voluntary, but without enough contact and scoping information we may be unable to respond or prepare a proposal. Cloudflare Turnstile automatically assesses whether a form submission appears abusive and may allow or block that submission. This security check has no legal or similarly significant effect; if it fails, you can contact us directly by email. The website does not profile visitors for advertising.

9. Security and changes

Reasonable technical and organizational measures are used to protect personal data. No internet or email transmission is completely risk-free, so use an agreed secure channel before sharing confidential assessment material.

This notice may be updated when processing or legal requirements change. The date above identifies the current version.