Privacy Policy

1. Who is the controller

Forum Art s.r.o., Company ID (IČO) 06772447, VAT number (DIČ) CZ06772447, registered office at Italská 1202/12, Vinohrady (Praha 2), 120 00 Praha. Phone: +420 603 889 418. E-mail: [email protected]. The company is registered in the Commercial Register kept by the Municipal Court in Prague, file number C 288619.

We process personal data under Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data. With questions or requests to exercise your rights, you can contact us using the details on the Contact page or by a letter to our registered office.

2. What data we process

• Data from the form: name, e-mail, the selected service and the message; optionally a phone number. Depending on the service, you can add the type of property, the package, the client type or the offer you are interested in. We also store the language of the form, its source label, a submission identifier and the enquiry number.
• Data about the current submission: the page path without parameters and fragment, the label of the button you used to open the form, and only the domain name of a referring third-party website (without path and parameters). We also store the device type derived from the window width and the time taken to fill in the form in seconds. This data is attached only to the enquiry that is sent. It is not continuous tracking of all visits to the website. We store UTM campaign parameters and ad click identifiers and attach them to the enquiry only with your marketing consent. Without it, we do not capture them for these purposes or use them further.
• Record of agreement with the Terms and Conditions: the version of the terms and the time the agreement was saved when the enquiry was sent. This record is not consent to the processing of personal data or a request to start the service early.
• Arranging and providing the service: the visit address, the date, the agreed scope and price, related communication and any explicit request to start the service before the withdrawal period ends.
• Invoicing and delivery of messages: billing details and payments; for the enquiry confirmation and the internal notification also the recipient of the message, the delivery status and time, the number of attempts and the technical code of any error.

We do not store the IP address, the full user-agent string or a browser fingerprint with the enquiry. The rough device type described above, on the other hand, is stored. Do not write passwords, verification codes or sensitive data in the message. You enter the login details for your accounts yourself.

3. Purposes and legal basis

• Handling the enquiry, arranging and providing the service, including confirming the enquiry by e-mail - steps taken at your request before concluding a contract and its performance (Article 6(1)(b) GDPR).
• Accounting and tax obligations - legal obligation (Article 6(1)(c) GDPR).
• Evidence of the terms and protection of legal claims - our legitimate interest in documenting the course of dealings and protecting our rights (Article 6(1)(f) GDPR).
• Contact persons of business customers - we process the contact details of persons acting for a business customer on the basis of our legitimate interest in handling the enquiry and communicating while providing the service (Article 6(1)(f) GDPR).
• Protecting the form against misuse - legitimate interest in keeping the service available and preventing unsolicited submissions (Article 6(1)(f) GDPR). We process the IP address temporarily and, to limit the number of submissions, use only a hash with a random salt in the memory of the server process for no longer than 24 hours from the submission concerned. Records are removed continuously even without further requests and disappear on restart. This hash is also personal data; we process it only briefly and only to secure the form. The application does not write the IP address or its hash to the database or logs.
• Identifying the source of the enquiry and evaluating the website from the data about the current submission - legitimate interest in evaluating where enquiries come from (Article 6(1)(f) GDPR). You can object to processing based on legitimate interest.

To reply to a form enquiry we need your name, e-mail and a description of your request; without them we cannot handle it this way. The phone number is optional unless we need it for a specifically agreed way of providing the service. We use the e-mail to confirm the enquiry and the phone to arrange a visit or remote help. If you do not want to use the form, you can call us. We do not use contact details to send advertising.

4. Retention and erasure

We keep the enquiry, its metadata, the record of agreement with the terms, delivery records and related communication for 1 year from the last contact if the enquiry did not lead to an order or contract. If the enquiry led to the provision of a service, we keep this data for 3 years from the last contact for possible legal claims, taking into account the general limitation period. If a contract was concluded, we also keep the necessary contract documents even if the service was not subsequently provided. We keep operational metadata only for as long as necessary for its specific purpose. After that we ensure erasure from the database and the mailbox. Erasure is not automatic after the form is sent; we carry it out when managing these records. Data necessary for an ongoing legal claim can be kept for as long as needed to settle it. We keep accounting and tax documents, in particular invoices, for the period required by tax and accounting regulations.

Ordinary communication does not by itself extend the retention of all older data. After the relevant period we erase the data; it may remain in backups for no longer than 6 weeks before it is overwritten in the regular backup cycle.

The hosting provider and Cloudflare may independently process the IP address, access time and other technical data in operational or security logs. This is separate from the limit on submissions in our application described above. The scope and duration of these logs are determined by the services used and their security settings; we limit retention to the necessary period.

5. Suppliers and transfers outside the EEA

Hosting, the database and mailboxes are provided by alwaysdata in France. The CDN and website security are provided by Cloudflare, Inc. (USA). The transfer to the USA is based on the European Commission's adequacy decision (EU-US Data Privacy Framework), under which Cloudflare, Inc. is certified, and additionally on the standard contractual clauses in Cloudflare's data processing agreement. We will provide a copy of the safeguards on request. Our accountant or tax adviser and persons providing technical support, bound by appropriate obligations, may also have access to the extent necessary. We do not sell personal data.

Data you enter into your AI service is processed by its provider under the terms you have with it. We access the account or screen only during permitted setup or support. Remote access requires your consent and presence; the accounts remain yours. For business support, any processing of data for the customer is arranged according to the actual scope of cooperation.

Analytics and ad measurement (only with consent)

With your consent we use Google Analytics 4 for visitor statistics (with analytics consent) and Meta Pixel to measure the effectiveness of ads (with marketing consent). In doing so we process technical data about the visit (the address of the page visited, the device and browser type, approximate location based on the IP address, cookie identifiers) and events on the website: clicks on the enquiry button or the phone number, starting to fill in the form and sending the enquiry. We do not send your name, e-mail, phone, text or enquiry number to these tools. The tools are loaded only after consent is given. We send the page address to Google Analytics without parameters, except UTM campaign parameters.

We use Google Analytics only for statistics: Google signals, user-provided data collection and data sharing with Google are switched off. For Meta Pixel we do not use automatic advanced matching, automatically detected events or the Conversions API; we measure only page views, clicks on the phone number and sent enquiries.

The legal basis is your consent (Article 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications). We keep event data in Google Analytics for 14 months.

Recipients: Google Ireland Limited (Google Analytics 4) and Meta Platforms Ireland Limited (Meta Pixel). Data may be transferred to the USA to Google LLC and Meta Platforms, Inc. on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework), under which these companies are certified, and additionally on the basis of standard contractual clauses.

If you allow marketing, the data may also be used to personalise advertising and to create advertising audiences. We are jointly responsible with Meta Platforms Ireland Limited as joint controllers (Article 26 GDPR) for collecting data on our website and transferring it to Meta; Meta carries out further processing as an independent controller under its own policies.

You can change or withdraw your consent at any time with the “Cookie settings” button in the website footer. After you withdraw consent, we stop further measurement and remove the relevant cookies and storage that we can manage from this domain. Withdrawing consent does not affect the lawfulness of earlier processing.

6. Your rights

Under the conditions of the GDPR you have the right of access to your data, rectification, erasure and restriction of processing. Portability applies to data you provided that is processed automatically on the basis of a contract or consent. Consent can be withdrawn. You can object to processing based on legitimate interest on grounds relating to your particular situation.

We handle requests without undue delay, usually within one month. If the period is extended as permitted by law, we will inform you of the reasons in good time. You can also lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, Holešovice, 170 00 Praha 7, uoou.gov.cz.

7. Automated decision-making and cookies

If you allow marketing, the data may also be used to personalise advertising and to create advertising audiences. We do not carry out automated decision-making with legal or similarly significant effects under Article 22 GDPR. The rules for cookies and similar storage are on the page Cookie Policy.