Who is responsible for your data

The controller is Mgr. Martin Ševčík, Hlinky 277/29, 603 00 Brno, Czech Republic, Identification No. 06860583, email martin@sevcikmarketing.com.

I handle privacy matters myself. I have not appointed a data protection officer because my activities do not meet the conditions in Article 37 of the GDPR that would require one.

When you contact me

If you send a message or book a call, I will usually receive your name, email address, possibly your telephone number, and whatever you include in the message.

Where your message concerns possible work, I use the information to deal with your enquiry and prepare an agreement. The legal basis is Article 6(1)(b) of the GDPR: steps taken at your request before entering into a contract.

For other correspondence, I rely on my legitimate interest in ordinary business communication under Article 6(1)(f) of the GDPR.

If we do not work together, I delete the messages and contact details within three months of our last exchange. I may keep only the information needed for longer if a dispute or the protection of legal rights requires it, and only until that matter is closed.

You provide contact details voluntarily, but without them I cannot reply or prepare a proposal.

When we work together

During the work, I process the Client’s identification, contact and billing details. I also work with briefs, agreements, analyses, reports, working documents and related correspondence.

I use this information:

• to prepare and provide the services you order
• to communicate with the Client
• to issue and keep business records and invoices
• to meet accounting and tax obligations
• to deal with any claims arising from the Agreement

For performance of the Agreement, I rely on Article 6(1)(b) of the GDPR. I process accounting and tax records under Article 6(1)(c), because the law requires me to keep them. I may retain material needed to establish, exercise or defend legal claims on the basis of my legitimate interests under Article 6(1)(f).

I keep working documents for the duration of the work and afterwards for as long as they may reasonably be needed to finish it or deal with claims under the Agreement. Depending on the type of record, Czech accounting and tax law generally requires records to be kept for five or ten years from the end of the relevant accounting or tax period. VAT records subject to the statutory ten‑year period are kept for ten years.

Data I may access while working for a Client

When I work in a Client’s CRM, analytics, advertising accounts or other systems, I may have access to personal data relating to its customers, employees or business partners.

In those cases, I do not normally decide why the data is processed. I act as the Client’s processor and follow its documented instructions. The Client remains the controller and is responsible for providing the required privacy information to the people concerned.

The Agreement or a data processing agreement under Article 28 of the GDPR sets out the scope of that processing. As processor, I may use the data only on the controller’s instructions.

Newsletter

If you subscribe to the newsletter, I process your email address and any other information you choose to enter in the form.

I send the newsletter with your consent under Article 6(1)(a) of the GDPR and in accordance with Czech Act No. 480/2004 Coll., on Certain Information Society Services.

You can withdraw your consent at any time by using the unsubscribe link in any issue or emailing martin@sevcikmarketing.com. Withdrawal does not affect processing that was lawful before it.

I use Brevo SAS to manage the mailing list and send the newsletter. Brevo acts as a processor and states that the databases used for this service are hosted on servers in the European Union.

Once you unsubscribe, I will not send you further newsletters. Your address may remain on a suppression list so that the system does not add it back by mistake. I may also keep evidence of consent or withdrawal for as long as reasonably needed to demonstrate compliance with the law.

Unless you renew your consent, I remove your address from the active mailing list no later than four years after you subscribe.

Visiting the website and cookies

When you visit the website, the server and essential technical tools may record your IP address, the date and time of the request, the page requested, browser type and basic device information.

I use this information to secure the website, diagnose technical problems and prevent misuse. The legal basis is my legitimate interest under Article 6(1)(f) of the GDPR. Technical logs are kept only for as long as needed to identify and resolve a fault or security incident.

The website may store essential cookies without consent where they are needed to transmit data or provide a service you expressly request. This exception is set out in Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications.

Analytics and advertising cookies are activated only with your consent. The legal basis for the subsequent processing of personal data is Article 6(1)(a) of the GDPR.

The Cookies page lists the cookies in use, their purpose, duration and recipients. You can also change or withdraw your consent there.

Who may receive the data

I use the following suppliers to run the website and provide my services:

• Hetzner Online GmbH hosts the website in the European Union.
• Seznam.cz, a.s. provides my mailbox through its Profi email service.
• Brevo SAS manages subscriber addresses and sends the newsletter.
• Providers of AI tools I use for analysis, drafting and automation, in particular Google Ireland Limited (Gemini), Anthropic PBC (Claude) and OpenAI Ireland Limited. I enter personal data into them only where necessary, where the client has agreed, and with settings that exclude the use of inputs for model training.
• Analytics and advertising providers receive data only to the extent permitted by your cookie settings.

Depending on your choices, these providers may include Google, Meta, Microsoft, LinkedIn, TikTok, Reddit, X (formerly Twitter) and OpenAI. The Cookies page lists the tools actually in use.

I may also disclose information to an accountant, tax adviser, lawyer or public authority where necessary to meet a legal obligation or protect my legal rights.

I do not sell personal data.

Transfers outside the European Economic Area

Some analytics, advertising and AI providers may also process data outside the European Economic Area, particularly in the United States.

Where a US recipient holds a valid certification under the EU–US Data Privacy Framework, the transfer may rely on the European Commission’s adequacy decision. The Framework covers only organisations with a current certification.

In other cases, the provider must use another lawful transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with any additional safeguards required.

The Cookies page gives more information about individual providers and safeguards. You may also ask me for the relevant details.

Your rights

Depending on the circumstances, you may ask me to:

• confirm whether I process your personal data
• give you access to the data and a copy of it
• correct inaccurate data
• delete data
• restrict processing
• provide portable data for transfer to another controller
• stop processing based on legitimate interests where your right to object applies
• withdraw consent you have given

Not every right applies in every situation. For example, I cannot delete information that the law requires me to keep.

Send requests to martin@sevcikmarketing.com. I will respond without undue delay, normally within one month. If I have reasonable doubts about the requester’s identity, I may ask for the information needed to verify it. The Czech Data Protection Authority also explains data subject rights and the basic request procedure.

If you believe that I am processing personal data unlawfully, you may complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz. You also retain the right to seek a judicial remedy.

Automated decision‑making

I do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects for you.

Main legislation

My processing is governed in particular by:

• Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR)
• Czech Act No. 110/2019 Coll., on the Processing of Personal Data
• Czech Act No. 127/2005 Coll., on Electronic Communications
• Czech Act No. 480/2004 Coll., on Certain Information Society Services
• applicable Czech accounting and tax legislation