Privacy Policy

1. Data controller

The data controller is Bonderio s.r.o., Company ID 06854699, registered office at Jičínská 226/17, Žižkov, 130 00 Prague 3, Czech Republic (the “controller”).

For matters of personal data protection, contact us at marek.krivan@dancingcode.cz. We have not appointed a data protection officer, as the law does not require us to.

2. What data we process

Depending on how you use the Service, we process:

• the email address you enter to have the report sent or unlocked;
• the address (URL) of the checked website and the audit results for it;
• technical access data – IP address, browser type, time and request identifier – from logs and for security;
• data related to payment for paid services (but not the payment card number, which is processed solely by the payment gateway);
• data from cookies to the extent described in the Cookie Policy.

We deliberately do not process sensitive (special category) personal data.

3. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases:

• providing the Service and sending the report – performance of a contract, or steps prior to entering into it;
• handling and administering a paid order and subscription – performance of a contract;
• operating, securing and improving the Service and protection against misuse – legitimate interest;
• sending tips and commercial communications – consent, or legitimate interest for our own similar services, always with the option to unsubscribe;
• compliance with legal obligations, such as accounting and tax – legal obligation.

4. Cookies

On the website we use necessary cookies for the operation of the Service and, where applicable, analytics cookies based on your consent. Details and management options are in the Cookie Policy.

5. Recipients and processors

We do not sell personal data. We share it only with providers who operate the Service for us as processors, bound by confidentiality and a processing agreement, in particular:

• the payment gateway provider (Stripe) to process payments;
• the server infrastructure and hosting provider;
• the email delivery service provider;
• Google (PageSpeed Insights, Safe Browsing) to the extent necessary to run the check.

We may also disclose data to public authorities where required by law.

6. Transfers abroad

Some of our processors (for example Stripe or Google) may process personal data outside the European Economic Area, in particular in the United States.

In such cases, the transfer is secured by appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses, or on the basis of an adequacy decision (the EU–US Data Privacy Framework).

7. Retention period

We keep personal data only for as long as necessary to fulfil the purpose:

• audit results and the related email – for as long as needed to provide the Service and thereafter for a reasonable period, unless you request earlier deletion;
• data from accounting and tax documents – for the period set by law (usually 10 years);
• technical logs – short term, on the order of months, for security and operations.

After the period elapses, we delete or anonymise the data.

8. Your rights

In connection with the processing you have the right:

• to access your data and to a copy of it;
• to rectification of inaccurate data and completion of incomplete data;
• to erasure (the “right to be forgotten”) and to restriction of processing;
• to data portability;
• to object to processing based on legitimate interest and to direct marketing;
• to withdraw consent at any time, without affecting the lawfulness of earlier processing.

Exercise your rights at marek.krivan@dancingcode.cz. You also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

9. Rights of California residents (CCPA)

If you are a California resident, you have the right under the CCPA/CPRA to information about the categories of data processed, to their deletion, and to have your personal data not sold or shared.

We do not sell your personal data or share it for cross-context behavioural advertising within the meaning of that law. You can exercise these rights at marek.krivan@dancingcode.cz; you will not be discriminated against for doing so.

10. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, in particular encrypted transmission, access control and minimisation of stored data.

When checking a website we process only publicly available information; we do not download or store the contents of third-party databases beyond what is necessary to compile the report.

11. Changes to this policy and contact

We may update this policy, in particular when the Service or the law changes. The current wording is always on the website with a stated effective date.

For questions about personal data protection, contact us at marek.krivan@dancingcode.cz.