Privacy Policy
Draft for legal review
This document is a working draft. Items marked [TO COMPLETE] must be verified before publication. Effective date: [TO COMPLETE].
1. Who is responsible for your data?
The controller operating under the Gariana brand is [TO COMPLETE: full legal name, registration number and registered office]. The website presents creative, production and event services. You can contact us at martin@gariana.cz or +420 602 227 444. [TO COMPLETE: confirm that this contact also handles data protection requests; add a data protection officer’s contact if applicable].
2. What information do we process?
The enquiry forms contain a name field, a required email address and a free-text field labelled Message or Location. We process the information you choose to enter and subsequent correspondence needed to respond. The inspected forms do not contain a file-upload field. Please do not send sensitive information or third parties’ personal data unless necessary. Technical data may be processed when the website or embedded media load; the exact scope is [TO COMPLETE: verify hosting, form and media logs].
3. Purposes and legal bases
We use enquiry data to answer questions, discuss a project and prepare an offer. Where you request steps before entering into a contract as an individual, processing is based on Article 6(1)(b) GDPR. Communication with a company’s representative and other business enquiries may rely on our legitimate interest in responding and managing business relationships under Article 6(1)(f); the applicable interests and balancing assessment must be confirmed. Statutory duties, where applicable, are based on Article 6(1)(c). A privacy notice is not a request for consent to ordinary enquiry handling. Marketing or newsletter purposes require a separate assessment and notice; none is added by this document.
4. Is providing data compulsory?
Sending an enquiry is voluntary. An email address is required by the current forms so that we can reply. Without the contact information or project details necessary to answer, we may be unable to handle your request. Providing data does not itself create a contract or require you to purchase services.
5. How long do we retain information?
Data should be retained only as long as needed to handle the enquiry and any justified follow-up. If a contract follows, contractual and statutory retention requirements must be assessed separately. Information needed to establish, exercise or defend legal claims may be retained for the relevant limitation period and dispute duration. [TO COMPLETE: confirm actual deletion rules, the retention period or objectively applicable criteria for unsuccessful enquiries, email, Framer submissions and backups; identify applicable statutory periods].
6. Recipients and service providers
The website is built on Framer and the inspected enquiry forms use native Framer form elements. Framer B.V. provides the web platform; its processing role and contractual arrangements must be confirmed for the services used. Enquiries are accessible only to persons who need them for the relevant purpose. [TO COMPLETE: verify the actual submission destination and recipients, email provider, other processors, authorised staff or contractors, and relevant data processing agreements]. The displayed contact email is not proof of a form’s configured recipient.
7. Transfers outside the EU/EEA
Framer’s data processing terms provide for international transfers subject to GDPR safeguards. Embedded Vimeo media may also involve processing outside the EU/EEA. This does not establish which transfers occur for this website. [TO COMPLETE: identify the actual recipients and countries, applicable adequacy decisions or safeguards, and how a copy of the safeguards can be obtained]. Ask the controller for details using the contact above.
8. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure or restriction of processing. You may object to processing based on legitimate interests and, where applicable, receive data you provided in a portable format. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), uoou.gov.cz, or another competent supervisory authority. Requests are normally answered within one month; the GDPR permits an extension by two further months where necessary, with an explanation within the first month. We may request proportionate identity verification where justified.
9. Cookies, analytics and embedded media
The Social Media page contains embedded Vimeo videos. Loading external media can disclose technical connection information to its provider and may involve cookies or similar technologies. The inspected custom-code slots contained no scripts; this is not proof that the website uses no analytics, cookies or other external services. [TO COMPLETE: verify the published site before and after consent, all settings and embeds; list providers, purposes and cookie lifetimes; confirm any Framer analytics and consent mechanism]. Technologies that are not strictly necessary must not be enabled before consent where the law requires it. A privacy page alone does not provide this consent mechanism.
10. Further information to confirm
[TO COMPLETE: confirm whether automated decision-making or profiling is used and, if applicable, explain its logic and consequences; verify that this draft covers all actual processing]. Material changes to processing must be reflected in this notice before they take effect.