Privacy notice

Who processes your data

The data controller is:

Operator

Tomáš Zatloukal

Address

Jana Maluchy 42/8

Contact

kezzy@shimatsu.eu

Data protection officer

privacy@shimatsu.eu

What we store

• Answers. What you fill in, including uploaded files and a signature if the form asks for them.
• Email. Only when you enter it in the form.
• Handling. The tracking code, the status of your response, messages between you and the team, and the team’s notes on the response.
• Technical data. A fingerprint of your IP address (the address itself is not stored with the response), the browser type and the result of the spam check.

Like any website, the server sees your IP address when you connect and may keep it in its ordinary operating logs.

Why we do it

Handling your response

To read and process your response and let you know the outcome, including emails to the address you give. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). If the form includes a consent checkbox, the legal basis is your consent (Art. 6(1)(a)).

Protection against abuse

Technical data is used to detect spam and bots. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f)).

Filling in a form is voluntary, but it cannot be sent without the required fields. We do not sell your data, use it for advertising or profile you. We make no automated decisions about you: the spam check only flags a submission and a person reviews it.

How long we keep data

A response is deleted together with its attachments and related data after the period set for the form. If no period is set, this happens 2 years after it was received. We delete it sooner if you ask and nothing prevents it. Deleted data may stay in backups a little longer.

Who can access the data

We store the data on our own servers, and only the team handling that form can access it. It can leave our team only in these cases:

• Your email provider processes every message we send you.
• Discord or another team tool, if the form has notifications about new responses turned on. A notification may include data from the response. Discord’s policy.
• Google, if the form contains a YouTube video and you click it. Nothing loads without the click. Google’s policy.
• Public authorities, when the law requires it.

Discord and Google are US companies, so in those two cases data may leave the EU. In all other cases it stays with us.

Your rights

You have the right to access your data and get a copy, and to have it corrected, erased, restricted or transferred. You can object to processing based on legitimate interest. You can withdraw consent at any time, which does not affect what happened before.

Just write to support@shimatsu.eu with your tracking code or the email used in the form. We reply free of charge, within one month at the latest. Sometimes we first have to verify that the request really comes from you.

If you disagree with the outcome, you can complain to the Czech Office for Personal Data Protection: uoou.gov.cz.

Under 15

If you are under 15 and the form relies on consent, a parent or other legal guardian has to give it for you (Section 7 of Czech Act No. 110/2019 Coll.). If we find out this did not happen, we delete the data. A parent can write to us at support@shimatsu.eu.

Changes

When something changes, we update this page and the effective date at the top. Related rules are in the terms of use and on the Cookies page.