Privacy, personal data and cookies

Controller and scope

The controller for the personal data described in this policy is the Czech company Ganado. This policy covers the public website, contact and calculator forms, traffic measurement on ganado.cz and the Ganado app for clients.

Legal name: Ganado international s.r.o.
Company ID (IČO): 19322119
Registered office: Příčná 1892/4, Nové Město, 110 00 Praha 1
Privacy contact: info@ganado.cz

Separate applications or client services may provide additional notices where they process a different data set. In that case, the additional notice applies together with this policy.

Data, purposes and legal bases

The scope depends on whether you only browse the website, submit an enquiry, request a calculator result by email or become a client.

Main processing activities on Ganado’s public website
Activity	Data categories	Purpose and legal basis	Retention
Contact enquiry	Name, contact, message, selected service, business situation, documents, timing, language and attribution context.	Replying, scoping and quoting: Article 6(1)(b) GDPR; for general communication and continuity records, also legitimate interests under Article 6(1)(f).	Until the enquiry closes, then only while needed for continuity, legal claims or a legal duty; the data set is reviewed regularly.
Calculator result	Email, language, calculator type, entered values, calculated output and submission identifier.	Sending the requested result: requested pre-contract steps under Article 6(1)(b); operational protection relies on Article 6(1)(f).	Using the same criteria as an enquiry. A separate delivery backup is deleted automatically after 30 days.
Sales pipeline and client relationship	Contact, service, case status, communication history, supporting records and data required to provide the service.	Managing the enquiry and contract: Article 6(1)(b); accounting and tax duties under Article 6(1)(c); protecting legal rights under Article 6(1)(f).	While the enquiry or contract is active, then according to a specific statutory duty or claims risk; unnecessary scope is erased or restricted.
Security and technical operation	Request time and metadata, host, origin/referrer, IP address processed to limit abuse, technical logs and error records.	Availability, spam prevention, rate limiting, diagnostics and service protection: legitimate interests under Article 6(1)(f).	Only for a limited period matching the security or diagnostic purpose; longer only for an incident or legal claim.
Technical traffic measurement (Ganado Track)	Pages visited, time on page, scroll depth, clicks on labelled elements, referrer origin (scheme and domain only) and UTM parameters — no cookies and nothing stored on your device.	Measuring traffic, traffic sources and content performance without ad profiling: legitimate interests under Article 6(1)(f). No consent is required — this measurement is consent-exempt.	Deleted automatically after 10 years. The server rotates the visitor key's salted hash daily, so visits cannot be linked across days.

Forms and business communication

Contact and calculator forms collect only what is needed for the specific request. Required fields are marked; without contact details and minimum context we may be unable to reply.

A validated enquiry is written to the Ganado Core sales pipeline, delivered through Resend and placed in a separate delivery backup with automatic deletion after 30 days. The backup protects against losing a lead during an email outage; it is not used for marketing.

We send the calculator result without marketing consent, as a requested pre-contract step.

Depending on the situation, a form may include

name, email or phone number and preferred reply channel;
message, service, client type, urgency, available documents and timing;
business context such as IČO/OSVČ status, platform work, foreign services or previous VAT/identified-person handling;
for a calculator, the email, inputs, calculated totals, calculator type and year;
the page and button leading to the form, language, referrer, UTM parameters and a technical submission identifier.

Operational request metadata

The server processes origin, referer, host and IP address to validate requests, prevent abuse and apply rate limits.
Suspicious or malicious payloads may be rejected automatically; a valid enquiry is not assessed for a legal or similarly significant decision.

Ganado app

The Ganado app is a mobile app for clients who have a contract with Ganado. You sign in with your email address and a one-time code we send to it; we process your name and phone number only if you provide them yourself. There is no registration in the app — we open accounts only for clients with a contract.

In the app you see the status and deadlines of your accounting, tax and payroll obligations under the contract. Documents we need from you can be uploaded or photographed there.

The app processes

your sign-in email address and one-time code; your name and phone number if you provide them;
documents and photos you upload — receipts, invoices, statements;
the status and deadlines of your accounting, tax and payroll obligations under the contract.

What stays on your phone

The camera and photo library open only when you tap to scan or pick a file.
Deadline reminders are scheduled on the device itself; we run no push-notification server.

Data from the app is stored on Ganado’s own server in the Czech Republic. The app loads the list of your companies and the overview of obligations and requested documents through Ganado’s web app, hosted by Vercel in the Dublin region (Ireland). The app’s HTTPS requests pass through Cloudflare, and sign-in codes are sent from auth@ganado.cz through Postmark. The roles of these providers and where they process data are described under Recipients and transfers outside the EEA.

The legal basis is performance of the contract under Article 6(1)(b) GDPR and, for accounting records, also compliance with legal obligations under Article 6(1)(c). We keep data from the app in the same way as the rest of a client’s accounting and tax records: for the periods required by applicable law and the contractual relationship.

The rights described under Your rights, including a request to erase your account and uploaded documents, can be exercised at the controller’s email address info@ganado.cz.

Cookies and analytics

Ganado.cz uses no analytics or marketing cookies and loads no tool that would need your consent. The website therefore has, and needs, no cookie banner.

No analytics that would need consent

The site previously used Google Analytics, Microsoft Clarity and Vercel Web Analytics/Speed Insights. All three have been removed from the site — none of their scripts load and none of their cookies (_ga, _gid, _clck, _clsk and similar) are set. Before a visitor chooses anything, the site sets no cookies and writes nothing to the browser's web storage.

Cookieless visit measurement (Ganado Track)

We measure site traffic with our own tool that stores nothing on your device — no cookies, no web storage. The visitor key is derived on the server as a salted hash; the salt rotates every day and the previous one is deleted, so visits cannot be linked across days. This measurement is consent-exempt and always runs, independent of the choices described below.

pages visited, time spent on a page and scroll depth;
clicks on elements we labelled for this purpose, and enquiry or form submissions; their text and link target are not read;
the referrer origin, meaning the scheme and domain only, never the page address, and UTM tags;
a coarse browser family, for example “Chrome / Android”.

These records are deleted automatically after 10 years. We do not sell them and do not share them with advertising networks.

You can opt out of this measurement at any time: open any page of the site with ?gnd_notrack=1 appended to the address. Your choice is remembered on our server for 90 days, so opting out stores nothing on your device either; ?gnd_notrack=0 turns measurement back on.

Hosting and network infrastructure

Hosting and CDN providers process technical request data in their own right, to deliver the site and protect it from abuse. That processing serves operation, not behavioural measurement — it is also covered under Recipients and transfers below.

Vercel

Hosting and delivery of the website. On Vercel, the site does not use Vercel Web Analytics or Speed Insights.

Cloudflare

Network infrastructure and traffic protection. Cloudflare may run its own cookieless web-analytics beacon on our domain (a cookieless technology described in the provider's documentation), and when it suspects automated or malicious traffic it may briefly set the cf_clearance security cookie to confirm a visit is legitimate. That cookie serves security only, not measurement or profiling.

Owner marker

The site owner can set a single local marker, “gnd_owner”, on his own device by opening a URL with ?gnd_owner=1 (?gnd_owner=0 removes it). It only separates his own visits from visitors' in Ganado Track summaries and has no effect on what is processed about you.

Recipients and transfers outside the EEA

Access is limited to people and suppliers who need it for the stated purpose. Depending on the service, a supplier acts as a processor or an independent controller.

Main recipient and supplier categories
Recipient	Role	Data and purpose	Location / transfer
Ganado Core	Ganado’s own infrastructure for data storage	Sales pipeline and the 30-day backup of validated enquiries.	Ganado’s own server in the Czech Republic. HTTPS requests to Core pass through Cloudflare.
Ganado app server	Ganado’s own infrastructure for the app	Sign-in data, uploaded documents and the status of obligations for clients who use the Ganado app.	Ganado’s own server in the Czech Republic. The app’s HTTPS requests pass through Cloudflare.
Resend	Email delivery	Contact, message content and metadata required for delivery and error handling. Resend retains email data for 30 days; open/click tracking is disabled for the domain.	According to the provider’s documentation, email metadata, logs and API records are stored in the United States. Transfers from the EEA are covered by the provider’s DPA, EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
Postmark (ActiveCampaign, LLC)	Delivery of the app’s sign-in codes	Email address and the one-time code for signing in to the Ganado app, sent from auth@ganado.cz.	USA. The transfer is covered by Standard Contractual Clauses approved by the European Commission.
Vercel	Hosting and delivery of the website and the Ganado web app	Web requests, technical logs and performance; for the Ganado app, also requests for the list of companies and the overview of obligations and documents. We do not use Vercel Web Analytics or Speed Insights.	The Ganado web app runs in the Dublin region (Ireland). The provider may use infrastructure outside the EEA.
Cloudflare	Network infrastructure and security	On Ganado’s instructions it processes the request and response content of Ganado Core and the Ganado app, including enquiry and account data, documents uploaded in the app, IP addresses and technical connection metadata to deliver and secure HTTPS traffic. Network and technical data needed to transmit requests securely and protect the service; the provider's own cookieless web-analytics beacon and a temporary cf_clearance security cookie when checking suspicious traffic.	The global network may process data outside the EEA; the provider identifies GDPR mechanisms including the Data Privacy Framework and standard contractual clauses where applicable.
Public authorities and professional advisers	Legal duty or claims protection	Only data necessary for the specific duty, dispute or security incident.	According to jurisdiction and the legal basis of the specific case.

Where a provider processes data outside the European Economic Area, a Chapter V GDPR mechanism is required. Depending on the recipient, this may be an adequacy decision, including the EU–US Data Privacy Framework for a certified recipient, or Article 46 standard contractual clauses with appropriate supplementary measures.

You can request information about the mechanism used for a specific transfer and an available copy of the safeguards from the controller’s email address.

Retention and security

We do not retain data longer than its purpose requires. The period is determined by the enquiry or contract status, statutory archiving, potential legal claims, security needs and provider settings.

separate form-delivery backup: automatic deletion after 30 days;
enquiry and sales pipeline: until the case closes, then only while justified by continuity, a claim or a legal duty;
Ganado Plus data-processing consent: valid for no more than 12 months from when it was given; we request a fresh choice only if the scope of Ganado Plus processing changes materially;
client accounting and tax records: for periods required by applicable law and the contractual relationship;
technical and security logs: a limited operational period, longer only for an incident or claim;
technical traffic measurement (Ganado Track): deleted automatically after 10 years, with no identifiers tied to your device.

Security and data minimisation

We use access separation, server-side validation, rate limiting, spam protection, encrypted transport and restricted service roles. The pipeline and backups are not publicly accessible.

No control removes every risk. When a purpose, supplier or data flow changes, we reassess the scope and update this policy.

Your rights

Subject to the GDPR conditions, your rights include:

access to personal data and information about its processing;
rectification of inaccurate or completion of incomplete data;
erasure where there is no longer a legal basis to retain the data;
restriction of processing in the circumstances set by the GDPR;
portability for automated processing based on consent or a contract;
objection to processing based on legitimate interests;
withdrawal of consent for future Ganado Plus data processing;
a complaint to the supervisory authority and judicial remedy.

If you object to processing based on legitimate interests, we will stop unless we demonstrate compelling legitimate grounds or a need to establish, exercise or defend legal claims.

Consent to Ganado Plus data processing can be withdrawn at any time at the controller's contact email. Withdrawal does not affect the lawfulness of earlier processing or access to the website.

Send a request to the controller’s email address. To protect the data, we may reasonably verify identity without asking for more information than the verification requires.

We respond without undue delay, normally within one month. The GDPR may allow an extension for complex requests; we will explain the reason in time.

Supervisory authority Czech Office for Personal Data Protection (ÚOOÚ) Pplk. Sochora 27, 170 00 Prague 7, Czech Republic How to lodge a complaint with ÚOOÚ

Automation and official sources

We may automatically sort an enquiry by topic, source, priority or technical risk so it reaches the appropriate workflow. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

The site uses no analytics and does not build advertising profiles. This policy is a transparent description of processing, not a compliance certification or individual legal advice.

We check the rules and rights against these official primary sources:

If the data flow, supplier or purpose changes materially, we will issue a new version and, where required, request a fresh consent choice.

A clear account of what we process.

The essentials

ENQUIRIES

NO ANALYTICS

NO AD PROFILES