Privacy notice

The controller is ALEYO s.r.o., company ID 30149801, with its registered office at Moskevská 1008/40, 360 01 Karlovy Vary, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Plzeň, Section C, File 49154.

For privacy questions or requests, contact daniel@aleyo.cz or write to our registered office. This notice covers the ALEYO website and communications about inquiries and projects.

The form collects your name, email address and selected area of interest. You may optionally provide a location, date and project description. Follow-up communications may include information you choose to share and details needed for a quotation, contract or delivery.

To operate and protect the website, we and our providers may process your IP address, browser and device information, requested page, request time and outcome, and anti-bot verification signals. The form does not require sensitive personal data; please do not include it in free-text fields.

• Inquiries and contracts: taking steps at your request before entering a contract and performing it under Article 6(1)(b) GDPR. For business contact persons, we rely on our legitimate interest in business communications and delivering projects under Article 6(1)(f).
• Accounting and other legal duties: compliance with legal obligations under Article 6(1)(c), where applicable to the relationship.
• Security and legal claims: our legitimate interest in preventing spam and abuse and establishing, exercising or defending legal claims under Article 6(1)(f).

We need your name and email to handle and respond to your inquiry. Other details are optional. Sending an inquiry does not subscribe you to a newsletter or give permission for advertising.

CookieYes manages your cookie choices and records acceptance or refusal. Google Tag Manager loads the consent manager and permitted tags. These services receive technical information needed for the connection, such as your IP address and browser information.

Google Analytics 4 loads only after you consent to analytics cookies (Basic Consent Mode). We measure page visits, contact-button clicks and successful inquiry submissions. We do not send names, email addresses, free-text briefs or URL query parameters to analytics. We do not use advertising pixels.

Optional analytics relies on consent under Article 6(1)(a) GDPR. Necessary consent management and records support our obligations concerning consent. You can change or withdraw your choice at any time using Cookie settings in the footer; this does not affect earlier lawful processing. Refusing analytics does not prevent you from using the website or submitting a form.

See the Google privacy policy and CookieYes privacy policy. Cookie purposes and retention periods are listed on Cookies and website preferences.

Information is available to authorised ALEYO staff and suppliers to the extent needed for their work. The website currently uses:

• Vercel Inc. – website hosting, form endpoint operation and technical logs.
• Plus Five Five, Inc. (Resend) – delivery of inquiries to ALEYO and confirmations to your email address.
• Cloudflare, Inc. – Turnstile anti-spam verification and delivery of certain public website assets.
• Google Workspace (Google) – business email storage and follow-up communications.
• Google Ireland Limited – Google Tag Manager and, with consent, Google Analytics 4.
• CookieYes Limited – cookie consent management and records.
• Authorised website and IT support providers; accountants and legal advisers where needed.

We do not sell personal data. We disclose it to public authorities where required by law. Processors must use the information only for agreed purposes under the applicable contractual arrangements.

Vercel, Resend, Cloudflare, Google and CookieYes use international infrastructure, so information may also be processed outside the European Economic Area, particularly in the United States. Transfers are subject to safeguards under Chapter V GDPR, including the European Commission’s Standard Contractual Clauses or an applicable adequacy decision where its conditions are met.

See the Vercel DPA, Resend DPA, Cloudflare DPA and Google Workspace DPA, Google Ads Data Processing Terms and CookieYes DPA. You can request details or a copy of the relevant safeguards at daniel@aleyo.cz.

Inquiries that do not become a project are kept while we handle them and follow up, for no more than 12 months after the last contact, unless continued retention is necessary for a specific legal claim. Project records are kept during delivery and then for applicable statutory retention periods and limitation periods for legal claims. An ongoing dispute may require retention until it is resolved.

Technical logs are retained as needed for operation, diagnosis and security incidents, subject to provider retention settings. The form’s short-term rate limit uses hashes of IP addresses and emails within a ten-minute window. The application does not save unsent briefs to a database or persistent browser storage. Browser preference storage is described in Cookies and website preferences.

Cloudflare Turnstile loads at the review step of the form. It evaluates technical signals such as IP address, browser information and request origin to distinguish visitors from bots. ALEYO does not send form field contents to Turnstile. Cloudflare acts as a processor for website protection and as a separate controller when improving bot detection; see the Cloudflare Turnstile Privacy Addendum.

Verification can prevent automated submissions, but it does not determine quotations or contracts. If it fails, email daniel@aleyo.cz directly. We do not carry out automated decisions with legal or similarly significant effects or marketing profiling. Optional analytics starts only after consent; we do not use advertising pixels. Local storage is explained in Cookies and website preferences.

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and data portability where processing is automated and based on consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send requests to daniel@aleyo.cz. We normally respond within one month. In circumstances permitted by the GDPR, this may be extended by two further months; we will explain the reasons within the initial period. We may request proportionate identity verification if needed.

You may also complain to a supervisory authority. In the Czech Republic this is the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7. You may also contact the authority where you habitually live, work or where the alleged infringement occurred.