Privacy policy

1. Who the controller is and how to reach them

The data controller is Emet delta s.r.o., company ID (IČO) 09753133, registered at Zbraslavská 12/11, 159 00 Praha, Czech Republic, with an office in Opava.

In practice, one person runs the site and the form — Samuel Poloha, the company's managing director and the person who built the site. He is the one who reads your message and replies.

Write to Show e-mail or call Show phone (both are hidden behind a "reveal" button on the site — click it to see the real value).

We don't have a separate Data Protection Officer — a business our size isn't legally required to have one — so anything about your data goes straight to Samuel.

2. What the form collects and why

The form on the site has these fields:

The form also has one hidden field a normal visitor never sees or fills in — it's a trap for spam bots (a "honeypot"). If something fills it in, the form treats the submission as spam and never sends or stores it; the content of that field is never saved anywhere.

The form never sends files, your location, or any other data about your device — only what you type into the fields above.

3. What happens to a submitted form

A submitted message goes out as an e-mail to the address given in section 1. From there a forwarding service redirects it to the site owner's private mailbox at Google (Gmail) — that's where Samuel reads it personally (details, and why we don't print the address itself, are in section 4). Sending the e-mail from the form is handled by a tool called Brevo. The form itself is never saved to any database on the server — the lasting trace is the e-mail in the inbox and (only under the conditions in section 5) a fallback record.

4. Who else sees your data

We never sell your data or use it for anything other than what this policy describes. Besides Samuel personally, the following service providers technically handle it, because we need them to make the site and the form work at all:

• Brevo (Sendinblue SAS, Paris, France) — the tool the form's e-mail is sent through, addressed to the address given in section 1. It's a European company that, by its own terms, processes data in European data centres.
• ForwardEmail.net (USA) — once a message (whether from the form, or because you e-mailed us directly, outside the form) reaches the address given in section 1, this forwarding service sends it on to the site owner's private mailbox at Google.
• Google / Gmail (Google LLC, USA) — the site owner's private mailbox, where the message finally ends up and where Samuel reads it. We deliberately don't print the exact address of that mailbox in this document — it's the same protection that keeps the e-mail and phone number on the site hidden behind a "reveal" button: we don't want to expose it to address harvesters. Google is certified for this purpose under the EU-U.S. Data Privacy Framework — a mechanism the European Commission recognises as giving adequate protection even for transfers to the US. See section 10 for more.
• The hosting provider — the site and the form run on a single physical server at a Czech hosting provider (see section 9). The hosting provider has the same access to the data on that disk that any hosting company has to its own machines, but doesn't do anything with your data itself — it's just where the server runs.

We don't hand your data to any marketing, advertising, or analytics tool — the site doesn't use any (see section 8).

5. When an e-mail can't be sent — the fallback record

Normally your message disappears from the server's memory the moment it leaves as an e-mail. But technology occasionally breaks — the mail relay can be temporarily unreachable, or we can hit a daily sending limit (shared with the other small sites we run). For these rare cases we have a safety net: if the e-mail can't be sent, the full content of your message is written to a dedicated record on the server (the same fields as in section 2, plus an approximate version of your IP address — see section 7), so your request doesn't get lost just because the technology hiccupped. When the e-mail is sent normally, only a technical line with no personal data gets written (which site was audited, and whether you left an e-mail or a phone number — never the value itself).

This record:

• is only ever seen by the server's administrator (Samuel, as root on his own machine) — it's readable only by him, and no one else has access to it;
• overwrites itself automatically on the server once it grows past a certain size (details in section 6);
• has, as of 25 Sep 2026, become part of the regular nightly off-site backup — it wasn't before (while writing the first version of this policy we found this specific record wasn't being backed up at all, and fixed the setup as a result). The backup is encrypted on the server before it ever leaves it — even if it ended up in the wrong hands, the file itself is unreadable without the passphrase.

In practice this means: if the e-mail with your request can't be sent, your submission stays stored on the server and also in an encrypted off-site backup — not just in a record that eventually overwrites itself.

If this happens, we also send ourselves one alert e-mail saying that requests currently aren't going out and are piling up in this record — with none of your details in it, just that "something is there."

6. How long we keep data

7. Web server logs and IP addresses

When you browse the site, the web server (nginx) that serves it records, for every request (a page, an image, a font…): your IP address, the time, which page you asked for, the response code, the response size, where you came from (if your browser sends that), and an identifier for your browser/device (the "user agent"). This is a standard log kept by almost every website on the internet — it's used to keep the site running, to fix things when something breaks, and to spot an attack or abuse.

This IP address is not anonymised — it's the full technical record, unlike the IP address used for the form (see below). Only the server's administrator can see it, and it is deleted by the same automatic rotation as in section 6.

For the form itself it's different: we only use the IP address a submission comes from to recognise when someone is sending dozens of messages a minute (abuse/spam protection) — for that purpose we keep it in memory for at most 10 minutes and never save it anywhere. If your IP address does end up in the request e-mail or the fallback record (section 5), it's truncated first — for an ordinary IPv4 address we drop the last number (e.g. 89.24.15.0 instead of the exact address); for IPv6 only the first three groups of digits remain. That shortened form is enough to tell "roughly the same part of the network," but not enough to identify a specific device.

8. Cookies

The site sets exactly one cookie: emet_lang. It remembers the language you picked (Czech/English/Polish) for 1 year. It's only set the moment you actively choose a language (by clicking the language switch or a link with ?lang=), never automatically on every visit.

This cookie doesn't need your consent — it doesn't track anything, is never sent anywhere outside this site, and exists solely to do the one thing you asked for (so the site opens in your language next time). The site has no cookie-consent banner because it sets no other cookie.

9. Where the site and the form run

The site and the form run on a single virtual server at a Czech hosting provider (the server's IP address is, per a public whois lookup, registered to Internet CZ, a.s. — brand name Forpsi — with a registered address in Ktiš, Czech Republic). The server is therefore physically inside the European Union. The connection between your browser and the server is always encrypted (HTTPS).

10. Transfers of data outside the European Union

Most of the processing happens inside the European Union — the server is in Czechia, and Brevo, the tool that relays the mail, is a French company with European data centres.

Two linked steps do involve a genuine transfer outside the EU: the e-mail with your request (and equally a message you send us directly, outside the form) first passes through the US forwarding service ForwardEmail.net, and finally ends up in the site owner's private mailbox at Google — that is, at the US company Google LLC. We don't want to hide this or dress it up: under GDPR this formally counts as a transfer of personal data outside the EU. Both providers, though, have a legal mechanism in place at the point of transfer that the European Commission recognises as adequate protection (for Google, this is the EU-U.S. Data Privacy Framework, a certification Google LLC currently holds; ForwardEmail.net's own data processing terms point to the same kind of safeguard). In other words: the transfer happens within the rules, not around them, but it's honest to be upfront about it.

We never hand your data to any other commercial or advertising entity outside the EU.

11. What the site doesn't do

The site is set up so it cannot load anything from a third-party domain — its content security policy (CSP) only lets your browser fetch a script, stylesheet, font, or image from emetstudio.eu itself. This isn't just a promise in this text; it's enforced technically, by the browser.

• No analytics. Since 22 Sep 2026 the site uses no analytics tool at all (the earlier Umami instance was compromised by a security bug and was fully removed) — the site never sends information about how you browse it anywhere, and sets no tracking cookie.
• No profiling and no automated decision-making. No one (and no program) automatically decides anything about you or what we'd offer you based on your data — every request is read and handled by Samuel personally.
• No advertising. The site loads no advertising or tracking script from any third party — see the paragraph above.
• No selling of data. We never sell your data or hand it over for anyone else's marketing purposes.

12. Your rights

Under GDPR you have the right to:

• access — ask what data we hold about you;
• rectification — have inaccurate data corrected;
• erasure — ask us to delete your data (e.g. a request you're no longer interested in);
• restriction of processing — in justified cases, have processing paused;
• data portability — receive your data in a machine-readable format;
• object — particularly to processing that relies on our legitimate interest (typically the logs and the form's abuse protection, sections 5 and 7).

The form is not processed on the basis of consent (it's handling your request as a step before a possible working relationship, Article 6(1)(b) GDPR), so there's nothing to "withdraw" — but write to the contact given in section 1 and we'll do whatever you ask with your data.

13. Complaining to the regulator

If you think we're not handling your data properly, you can contact the Czech supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)

Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

e-mail: posta@uoou.cz · phone: +420 234 665 111

uoou.gov.cz

If you're not in the Czech Republic, you may instead be able to complain to the supervisory authority in your own EU country.

14. Changes to this policy and when it takes effect

We may update this policy from time to time — for example if the site, the form, or the providers we use change. The current version always lives at this page.

This policy takes effect on 1 October 2026.