Privacy information

The controller of personal data processed through this website is Excoin s.r.o., company ID 29682223, Uzbecká 1463/1, 101 00 Prague 10, Czech Republic. For privacy questions, contact [email protected], call +420 773 795 853, or write to the postal address above. You may also use the public contact form, but do not send passwords, access tokens or special categories of personal data through it.

This notice covers excoin.cz, its contact and careers forms, chat, administration and audience measurement. If we enter a contract with you, other rules communicated separately may apply to related documents and service operations. It does not cover our employees' data or customer systems outside this website.

The information involved depends on how you use the website. Ordinary browsing produces technical data needed to deliver pages and protect the service. If you submit a form or chat message, we process the information you provide and what is needed to respond. If you allow analytics, Google Analytics 4 may measure visits. Administrator sign-in creates a separate administrative session.

We do not ask visitors for national identity numbers, document numbers, payment details or health information. Please do not include them in messages. You decide what voluntary information to provide, but should share only what is needed for your enquiry or collaboration proposal. The website does not publish visitor submissions.

To display a page, our servers and delivery providers handle ordinary request data, including IP address, time, requested URL, server response, and browser or device information included in the request. This supports content delivery, secure connections, error diagnosis and protection against abuse. The exact contents of operational logs depend on server and Cloudflare configuration.

Viewing a page does not add you to a commercial mailing list and does not require permission for Google Analytics. We do not intentionally combine technical visit data with form messages to profile individual visitors. We are still verifying the exact retention of VPS, reverse-proxy and backup logs against production settings, so we do not state an unsupported period here.

To answer an enquiry, we process your name, work email, subject and message. The form may also offer optional fields such as organisation, project stage and expected timing. The message is stored in the website database and handled by an authorised administrator in a private interface. Sending a form does not sign you up for a newsletter or consent to further advertising.

We need the information to understand your request, reply, and discuss possible cooperation. Without an email address and a substantive request, we generally cannot respond. Describe the relevant project, but do not include login details, secret keys or unnecessary personal data about other people.

If you contact us through the careers or collaboration page, we process the fields accepted by its form: name, email, subject, message and any optional details you add. This channel starts a conversation; the current form does not accept CV files or other attachments. An authorised administrator reviews the message in the private interface.

We use the information to respond to your initiative and consider possible cooperation. We do not make automated hiring decisions or assess candidates using site analytics. If the conversation moves to a separate recruitment or contractual process, we will provide any further processing information in the relevant context.

The chat stores your messages and the administrator's replies. Name and email are optional; if supplied, we use them to follow up on your enquiry. Chat is not an automated adviser: the message appears in the private administration area and the administrator's response is shown in the same browser. Please do not submit passwords, identity documents or other sensitive data.

To reconnect you to the same conversation, an essential excoin_chat cookie holds a random identifier for up to 30 days. The server stores only a hash of that identifier. It is not an advertising identifier. If you remove cookies or use another browser, you may lose access to the conversation even while it remains in the administration area.

Cloudflare Turnstile protects contact and careers forms, chat and administrator login against automated abuse. During verification, Cloudflare may process device, browser, IP and interaction data. The website verifies the result on the server to limit spam and unauthorised access attempts. We do not use this protection as an advertising profile.

The website also limits the frequency of some requests and uses technical anti-spam controls. If verification fails, a message may not be accepted; you can instead use the email address or phone number above. The extent to which Cloudflare retains data for its own security assessment also depends on its documentation and our service configuration.

Essential storage includes the chat conversation identifier and, for a signed-in administrator only, a protected administration session cookie. The related functions would not work without them. We keep your analytics choice as accepted or rejected in browser local storage so you are not asked on every visit. The choice applies to that browser and profile.

Optional analytics cookies can be created only after you select “Allow analytics”. If you reject analytics before first allowing it, the Google Analytics script is not loaded. You can change your decision through “Cookie settings” in the footer at any time. On withdrawal, the site stops further measurement in that browser and tries to remove related cookies from the current domain; this does not retroactively erase data already sent.

After your affirmative consent, we use Google Analytics 4 with measurement ID G-SKEQ0FY74Y to understand site visits and use. It may record page views and other interactions supported by the service settings, such as link use or scrolling. The results help us see which information is useful and where the website is difficult to use. We do not use them to decide how to handle an individual enquiry.

Google provides the measurement service and may use cookies such as _ga and names beginning with _ga_. We do not intentionally send names, email addresses or form content to Google Analytics. The exact retention of user- and event-level data depends on this GA4 property's settings, which we are still verifying. Standard aggregate reports may follow different Google service rules.

We use form and chat data to respond, continue correspondence and take steps toward a possible contract at your request. Depending on the message, the basis is pre-contractual steps or our legitimate interest in handling correspondence. Technical operations, attack prevention and access control rely on our legitimate interest in running a secure website. Essential technical storage is used only for the relevant function.

Optional analytics and its cookies rely on your consent. Consent is not required to read the website or send an enquiry and may be withdrawn at any time. If a legal obligation requires us to keep a particular document or respond to a lawful request, we process the relevant information only as necessary for that obligation.

Form and chat messages are available to authorised EXCOIN administrators in the private interface. The website runs on a Hostinger VPS and uses Cloudflare for delivery and protection. Turnstile is a Cloudflare service. Google processes optional analytics data only once you allow it. Providers may access technical information as necessary to deliver their services under applicable contractual terms.

We do not sell or rent contact details from enquiries or automatically add them to marketing lists. Website messages are normally stored in the administration area, not automatically sent to a mailing platform. If a particular collaboration requires sharing information with another person or supplier, we will assess its purpose and legal basis separately.

Hosting and third-party services may involve access to or transfer of information outside the European Economic Area, depending especially on Cloudflare and Google configuration. Without checking contracts, data regions and technical settings, it would be misleading to claim that every item is processed only in the EU. We are verifying these points for the current deployment.

Where a transfer outside the EEA applies, it must use an appropriate GDPR transfer mechanism and safeguards. For details about the settings and documents relevant to your request, write to [email protected]. We will update this section when provider verification is complete.

Our stated retention period for contact and careers messages is 180 days from receipt. Chat conversations are intended to be erased 180 days after their last activity. An administrator may delete an individual message earlier. If correspondence leads to a contract, necessary records may be managed separately from the website database under the rules of that relationship and applicable legal duties.

An operational tool exists to remove old messages, but its scheduled execution on the public server still needs verification. Retention of technical logs and backups depends on VPS and provider settings and is also being checked. The chat cookie lasts up to 30 days; that is not the retention period of the conversation itself. Previously sent analytics data follows the GA4 property's settings.

Public messages are not shown to other visitors. Administration is protected by sign-in, technical restrictions and Turnstile verification. The site uses an encrypted HTTPS connection; the database is part of private server infrastructure. The chat token is stored as a hash on the server and administrator sign-in uses a separate session.

Access should be limited to people who need it to handle correspondence and operate the site. No technical measure can guarantee absolute security. If you notice suspicious behaviour or believe your information has been misused, contact [email protected] promptly.

Depending on the circumstances and GDPR conditions, you may request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on our legitimate interests. For analytics, you can withdraw consent through Cookie settings at any time; withdrawal does not undo processing that lawfully occurred before it.

Erasure may not be immediate where information is needed for a legal obligation or legal claims. Portability applies only when its legal conditions are met. If you are dissatisfied with our response, you may complain to the Czech Data Protection Authority or another competent supervisory authority.

Send a privacy request to [email protected] or by post to Excoin s.r.o., Uzbecká 1463/1, 101 00 Prague 10. Tell us whether it concerns a contact form, careers message, chat or other correspondence and provide the contact details used. Do not send an identity-document copy unless we have discussed a specific need for it.

We respond without undue delay, normally within one month. Where the law permits an extension, we will explain why. We may reasonably verify your identity before disclosing information to prevent it reaching the wrong person. Ordinary requests are handled free of charge within the limits set by the GDPR.

We will update this text if website functions, providers, retention periods or verified technical settings change. The current version remains available at this address in Czech, English and Spanish. A substantial change to a processing purpose or consent choice will not be treated as accepted merely because you visited the website previously.

We explicitly mark unverified operational details so this notice does not suggest certainty we do not yet have. If you need information about your own message or a provider before the text is updated, contact us and we will share the details available to us.