← Back to Home

GDPR & Data Protection

Last updated: March 10, 2026

1. Data Controller

The Capital Code acts as the data controller for personal data collected through this website. We are committed to processing your data in compliance with the General Data Protection Regulation (GDPR) and applicable Czech data protection laws.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Contract performance: Processing necessary to fulfill our obligations when you purchase a product or create an account
  • Consent: Marketing emails and newsletter subscriptions (you can withdraw consent at any time)
  • Legitimate interest: Website analytics, fraud prevention, and service improvement

3. Your GDPR Rights

As a data subject under the GDPR, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you
  • Right to rectification: Request correction of inaccurate or incomplete data
  • Right to erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to restrict processing: Limit how we use your data
  • Right to data portability: Receive your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interests
  • Right to withdraw consent: Withdraw consent at any time for consent-based processing

4. Data Transfers

Your data may be processed by third-party services (e.g., Stripe for payments, Resend for transactional emails). These services comply with GDPR and provide adequate data protection safeguards. Data is primarily stored in the EU region via our database provider (Turso).

5. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay.

6. Newsletter & Marketing

  • Newsletter subscriptions require explicit opt-in
  • Every marketing email includes an unsubscribe link
  • We do not share subscriber data with third parties
  • Unsubscription is immediate and permanent

7. Cookies

This website uses a cookie consent mechanism. We store only essential cookies (language preference, consent status) in localStorage. No third-party tracking cookies are used without your explicit consent.

8. Exercising Your Rights

To exercise any of your GDPR rights, please contact us through the Q&A page. We will respond to your request within 30 days.