Privacy policy

Effective date: 31 October 2026. Version 2.

Oryven Group designs and builds websites and digital tools for businesses. Your privacy matters to us, and we want you to understand clearly what happens to your personal data when you deal with us.

This privacy policy explains what personal data we collect, why we collect it, the legal basis on which we rely, who receives it, how long we keep it and how we protect it. It also explains the rights you have and how to use them. It is provided under Articles 13 and 14 of the General Data Protection Regulation (GDPR). In this policy, "we", "us" and "our" refer to Oryven Group, whose full details appear in section 20.

1. Scope of this policy

This policy applies to personal data we handle about:

• visitors to this website;
• people who contact us through the contact form, by email, by telephone or by message;
• owners, employees and contact persons of businesses we contact about our services;
• our clients and the people we deal with at those clients.

It does not apply to websites we build or maintain for other businesses. Each of those businesses decides how its visitors' data is used and is responsible for it. We act only on its instructions, and its own privacy policy applies. If your question concerns such a website, please contact that business first.

2. Definitions

• Personal data: any information relating to an identified or identifiable person.
• Processing: anything done with personal data, such as collecting, storing, using, sharing or deleting it.
• Controller: the person who decides why and how personal data is processed.
• Processor: a person or company that processes personal data on behalf of a controller.
• GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.
• FADP: the Swiss Federal Act on Data Protection.

3. Our data protection principles

We handle personal data in line with Article 5 GDPR. This means that we:

• process it lawfully, fairly and openly;
• collect it only for specific and legitimate purposes;
• limit it to what we need for those purposes;
• take reasonable steps to keep it accurate;
• keep it no longer than necessary;
• protect it with appropriate security measures.

4. What we process, why, and on what legal basis

4.1 Visiting this website

Data

IP address and the technical details your browser sends with every request, such as browser type, requested page and time.

Source

Your device, through our hosting provider Cloudflare.

Purpose

Delivering the website to you and protecting it against attacks and misuse. We do not use this data to identify you.

Legal basis

Article 6(1)(f) GDPR, our legitimate interest in operating a secure, working website.

Retention

We do not keep this data ourselves. Cloudflare keeps technical logs only as long as it needs them to provide and secure its service. Its published policy sets no fixed number of days.

4.2 Contact form, email, telephone and messages

Data

Your name, business name if given, email address, message, and anything else you choose to send us, including attachments and your telephone number if you call or message us.

Source

You.

Purpose

Answering your enquiry and preparing a possible cooperation.

Legal basis

Article 6(1)(b) GDPR for steps you request before a possible contract. Article 6(1)(f) GDPR, our legitimate interest in answering people who contact us, for any other message.

Retention

If no work follows, we delete your messages 12 months after our last contact with you. Copies of form messages stay in Resend's logs for up to 30 days after sending. Deleted data may remain in our providers' systems for a short time until their normal processes erase it.

Please do not send us sensitive data, such as health information, that we do not need.

4.3 If we contacted you first

We sometimes contact businesses we believe could benefit from our services, for example with a short message offering a free demonstration.

Data

Business contact details: business name, name of the owner or contact person if published, business telephone number, business email address, website and social media pages, plus our own notes on whether we contacted you and what you replied.

Source

Public sources, such as Google Maps listings, your business website and your public social media pages.

Purpose

Offering our services to businesses.

Legal basis

Article 6(1)(f) GDPR, our legitimate interest in promoting our business.

Retention

Up to 12 months after our last contact. If you tell us not to contact you again, we stop immediately and keep only the minimum needed to make sure we respect that.

You may object to this at any time, free of charge and without giving a reason. Write to [email protected] or simply reply to our message.

4.4 If you become a client

Data

Contact and billing details, contract documents, project communication and invoices.

Source

You and our work together.

Purpose

Performing our contract with you, meeting our tax and accounting duties, and handling questions or claims afterwards.

Legal basis

Article 6(1)(b) GDPR for the contract. Article 6(1)(c) GDPR for legal duties. Article 6(1)(f) GDPR, our legitimate interest in handling questions and claims, for project communication kept after the work ends.

Retention

Project communication for 3 years after the work ends. Invoices and tax records for 10 years, to meet Czech tax and accounting duties.

4.5 Keeping data longer for legal reasons

We keep data longer than the periods stated in this policy only where the law requires it, under Article 6(1)(c) GDPR, or where it is needed to establish, exercise or defend an actual or likely legal claim, under Article 6(1)(f) GDPR. In those cases we keep only what is needed, for only as long as it is needed.

5. Our legitimate interests

Where we rely on legitimate interests, those interests are:

• keeping this website secure and working;
• answering people who contact us;
• telling businesses about our services;
• handling questions and establishing, exercising or defending legal claims.

We rely on these interests only where they are not overridden by your interests and rights. You may ask us how we weighed them, and you may object at any time as described in section 12.

6. Cookies and similar technologies

Cookies are small files that a website stores on your device. This website sets no cookies and stores nothing on your device. It has no analytics, advertising pixels or social media plugins, and its fonts are loaded from our own site, not from Google.

Because there is nothing to accept or refuse, we do not show a cookie banner. If that changes, we will update this policy first and ask for your consent where the law requires it.

7. Whether you must provide your data

You are never legally required to give us personal data. To answer you we need a way to reach you, so the contact form asks for your name, email address and message, and for you to accept our terms of use. That tick is not consent to any use of your data. Your business name is optional.

Without the required fields we cannot process your enquiry. If you do not provide the details needed for a contract and invoice, we cannot work together.

8. Who receives your data

We do not sell personal data or share it for anyone else's marketing.

8.1 Service providers

Google and WhatsApp handle data under their own privacy terms, not only on our instructions, so please read their policies as well. If we start using another provider that receives your data, we will add it here.

8.2 Our business partner

Our business partner Alfonso helps answer enquiries and can read the messages sent to us. Alfonso may use them only to deal with your request and must keep them confidential.

8.3 Advisers and authorities

For clients, we share what is legally required with our tax adviser or accountant, if we use one. We disclose data to public authorities, such as tax offices or courts, only where the law requires it. We may also share data with legal advisers where needed to establish, exercise or defend a legal claim.

9. International data transfers

Cloudflare and Resend are based in the United States, and Resend stores data there. Google and WhatsApp may also process data there. These transfers are protected as follows:

• On 10 July 2023 the European Commission decided that the United States ensures adequate protection for companies certified under the EU-U.S. Data Privacy Framework. Cloudflare and Resend state that they are certified. You can check any company on the official list.
• Resend also uses the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, included in its data processing addendum. Cloudflare's data processing addendum provides for the same clauses if its certification ever ends.
• You may ask us for a copy of these safeguards at [email protected].

10. How long we keep your data

Website logs

Not kept by us. Cloudflare keeps them as long as needed to provide and secure its service.

Enquiries

12 months after our last contact if no work follows.

Form message logs

Up to 30 days after sending, at Resend.

Business outreach

Up to 12 months after our last contact.

Project communication

3 years after the work ends.

Invoices and tax records

10 years.

When a period ends, we delete the data or make it anonymous, unless section 4.5 applies.

11. How we protect your data

We use technical and organisational measures appropriate to the data we hold. The website and contact form use encrypted connections. Only the people who need your data to do their work can read it, and our accounts are protected by passwords.

No system is perfectly secure. If a personal data breach occurs, we will assess it promptly. Where the law requires it, we will notify the data protection authority within 72 hours of becoming aware of it, and we will tell you without undue delay if it puts your rights at high risk.

12. Your rights

Under the GDPR, and subject to the conditions and limits it sets, you have the right to:

• Access: ask whether we hold your data and receive a copy (Article 15).
• Rectification: have inaccurate or incomplete data corrected (Article 16).
• Erasure: have your data deleted, unless the law requires us to keep it (Article 17).
• Restriction: ask us to pause the use of your data, for example while we check a complaint (Article 18).
• Portability: receive data you gave us under a contract in a common electronic format, or have it sent to another provider where technically possible (Article 20).
• Objection: object to processing based on our legitimate interests. If we contact you to promote our services, we will stop as soon as you object (Article 21).
• Withdrawing consent: we do not rely on your consent today. If we ever do, you may withdraw it at any time, without affecting anything we did lawfully before.

13. How to exercise your rights

Write to [email protected]. We reply within one month. If a request is complex or you send several, we may take up to two more months and will tell you why within the first month.

Exercising your rights is free. If a request is clearly unfounded or excessive, the law allows us to charge a reasonable fee or refuse it. We may ask you to confirm your identity first, so that we do not give your data to someone else. If a legal limit applies to your request, we will explain it.

14. Complaints

We would like to resolve any concern with you directly, but you may complain to a data protection authority at any time, in particular where you live or work. In the Czech Republic this is the Úřad pro ochranu osobních údajů, Pplk. Sochora 727/27, 170 00 Praha 7, uoou.gov.cz, [email protected].

15. Automated decisions and profiling

We make no decisions about you based solely on automated processing, and we do not profile you.

16. Children

Our services are for businesses and are not aimed at children. If we learn that a child has sent us personal data, we will delete it unless the law requires us to keep it.

17. Information for people in Switzerland

We also work with businesses in Switzerland. If you are there, you have the rights given by the FADP in addition to those above, and you may contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

18. Links to other websites

This website links to other websites, such as those of our providers. They have their own privacy policies, and we do not control how they handle your data.

19. Changes to this policy

If the way we handle your data changes, we will update this page and its effective date. If a change affects you significantly and we have your contact details, we will tell you directly before it applies.

This policy is information the law requires us to give you. It is not a contract, and nothing in it limits any right you have under the law. Use of the website is covered separately by our terms of use.

20. Data controller and contact details

The controller of your personal data is Adam Branný, a sole trader registered in the Czech Republic and trading as Oryven Group. Oryven Group is a trading name and not a registered company. We have not appointed a data protection officer, because the law does not require one for a business of our size and activity.

Name

Adam Branný, trading as Oryven Group

Registered address

č.p. 1306, 739 95 Bystřice, Czech Republic

Business ID (IČO)

29864381

Email

[email protected]

Phone

+41 77 278 17 50