Privacy policy
Effective 31 October 2026This page explains which personal data we process when you write to us through a form, when you visit the website, and when we contact a company that our work could help. It describes the situation as of 31 October 2026.
Controller and contact
The controller is Adam Kropáček, a sole trader, company ID (IČO) 19985258, place of business Vysoká nad Labem 222, Czech Republic. We provide our services under the KESTIR brand.
Contact: info@kestir.co for kestir.co and info@kestir.cz for kestir.cz.
We have not appointed a data protection officer. Questions about your data go to the controller directly.
Personal data of clients that we will process for their business will be governed by a separate contract. This page covers website visitors, people who write to us, and the companies we contact.
What we process, why and for how long
We process data only for the purposes listed in the table. When the period ends, we delete or anonymise the data.
| Activity | Data | Legal basis | Retention |
|---|---|---|---|
| Enquiry through the form on the website | name, job title, company, work e-mail, annual revenue band, optional message, page and language of the form | Steps at your request before entering a contract (Art. 6(1)(b) GDPR) | 12 months after the last contact if no work starts, then deleted |
| Form submission filled in by a bot (hidden field) | form content | Protection against spam (legitimate interest, Art. 6(1)(f) GDPR) | 30 days |
| Communication after an enquiry | e-mails, call notes, agreed times | Steps before entering a contract (Art. 6(1)(b) GDPR) | 12 months after the last contact |
| Contacting companies from public sources | name and role, work e-mail, company name, company ID, data from public registers | Legitimate interest (Art. 6(1)(f) GDPR), see section 3 | 12 months without a reply, then deleted or anonymised |
| E-mails sent and received in campaigns | text, subject, reply | Legitimate interest (Art. 6(1)(f) GDPR) | 12 months after the last message |
| Opt-out list | e-mail address, date, reason and source of the entry (opt-out or undeliverable address) | Handling your objection (Art. 21 GDPR) | Kept indefinitely, so that we do not write to you again |
| Own measurement of website use | pages, time on page, depth of reading, clicks on links, referring website, country, device and browser type; no IP address and no cookies in this measurement | Legitimate interest (Art. 6(1)(f) GDPR) | 14 months |
| Technical server logs | IP address, time, page address, browser type, referring page | Operation and security of the website (legitimate interest) | At most 30 days |
| Limit on form submissions | IP address and number of attempts | Protection against abuse (legitimate interest) | 2 days |
| Sign-in to the administration portal | e-mail, IP address, browser type, time and result of sign-in | Security (legitimate interest) | 180 days |
We use data from an enquiry only to reply and to arrange a call. We do not sell it and do not use it for third-party advertising.
Companies we contact
We contact companies that we expect could benefit from work with artificial intelligence. We find them in public sources and our own contacts: open data of the Czech Statistical Office, the public register and the collection of deeds (justice.cz and dataor), the register of contracts, the register of VAT payers, the insolvency register, job ads on jobs.cz, the company registers of the UK and Norway, company websites, search results on Seznam.cz and business contacts obtained earlier.cz.
From these sources we take company data (name, company ID, registered office, sector, size, figures from published financial statements) and the names of people entered in public registers, such as statutory bodies and shareholders. From a company's website we take the name and role of a person listed there as a contact, and an e-mail address if it is published there. We do not invent or guess e-mail addresses from a pattern.
Our outreach is a business offer. We rely on our legitimate interest in offering a company a service that may help it (Art. 6(1)(f) GDPR).
This page describes how we process data about the companies and people we contact. If you received an e-mail without a link to it, we will send it to you on request.
You have the right to object (Art. 21 GDPR). Just reply to the e-mail with the word stop or unsubscribe. We add your address to the opt-out list and from then on send you no business e-mails. A person reads and handles all other replies.
Measurement and cookies
We do not set cookies on the public pages of the website and do not use browser storage for measurement. There is no consent banner on the website.
Our own measurement runs on our server. It records which pages you visited, how long you read each section, what you clicked, where you came from (the domain of the referring website and the campaign name from the link), the country suggested by the IP address, device type, browser and operating system. We do not record what you type into a form; sending a form is recorded only as an event.
We do not store IP addresses in these statistics. A random daily key, the IP address and browser details produce a pseudonymous code that counts visitors per day. The key is deleted every day, so a code from a previous day cannot be linked to an address or to you.
Our own measurement respects Do Not Track and Global Privacy Control signals: when either is switched on, it sends nothing. This does not apply to Google Analytics 4. Known bots are not recorded. Data from our own measurement is kept for 14 months and then deleted.
Google Analytics 4 (measurement ID G-DGL27DY5DE) is loaded on the website. It is set to denied consent, so it does not use cookies. Google nevertheless receives a technical request with visit data, including the IP address, each time a page loads. We do not evaluate data about individual visitors in this tool. If you do not want it to load, block the domains google-analytics.com and googletagmanager.com in your browser or with a content blocker.
Server logs: for each request the server records the IP address, time, page address, browser type and referring page. We keep these logs for at most 30 days, then they are deleted automatically. We do not write sign-in data or cookies into them.
Who receives the data
We pass data to these recipients.
| Recipient | What it does for us | Country |
|---|---|---|
| Contabo GmbH | Rents the servers on which the website, the portal and the sending of e-mails run | Germany and France |
| Google (Gmail) | Delivers enquiries and e-mails sent to the info@ and adam@ addresses at kestir.co and kestir.cz | USA |
| Google (Google Analytics 4) | Website measurement through a tag, without cookies (see section 4) | USA |
| Google (Gemini API, free tier) | Writes the opening sentence and the salutation of e-mails from the text of a company's website | USA |
| Anthropic, PBC | Sorts replies to e-mails, prepares audits from public sources and reads company websites | USA |
| PlusVibe | Sends e-mail campaigns and stores recipients and replies | Location being verified |
| ntfy.sh | Sends the controller an alert about a new reply, with the company name and the start of the reply | Location being verified |
Only the controller has access to the portal and its databases.
Transfers outside the EU
Google and Anthropic process data in the USA under their terms of service. We are verifying where PlusVibe and ntfy.sh process data.
We also send Anthropic's services the names of people from public sources and the text of e-mail replies. We sent the free tier of Gemini website text and the names of people for salutations, and Google may use them to improve its services.
Your rights
You have the right to:
- access to the data we hold about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure of data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability in a machine-readable form (Art. 20 GDPR),
- object to processing based on legitimate interest, including receiving commercial e-mails (Art. 21 GDPR). After an objection we stop contacting you without undue delay.
Exercise your rights by e-mail to info@kestir.co or info@kestir.cz. We reply within one month, and in justified cases within three months at the latest (Art. 12(3) GDPR).
You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.
Automated decisions and changes to this page
We make no decisions with legal effects or similarly significant effects based solely on automated processing. AI sorts replies to e-mails and prepares drafts and notices. E-mail sequences that we have approved are sent on schedule, but a person answers the replies.
If we change how we process data, we update this page and state the effective date. The version in force is dated 31 October 2026.