Clear about your data.

This Privacy Policy applies to website visitors, representatives of brands and agencies, potential clients and business contacts. It describes what information may be processed, why it is needed, how it may be shared and the choices available to the people concerned.

The controller responsible for the processing described in this policy is:

Legal name

…

Trading name

Sofiya

IČO

…

Registered address

…

Business email

…

Country

Czech Republic

The Project brief form may collect:

• name and work email;
• brand or company name;
• selected package and intended content usage;
• requested target date and project description;
• any additional information voluntarily entered in the brief.

Later correspondence, contract and invoicing details, and information required to prepare and deliver a project may also be processed. The website infrastructure may generate limited technical server logs needed to operate and protect the site. The exact content of those logs depends on the confirmed hosting infrastructure; this policy does not assume collection of specific device identifiers or tracking profiles.

• reviewing and replying to enquiries;
• preparing proposals, quotations and project scopes;
• taking steps requested before entering into a contract;
• managing agreed UGC projects and client communication;
• invoicing, accounting and compliance with legal obligations;
• protecting the website against fraud, misuse and technical attacks;
• establishing, exercising or defending legal claims.

Depending on the context, processing is based on steps taken at your request before entering into a contract, performance of a contract, compliance with legal obligations, or legitimate interests in running the business, communicating with clients, securing the website and protecting legal rights. Where legitimate interests are relied on, they are considered against the interests and rights of the person concerned.

The Project brief form does not request marketing consent because information submitted through it is not used for unrelated promotional messages.

Personal data may be processed by providers needed to operate the website and business, such as a website hosting provider, email provider, form delivery or backend provider, accounting provider, and legal or professional advisers where required. Access should be limited to what each recipient needs for its role, and processors should act under appropriate contractual and confidentiality obligations.

Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

Some service providers may process personal data outside the European Economic Area. If that occurs, an applicable lawful transfer mechanism should be used, such as a European Commission adequacy decision or Standard Contractual Clauses, together with any additional safeguards required for the transfer.

• Unsuccessful or inactive enquiries are generally retained for no longer than 12 months, unless a longer period is reasonably needed for follow-up or legal claims.
• Project and contract records are retained for the duration of the relationship and applicable limitation periods.
• Invoices and accounting records are retained for the period required by Czech law.
• Correspondence relevant to legal claims may be retained for the relevant limitation period.

Data may be deleted or anonymised earlier where it is no longer needed and no legal reason requires its retention.

Reasonable organisational and technical measures are used to reduce the risk of unauthorised access, loss, misuse or alteration. No website or transmission method can guarantee absolute security, and the measures used should be reviewed as the technical setup changes.

Subject to the conditions and limits in applicable law, you may have the right to:

• request access to personal data;
• request correction of inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• receive or transfer certain data where data portability applies;
• withdraw consent where a specific processing activity is based on consent;
• lodge a complaint with the competent supervisory authority.

The competent Czech supervisory authority is the Office for Personal Data Protection of the Czech Republic — Úřad pro ochranu osobních údajů. You are encouraged to contact the controller first so the concern can be reviewed directly.

Information submitted through the Project brief form is not added to a mailing list and is not used to send unrelated marketing messages.

This website does not intentionally use analytics, advertising or marketing cookies. Strictly necessary technical technologies may be used to provide the website, protect it against misuse and enable the enquiry form to function.

If analytics, advertising pixels, embedded third-party content or other non-essential technologies are introduced in the future, this policy and the website’s consent mechanism will be updated before those technologies are activated.

The website links to Instagram, TikTok and other external platforms. Those services operate independently and apply their own privacy notices and terms. Visiting an external link is subject to the practices of that provider.

This policy may be updated when the website, service providers, business processes or legal requirements change. The revised version will be published here with an updated date.

To ask a privacy question or exercise a data protection right, contact Sofiya at …. Sufficient information may be requested to verify identity before responding to a request.