CHOST
ČESKÝ WEBHOSTING
The controller of personal data is the operator of the CHOST.cz web service (hereinafter the "controller"):
The controller has not appointed a data protection officer (DPO), as its processing does not meet the conditions for mandatory appointment under Art. 37 GDPR.
Data processed: name, email address, subject and message text, IP address and time of submission.
Purpose: answering an inquiry or request sent via the form.
Legal basis: the controller's legitimate interest (Art. 6 para. 1 point f) GDPR) – the processing is necessary for communication with potential customers.
Retention period: messages are delivered by email to the controller and are not stored in a database. As a safeguard against message loss (e.g., during an email outage), every message including the IP address is also written to a backup file on the controller's server, from which it is automatically deleted no later than after 3 months. Email correspondence is kept for a maximum of 3 years from the last contact. The submission of the form itself creates a record in the traffic analytics (item 2.5), which, however, does not contain the content of the message.
Data processed: first and last name / business name, email address, billing address (street, city, postal code, country), Company ID (IČO), VAT ID (if provided), domain or server name, note.
Purpose: processing inquiries about hosting services, preparing and performing the contract, invoicing.
Legal basis: performance of a contract or taking steps prior to entering into a contract (Art. 6 para. 1 point b) GDPR); legal obligation (tax records, Art. 6 para. 1 point c) GDPR).
Retention period: for the duration of the contractual relationship and further for the period required by applicable legal regulations (tax records – 10 years from the end of the tax period).
Processed data: IP address, request URL, HTTP status code, user-agent, timestamp.
Purpose: ensuring the security and stability of server operation, detecting and preventing attacks.
Legal basis: legitimate interest of the controller (Art. 6 para. 1 point f) GDPR).
Retention period: 10 days from the record.
Data processed at the partner: customer account identification, partner code, date, time, IP address, and the version of the terms at the time of consent to the Partner Program Terms, as well as the record of rewards earned and their crediting to credit.
Data processed for a visitor who came through a partner link: in the click-through table (affiliate_clicks) we store the partner code, click time, landing page, the referring site's domain, and an irreversible hash of the IP address and browser string. We do not store the raw IP address or the user agent in this record; the IP address fingerprint is created by a one-way SHA-256 function with a secret key (pepper) and serves only to limit the number of writes from a single source (protection against artificial inflation of statistics). It is not possible to recover the IP address from the fingerprint. If a registration follows, the account stores information about which partner code the customer came through and when.
Purpose: operating the partner program – assigning referrals, calculating and documenting rewards, preventing abuse of the program.
Legal basis: performance of a contract (participation in the program, Art. 6 para. 1 point b) GDPR) and the controller's legitimate interest in protecting the program against abuse and in documenting paid rewards (Art. 6 para. 1 point f) GDPR); on this basis we process the server record of the click-through.
Cookie chost_ref: it is a first-party cookie, which by its nature is marketing, not technically necessary. It is stored on the device only if you yourself open a partner link in the form chost.cz/KOD – it is not created at all during a normal visit to the website – and it can be deleted in the browser at any time. If you choose “Decline” in the cookie bar (or do not allow the partner cookie in the settings), we delete the cookie and it will no longer be stored when a partner link is opened again. The click record described above is created even in that case; the partner coupon is then prefilled only into a cart you already have in progress (otherwise you can enter it in the cart yourself), and the referral is not assigned to the partner at registration. The website uses no advertising or third-party tracking, and we measure traffic with our own tool without cookies (point 2.5). Details and the validity period are in Cookie Information.
Retention period: we keep the click record for no longer than 12 months from the click (attribution is valid for 90 days, the rest of the period is a reserve for documenting and checking the reward resulting from the click); older records are deleted automatically by a daily job on the server. Data on the partner's consent and on credited rewards are kept for the duration of participation in the program and afterward for the period required by tax regulations for the related accounting documents.
Processed data:
Purpose: an overview of traffic and use of the website's content, detecting errors and non-working forms, distinguishing bots and protection against abuse, improving the offering and the order process.
Legal basis: the controller's legitimate interest in operating, securing and improving the website (Art. 6 para. 1 point f) GDPR). The measurement is our own, uses no cookies or other storage of data on your device, and we do not use the data for advertising or profiling. You can object to this processing at [email protected].
Retention period: records of visits, clicks, technical events and cart records for 90 days, records of submitted forms and server error reports for 30 days, supplementary IP address data for 90 days from when it was determined. Older records are deleted automatically by a daily job on the server.
Recipients: the data is processed only by the controller on its own servers and is not passed on to anyone. Requests to the website pass through the Cloudflare network, which processes them as a processor (see point 3).
Personal data is not passed to third parties for marketing purposes or sold. We do not pass traffic measurement and cart tracking data (point 2.5) to anyone. The controller may share necessary data with:
The controller does not transfer personal data to third countries outside the European Economic Area, except for data passing through Cloudflare (see point 3). Cloudflare processes data on the basis of standard contractual clauses (SCC) and EU-US Data Privacy Framework certification.
You have the right to:
Send requests to exercise your rights to: [email protected]. The controller will respond without undue delay, at the latest within 30 days.
The controller does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.
The controller has adopted appropriate technical and organizational measures to protect personal data:
Detailed information about the use of cookies can be found in a separate document: Cookie information.
The controller reserves the right to update these policies at any time. The date of the last change is stated in the document header. Material changes will be announced on the website.