Who processes the data

The data controller is Jan Pala, Klecany 343, 250 67 Klecany, Czech Republic. Contact e-mail: [DOPLNIT — kontaktní e-mail provozovatele]. The operator has not appointed a data protection officer (and is not required to).

Comments under articles

  • What data: name or nickname (required), e-mail (optional, never published) and the text of the comment.
  • Purpose: discussion under the article and the option to reply to you.
  • Legal basis: your consent given by submitting the comment, which you can withdraw at any time — write to us and we will delete the comment. [DOPLNIT — to be confirmed with a lawyer: consent or legitimate interest.]
  • Retention: as long as the comment is on the site. There is no automatic deletion; you can ask for removal at any time.
  • A comment is not published straight away — the editors approve it first. Unpublished comments stay in the admin only.
  • We do not store the IP address with a comment. Comments imported from the old site came without e-mails and without IP addresses.
  • Recipients: hosting and database (Railway), e-mail notification to the editors (Resend). We pass comments to no one else.

Contact form

  • What data: name, e-mail, topic and the text of the message.
  • Purpose: replying to your message.
  • Legal basis: legitimate interest in handling an enquiry you send us yourself. [DOPLNIT — to be confirmed with a lawyer.]
  • The message is not stored in the site database. It is sent to the editors by e-mail (via Resend) and then lives only in the recipient's mailbox.
  • Retention: [DOPLNIT — how long the operator keeps e-mails from the form].
  • Recipients: Resend (sending the e-mail), the editors' mail provider [DOPLNIT — which one].

Event sign-ups via Google Forms

  • Event invitations (Setkání skialpinistů, Pelikánův seminář and similar) embed a Google Form in the article. What you fill in goes straight to the organiser's Google account, not to our server.
  • What data: whatever that form asks for — usually name, e-mail, phone and accommodation details. The scope is set by the organiser.
  • The controller of this data is the event organiser, with Google as the processor. [DOPLNIT — confirm who the organiser and controller is for each event.]
  • The form does not load on the site until you allow Google Forms in the cookie settings.

E-mail notifications to the editors

Every new comment and every message from the contact form is e-mailed to the editors so they can approve or reply. The e-mail is sent by Resend, Inc., which sees the message and stores it for the time needed to deliver it. The content goes to no one else, and the site sends no newsletter or bulk mail.

Running and securing the site

  • The forms (comment, contact) are protected by Cloudflare Turnstile. Verification sends your IP address and a technical token to Cloudflare — without it the forms would drown in spam.
  • Signing in to the admin uses the `ms_admin` cookie. The database holds only a derived (hashed) form of it, never the cookie value itself.
  • On a failed admin sign-in the site stores the IP address the attempt came from, so that password guessing can be blocked.
  • Photos and files live in Cloudflare R2; the application and database run on Railway. Both providers keep technical operational logs that may contain an IP address. [DOPLNIT — verify how long Railway and Cloudflare keep them.]
  • Legal basis: legitimate interest in keeping the site working and free of abuse.

Third-party embedded content

Older articles embed videos, maps and forms from YouTube, Vimeo, Google Maps, Google Forms, Mapy.cz and Czech Television's iVysílání. Until you allow a service, the server renders only a placeholder instead of the frame and no request goes to the other domain — so the provider does not learn about your visit. Once allowed, the frame loads and the provider receives your IP address and browser details and may store its own cookies; details are on the Cookies page.

Transfers outside the EU

The processors Railway, Cloudflare, Resend and Google are US companies or keep part of their infrastructure in the US, so data may be transferred outside the EU under standard contractual clauses or the EU–US Data Privacy Framework. [DOPLNIT, OVĚŘIT — for each service, add where the data sits and on what legal basis it is transferred; check the Railway database region.]

Your rights

  • The right of access to the data we hold about you.
  • The right to rectification of inaccurate data.
  • The right to erasure (“to be forgotten”) — typically deleting a comment.
  • The right to restriction of processing.
  • The right to object to processing based on legitimate interest.
  • The right to data portability.
  • The right to withdraw consent at any time — for embedded content via “Cookie settings” in the footer, for a comment by writing to the editors.
  • The right to lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) if you believe the processing is not right.

Send requests about your rights to [DOPLNIT — kontaktní e-mail provozovatele]. We reply within one month at the latest.