Privacy policy
Who is the controller?
The controller of your personal data is SUN Professionals s.r.o., Company ID 27159884, registered office K Dolům 1714/37, Modřany, 143 00 Prague, Czech Republic (this is the company's registered address, not a walk-in office — meetings are arranged in advance), which operates the Iterus brand. For data-protection matters contact tomas@iterus.cz. We are not required to appoint a data protection officer and have not appointed one.
What data do we process, why and for how long?
- Contact form — name, e-mail address and the text of your message. The message is delivered
only to our company mailbox; the website does not store it in a database.
- Purpose and legal basis: answering your enquiry and discussing a possible engagement — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest in handling the enquiry).
- Retention: if the enquiry does not lead to an engagement, we delete the correspondence no later than 12 months after the last message. If it does, retention follows the section on clients below.
- Providing the data is voluntary, but without a name, e-mail address and message we cannot reply.
- Protecting the form against spam and abuse — the Contact page loads Cloudflare Turnstile, which checks that you are a human. It processes your IP address, browser data (User-Agent, a fingerprint of the encrypted connection) and the page address; it does not read the form contents. When you submit the form, we also hold your IP address only in server memory for 10 minutes to limit the number of submissions from one address; we do not store it anywhere. After that period the server deletes it at the next form submission it handles, and at the latest it disappears when the server instance shuts down. Legal basis: legitimate interest in protecting the website and our mailbox against abuse (Art. 6(1)(f) GDPR).
- Visitor statistics — Cloudflare Web Analytics collects anonymous statistics (pages loaded, loading speed). It uses no cookies or other on-device storage and does not identify individual visitors. Legal basis: legitimate interest in improving the website (Art. 6(1)(f) GDPR).
- Operational logs — the hosting platform Vercel records technical data about every request (IP address, browser, requested address, time) to keep the service running and secure, and keeps it for a limited period under its own terms. Our own logs contain only error events (for example a message that could not be delivered) without personal data from the form. Legal basis: legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
- Clients and their contact persons — if you enter into a contract with us, we process the
names, business contact details and billing details of you or your contact persons and the
correspondence about the engagement.
- Purpose and legal basis: performance of the contract (Art. 6(1)(b) GDPR), compliance with accounting and tax obligations (Art. 6(1)(c)) and protection of our legal claims (Art. 6(1)(f)).
- Retention: for the term of the contract and then for the limitation periods (usually 3 years unless agreed otherwise); accounting and tax documents for as long as accounting and tax law requires (up to 10 years).
- Link to book a meeting — if the Contact page offers booking a meeting via Cal.com, the data you enter after opening that link is processed by Cal.com as an independent controller under its own policy.
We do not carry out automated decision-making or profiling with legal or similarly significant effects. The Turnstile check only tells a human from an automated program.
Does the website use cookies?
The website itself stores no cookies or other data on your device — the language is given by the page address. The Turnstile widget on the Contact page may store technical data needed to detect automated programs; it serves solely to secure the form you are submitting, so it does not require consent (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications).
Who has access to the data?
The data is processed by these processors, who run the website and e-mail for us:
- Vercel Inc. (USA) — website hosting. The website runs in the Frankfurt region, but the company also processes operational data in the USA.
- Plus Five Five, Inc., trading as Resend (USA) — delivering form messages to our mailbox. Messages are sent from the EU region (Ireland); sending metadata and logs are stored in the USA.
- Cloudflare, Inc. (USA) — form protection (Turnstile) and visitor statistics (Web Analytics). Cloudflare also uses Turnstile data, to a limited extent, as an independent controller to improve its detection of automated programs (Cloudflare's Turnstile privacy addendum).
- Migadu-Mail GmbH (Switzerland) — our mailbox, where the messages arrive.
For clients, providers of the accounting services and systems we use for bookkeeping also have access to billing and contract data, to the extent needed to meet our obligations.
We do not sell the data and do not pass it to any other recipients unless the law requires us to.
Do we transfer data outside the EU?
Yes. Vercel, Resend and Cloudflare are based in the USA. All three are listed in the EU-U.S. Data Privacy Framework programme, for which the European Commission adopted an adequacy decision, and their data processing agreements also include the Standard Contractual Clauses approved by the European Commission — these protect the transfer independently of the certification status. Switzerland, where Migadu is based, is covered by a European Commission adequacy decision. We will provide a copy of the relevant safeguards on request.
What are your rights?
You have the right of access to your data, to rectification or erasure, to restriction of processing and to data portability. Send requests to tomas@iterus.cz; we reply within one month.
Right to object: you may object at any time to processing based on legitimate interest (Art. 6(1)(f) GDPR). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.
You can lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
Changes to this policy
This version is effective from 23 September 2026. We publish changes on this page and give each version the date from which it applies.