top of page

XELA studio.

Privacy Policy

I. Basic provisions

  1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) is:
    XELA studio s.r.o.
    Company ID No.: 29740568
    VAT ID No.: CZ29740568
    Registered office: Pernerova 727/40a, Karlín, 186 00 Prague 8, Czech Republic
    The company is registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 451633.
     

  2. Contact details of the controller:
    Address: Pernerova 727/40a, Karlín, 186 00 Prague 8, Czech Republic
    E-mail: office@xelastudio.cz
    Website: xelastudio.cz
     

  3. Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to a name, contact details, identification number, location data, online identifier, or other data relating to their identity.
     

  4. The controller has not appointed a Data Protection Officer unless required to do so under applicable law.

II. Sources and Categories of Personal Data Processed

  1. The controller processes personal data that you provide, in particular:

    • through the contact form on the website,

    • during telephone, e-mail, or in-person communication,

    • in connection with enquiries regarding marketing, advertising, creative, or related services,

    • when entering into and performing a service agreement,

    • in connection with marketing campaigns, content creation, social media management, website development, and the production of photography, video, and podcasts,

    • when subscribing to marketing communications, where this option is available.
       

  2. The controller may process, in particular, the following categories of personal data:

    • identification data, in particular your first and last name,

    • contact details, in particular your telephone number, e-mail address, and postal address,

    • billing information and data necessary for entering into and performing a contract,

    • information provided through the contact form or other communications,

    • data related to the provision of the services ordered,

    • photographs, audiovisual recordings, and other content containing personal data where processed as part of the services provided,

    • data necessary for compliance with the controller’s legal obligations,

    • technical data related to the use of the website, in particular IP addresses, cookie identifiers, and information about interactions with the website, where such processing is permitted by applicable law or based on your consent.
       

  3. To the extent necessary, the controller may also obtain personal data from publicly available sources, in particular the Commercial Register, Trade Licensing Register, publicly available professional profiles, and websites, where such processing is necessary for a specific legitimate purpose and carried out in accordance with applicable law.

III. Legal Basis and Purpose of Personal Data Processing

  1. The legal bases for the processing of personal data include, in particular:

    • performance of a contract or taking steps at your request prior to entering into a contract pursuant to Article 6(1)(b) of the GDPR,

    • compliance with a legal obligation to which the controller is subject pursuant to Article 6(1)(c) of the GDPR,

    • the legitimate interests of the controller pursuant to Article 6(1)(f) of the GDPR, in particular the protection of legal claims, ensuring website security, and appropriate communication with customers,

    • your consent pursuant to Article 6(1)(a) of the GDPR, where consent is required for a specific processing activity.
       

  2. The purposes of processing personal data include, in particular:

    • responding to your enquiries or requests submitted via the contact form, e-mail, or telephone,

    • preparing proposals and conducting negotiations prior to entering into a contract,

    • providing marketing, advertising, creative, and production services,

    • managing and implementing marketing campaigns and related projects,

    • managing business and contractual communications,

    • issuing invoices and complying with accounting and tax obligations,

    • protecting the rights and legitimate interests of the controller,

    • sending marketing communications where the applicable legal requirements are met,

    • analysing website traffic and evaluating the effectiveness of marketing activities where such processing is permitted by applicable law or carried out on the basis of your consent.
       

  3. The provision of personal data is voluntary. However, certain personal data may be necessary in order to process your enquiry, enter into a contract, or provide the requested services.
     

  4. The controller does not carry out automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.

IV. Retention Period of Personal Data

  1. The controller retains personal data only for as long as necessary to fulfil the purposes for which it is processed, in particular:

    • data submitted through contact forms and ordinary communications for the period necessary to respond to an enquiry or request, generally no longer than 3 years from the date of the last communication, unless the communication results in a contractual relationship,

    • data related to a contractual relationship for the duration of that relationship and subsequently for the period necessary to protect and enforce legal claims,

    • accounting and tax records for the period required by applicable legislation,

    • personal data processed on the basis of consent for the period for which the consent was granted, but no longer than until the consent is withdrawn, unless another legal basis exists for its continued processing,

    • personal data processed on the basis of legitimate interests for as long as those legitimate interests continue to apply, but no longer than until an appropriate legal basis for such processing ceases to exist.
       

  2. Upon expiry of the applicable retention period, personal data will be deleted or anonymised unless its continued retention is required by applicable law.

V. Recipients of Personal Data

  1. Recipients of personal data may include individuals and companies involved, in particular, in:

    • providing legal, accounting, and tax services,

    • providing marketing, advertising, graphic design, and production services,

    • managing social media, advertising accounts, and marketing campaigns,

    • photography, audiovisual, and podcast production,

    • developing, operating, and maintaining the technical security of websites,

    • providing hosting, cloud, analytics, communication, or marketing services,

    • managing information systems and databases.
       

  2. To the extent necessary, personal data may also be disclosed to cooperating suppliers and professionals, in particular photographers, videographers, graphic designers, developers, marketing specialists, or other individuals involved in delivering the services ordered.
     

  3. In connection with the operation of the website and the provision of services, personal data may be processed through external technology platforms, including providers of web, e-mail, cloud, analytics, and advertising services.
     

  4. The controller does not disclose personal data to third parties for their own independent marketing purposes unless there is an appropriate legal basis for doing so.
     

  5. In connection with the use of certain technology, cloud, analytics, or marketing services, personal data may be transferred outside the European Union or the European Economic Area. Any such transfer will take place only in accordance with the requirements of the GDPR, in particular on the basis of an adequacy decision, Standard Contractual Clauses, or other appropriate safeguards.

VI. Your Rights

  1. Subject to the conditions set out in the GDPR, you have:

    • the right of access to your personal data pursuant to Article 15 of the GDPR,

    • the right to rectification of inaccurate personal data or completion of incomplete personal data pursuant to Article 16 of the GDPR,

    • the right to erasure of personal data pursuant to Article 17 of the GDPR,

    • the right to restriction of processing pursuant to Article 18 of the GDPR,

    • the right to data portability pursuant to Article 20 of the GDPR,

    • the right to object to processing pursuant to Article 21 of the GDPR,

    • the right to withdraw your consent to the processing of personal data at any time where the processing is based on consent.
       

  2. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
     

  3. You may exercise your rights by contacting us at office@xelastudio.cz or in writing at the controller’s registered office.
     

  4. You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe that the processing of your personal data infringes applicable data protection legislation.

VII. Security of Personal Data

  1. The controller implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, loss, destruction, damage, or unauthorised access.
     

  2. Access to personal data is limited to the controller and authorised persons who require such access in order to perform their professional or contractual duties.
     

  3. Persons who are granted access to personal data are required to maintain confidentiality and comply with the applicable security measures.

VIII. Contact Form and Website

  1. Through the contact form, we may process, in particular, your first name, last name, e-mail address, telephone number, and the content of your message, depending on the information you choose to provide.
     

  2. This data is processed for the purpose of responding to your enquiry or request and, where applicable, for taking steps towards the provision of marketing, advertising, creative, or related services.
     

  3. By submitting the contact form, you are not giving consent to these Privacy Policy terms. You simply acknowledge that the controller will process the personal data you provide in the manner described in this document.
     

  4. The website may use cookies and similar technologies to ensure its proper functioning, analyse website traffic, and evaluate marketing activities.
     

  5. Cookies that are not strictly necessary for the operation of the website are used only with your consent, unless otherwise permitted by applicable law. You may change or withdraw your consent at any time through the cookie settings available on the website.
     

  6. More detailed information about the cookies used, their purposes, and retention periods is available in the cookie settings on the website.

IX. Final Provisions

  1. The controller is entitled to update this Privacy Policy, in particular in the event of changes to applicable legislation, the services used, or the manner in which personal data is processed.
     

  2. The current version of this Privacy Policy will always be available on the website xelastudio.cz.
     

  3. This Privacy Policy is effective as of 23 September 2026.

bottom of page