GDPR

2) What personal data we process and why

We process only data that are necessary to operate the website and to communicate with you. We do not use third‑party analytics or marketing tools, and we do not profile visitors.

2.1 Website operation & security

• Data: IP address, timestamp, requested URL, HTTP headers, error and security logs.
• Purpose: running, securing and troubleshooting the website.
• Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• Retention: typically 30–180 days in server logs.

2.2 Communication & enquiries

• Data: your name, e‑mail, phone number and message content that you voluntarily send to us (e.g., by e‑mail or phone; if a contact form is used, the same applies).
• Purpose: answering your enquiry, negotiating and performing a contract if applicable.
• Legal basis: performance of a contract / steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention: for the duration of our communication and up to 3 years afterwards to protect our rights and claims.

2.3 Legal obligations (if a contract is concluded)

• Data: billing and contractual data where required by law.
• Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).
• Retention: for the statutory periods (typically 5–10 years under Czech law).

3) Recipients and processors

We may share data with trusted service providers who help us run the website and our communications, such as:

• Hosting provider and infrastructure services
• E‑mail provider
• External IT support
• Accounting provider (if a contract is concluded)

With all processors we have appropriate data processing agreements in place and we verify their security standards. We primarily use providers with servers in the EU/EEA. If any transfers outside the EU/EEA occur, we rely on Standard Contractual Clauses and additional safeguards.

4) Cookies and similar technologies

We use only strictly necessary (technical) cookies required for the website to work (e.g., session or security cookies).

• No analytics cookies (e.g., Google Analytics)
• No marketing or remarketing cookies (e.g., Meta, Google Ads)
• No third‑party tracking pixels

4.1 Cookie overview

5) External links

Our website may contain links to third‑party websites (e.g., professional profiles or partners). Once you leave our site, their privacy practices apply.

6) How long we keep data

We keep personal data only for as long as necessary for the purposes described above, or for the time required by law, or until you successfully exercise your rights (such as erasure), as applicable.

7) Your rights

Under the GDPR, you have the right to access, rectification, erasure, restriction, data portability, and the right to object to processing based on our legitimate interests. Where processing relies on consent, you can withdraw your consent at any time. You also have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ).

How to exercise your rights: contact us at team@passdiplomacy.com. We will reply without undue delay, within 30 days at the latest.

8) Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (TLS), access control, logging and regular updates. Access to personal data is limited to authorised personnel and providers.

9) Changes to this notice

We may update this notice from time to time. The current version is always available on this page.

Effective date: 2 November 2025