1. Data Controller
The controller of personal data processed through the KN Risk Advisory website is:
Klára Nováková
registered office / place of business: [to be completed]
Business ID: [to be completed if assigned]
email: [email protected]
If you have any questions concerning the processing of your personal data, you may contact the Controller directly at the email address above.
2. Personal Data We Process
The contact form contains three required fields:
- name,
- email address,
- message.
You may also provide the following information voluntarily:
- organisation,
- telephone number.
The form also transmits information about the language version of the website and technical information required to protect the form against automated submissions.
When you use the website, certain technical information may also be processed, including your IP address, the time of the request and information about your browser or device. This processing is related to the operation and security of the website.
Please do not submit sensitive personal data through the contact form unless it is necessary for your specific enquiry.
3. Why We Process Personal Data
Personal data submitted through the contact form is used to respond to enquiries or requests, conduct follow-up communication and, where relevant, prepare a proposal or discuss potential cooperation.
Where the communication concerns our services or possible future cooperation, the legal basis is Article 6(1)(b) GDPR, namely taking steps at your request prior to entering into a contract.
For other general enquiries, the legal basis is Article 6(1)(f) GDPR. The legitimate interest pursued by the Controller is the ability to receive and respond to incoming communication.
Technical information required to operate and secure the website and protect the contact form is also processed under Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website and protection against misuse.
Personal data submitted through the contact form is not used for newsletters, advertising messages or other direct marketing.
Consent to the processing of personal data is therefore not required for the purposes described above.
4. How the Contact Form Works
Information submitted through the contact form is not stored in a separate website database or spreadsheet.
After the form is submitted, the following processing takes place:
- The form is sent through Cloudflare's infrastructure, which provides website hosting, technical processing of the form and security services.
- Cloudflare Turnstile checks whether the submission is likely to come from a human visitor rather than an automated system. For this purpose, it processes technical signals including the visitor's IP address, browser and device information and other information required to detect automated traffic. Turnstile does not process the content entered into the contact form.
- The message is passed to Resend, which sends it as an email.
- The email is delivered to [email protected], a mailbox hosted by WEDOS Internet, a.s.
The website application does not store the content of the contact form in its own database or application logs.
5. Service Providers and Recipients
The following service providers are used in connection with the website and contact form:
Cloudflare, Inc.
Cloudflare provides website hosting, network infrastructure, security services and Cloudflare Turnstile. During normal operation, it may process technical information such as IP addresses, request timestamps and browser or device information.
Plus Five Five, Inc. (Resend)
Resend sends contact form submissions to the Controller by email. It therefore processes the information entered into the form, the contents of the message and technical information required for email delivery.
WEDOS Internet, a.s.
WEDOS provides the email mailbox in which delivered messages are stored.
These providers may use additional sub-processors where necessary to provide their services.
Personal data may also be disclosed to public authorities where required by applicable law.
6. Transfers Outside the European Economic Area
Cloudflare, Inc. and Plus Five Five, Inc. are companies established in the United States. Their services may therefore involve the transfer or processing of personal data outside the European Economic Area.
Both providers state that they participate in the EU-U.S. Data Privacy Framework. Their contractual documentation also incorporates the European Commission's Standard Contractual Clauses where these are required for international transfers of personal data.
Resend states that its primary customer data processing operations take place in the United States.
Further information about the safeguards used for international transfers is available in the data processing documentation published by the respective providers. Information about the applicable safeguards may also be requested from the Controller.
WEDOS Internet, a.s. is a Czech service provider operating within the European Union legal framework.
7. How Long We Keep Personal Data
Messages stored in the Controller's email mailbox are retained for as long as necessary to respond to the enquiry and conduct any related follow-up communication.
If the communication does not result in further cooperation or a contractual relationship, the message is manually deleted from the mailbox no later than 12 months after the last related communication.
If the communication results in a contractual relationship, relevant personal data may be retained for the duration of that relationship and subsequently for as long as necessary to comply with legal obligations or to establish, exercise or defend legal claims.
According to its current terms, Resend normally retains email content and related log data for 30 days on its Free, Pro and Scale plans.
Technical backup copies may remain with individual service providers for a limited period in accordance with their own backup and retention procedures.
8. Cookies and External Services
The website does not use Google Analytics, advertising pixels or other tools intended to track visitors for analytics or marketing purposes.
It does not load Google Fonts from external servers and does not embed YouTube videos or third-party map services. Fonts are hosted directly on the website.
Cloudflare and Cloudflare Turnstile use technical mechanisms required to operate and protect the website. They are not used by KN Risk Advisory for advertising or marketing profiling.
Links to LinkedIn, including links used to share content, are standard external links. Information is transferred to LinkedIn only after a visitor chooses to open such a link.
In its current configuration, the website does not use analytics or marketing cookies or comparable tracking technologies that require the visitor's prior consent.
9. Is Providing Personal Data Mandatory?
Using the contact form is voluntary.
Your name, email address and message are required so that the Controller can receive, understand and respond to your enquiry.
The organisation and telephone number fields are optional. You can submit the form without providing this information.
10. Your Rights
Subject to the conditions set out in the GDPR, you have the right to request access to your personal data and correction of inaccurate information. Where the legal requirements are met, you may also request deletion of your personal data or restriction of its processing.
Where applicable, you may exercise the right to data portability.
You have the right to object to processing based on the Controller's legitimate interests under Article 6(1)(f) GDPR.
Requests may be sent to [email protected].
If you believe that your personal data is being processed unlawfully, you also have the right to lodge a complaint with the Czech supervisory authority:
Office for Personal Data Protection
Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
email: [email protected]
11. Automated Decision-Making and Security
Personal data obtained through the contact form is not used for automated individual decision-making or profiling within the meaning of Article 22 GDPR.
The Controller takes appropriate technical and organisational measures to protect personal data. The website uses encrypted data transmission and Cloudflare services to protect it against automated and malicious traffic.
12. Changes to this Privacy Notice
This Privacy Notice will be updated if the way personal data is processed or the services used by the website change.
If analytics, externally hosted content or another service processing visitor information is introduced in the future, this Privacy Notice will be updated accordingly before or when such processing begins.
Effective from: 12 October 2026