Cookie Policy

1.What this document is for

1.1 This policy describes what we store on your device on the marketing website buildify.cz, in the web application cde.buildify.cz and on the identity server api.buildify.cz. The operator is Buildify Digital s.r.o., Company ID 29541743, registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic.

1.2 A cookie is a small file a website stores in your browser and reads back on your next visit. The same rules apply to similar technologies - local storage, session storage and tracking pixels in e-mails. Where we write "cookies" below, we mean those too.

1.3 Two legal frameworks apply. Storing and reading data on your device is governed by Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications. The subsequent processing of personal data is governed by the GDPR. The processing detail is in our Privacy Policy.

1.4 The Czech Republic operates a prior consent regime: anything not strictly necessary to deliver the service you asked for may be stored only after you have consented. Essential cookies need no consent.

2.Categories and how you decide about them

2.1 Essential. Without them the site or the application does not work. They keep you signed in, remember which Organisation you have selected, protect forms against abuse, and carry the record of your consent choice. They cannot be switched off - without them you could not sign in, and we could not even remember that you refused measurement.

2.2 Analytics. They measure how many people visit the site and which pages actually help. Refusing costs you nothing - we simply learn less about you.

2.3 Marketing. They measure advertising performance and attribute a visit to a campaign. Refuse them and you may still see ads, but they will not be targeted by your behaviour.

2.4 You decide about each category separately. We do not bundle analytics and advertising into a single tick - they are different purposes, and consent to one is not consent to the other.

2.5 Refusing is exactly as easy as accepting. The banner shows "Accept all" and "Reject all" side by side, at the same size and with the same emphasis, both in the first layer. Neither is preselected, and no optional switch is on by default. Closing the banner or continuing to browse is not consent.

3.What exactly we store

3.1 The marketing website buildify.cz:

3.2 buildify-cookie-consent is not a cookie but an entry in the browser's local storage. It is never sent to a server and carries only your choice, the time, and the list of processors it covered.

3.3 Apart from the consent record, nothing in this table is stored before you allow the relevant category in the banner. The Google, PostHog and Meta scripts are not inserted into the page at all until you consent - we do not load them "in advance" and delete them afterwards.

3.4 The application cde.buildify.cz and the identity server api.buildify.cz:

3.5 In the application and on the identity server we run no analytics or advertising tool whatsoever. We do not track which folders and documents you move through, and we do not use application data for advertising.

4.Who receives the data and where it goes

4.1 Essential cookies are processed by us alone. They never leave our infrastructure.

4.2 Analytics cookies are processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor within Google Analytics 4, and by PostHog Inc., whose data is stored in the EU (Frankfurt). Processing by Google may involve a transfer to the United States. That transfer relies on the European Commission's adequacy decision (the EU–US Data Privacy Framework) and, additionally, on standard contractual clauses.

4.3 Marketing cookies are processed by Google Ireland Limited within Google Ads and by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, within the Meta Pixel. For collecting data with the Meta Pixel and passing it to Meta we are joint controllers together with Meta; Meta's further processing is governed by Meta's own policies. Here too, data may be transferred to the United States under the EU–US Data Privacy Framework and, additionally, standard contractual clauses.

4.4 We do not send your name, e-mail, phone number or the content of your message from the forms into analytics - only the form type and the page it was sent from. Only with a marketing consent do we pass the e-mail from a sign-up to Google Ads, hashed (SHA-256) already in the browser, so the conversion can be attributed to an ad (enhanced conversions). We do not send the e-mail to Meta.

4.5 We use Google Consent Mode v2. Until you consent, the analytics_storage, ad_storage, ad_user_data and ad_personalization signals are all set to denied, so Google may neither store nor read identifiers. The advertising signals are raised only by a marketing consent and the analytics signal only by an analytics consent - never one from the other. The Meta Pixel is loaded into the page only with a marketing consent; when you withdraw it, we send the pixel the withdrawal and delete its cookies.

5.Tools that are not here

5.1 Beyond the tools in the table above (Google Analytics 4, PostHog, Google Ads and the Meta Pixel) we run no other measurement or advertising tool on the website. There are no other social-network advertising pixels, no third-party chat widgets and no session-recording tools.

5.2 The website is also wired for Microsoft Clarity, but it has no ID configured and does not run. If that changed you would see it immediately: the categories offered in the banner follow what is actually deployed, adding a tool invalidates previously stored consents, and we ask again. A consent given for one list of processors does not extend to a longer one.

5.3 If you choose to sign in with a Microsoft or Google account, we redirect you to their sign-in page. There, those providers store their own cookies under their own rules. Without that, signing in through them would not work.

5.4 Card payments use Stripe, which stores the cookies needed to complete the payment and to prevent fraud.

6.How to give, change and withdraw consent

6.1 The banner appears on your first visit. You can accept all, reject all, or pick individual categories in the settings.

6.2 You can change your choice at any time through the Cookie settings link in the site footer or the button on this page. The top of this page also shows what you currently have enabled.

6.3 Withdrawing consent is more than stopping the scripts. When you switch a category off, we remove the relevant scripts from the page and also delete the cookies that service has already stored - otherwise you would remain trackable by exactly the mechanism you refused. Categories are cleared independently: withdraw analytics while keeping marketing on, and the marketing cookies stay.

6.4 You can also delete or block cookies directly in your browser. For essential cookies that means you will not be able to sign in to the application.

6.5 We keep your choice - acceptance and refusal alike - for 12 months. After that we ask again, so the decision stays under your regular control. With the record we store the date and the list of processors the consent covered, so we can demonstrate exactly what you agreed to.

6.6 A refusal is a full decision, not a postponement. If you refuse, we will not show the banner again for 12 months, or until the list of processors changes.

7.Your rights, contact and changes

7.1 For cookies that process personal data you have every right under the GDPR - access, rectification, erasure, restriction, objection and withdrawal of consent. Withdrawal does not affect the lawfulness of processing before it. The detail and the deadlines are in our Privacy Policy.

7.2 Write to us at kluch@buildify.cz. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

7.3 We update this policy whenever we add or remove a technology. A new version is published with its effective date, and for an added technology we ask for consent again.