1.1.  This Privacy and Personal Data Processing Policy (hereinafter the "Policy") defines the procedures for collecting, processing, storing and protecting personal data of individuals (hereinafter "Data Subjects") in connection with the activities of Dzhevaha Design Studio (hereinafter the "Company", "we").
1.2.  The Company acts as the Data Controller within the meaning of EU Regulation 2016/679 (GDPR) and Act No. 110/2019 Coll. of the Czech Republic.
1.3.  This Policy applies to all persons who interact with the Company: website visitors, Clients, prospective clients, business partners and counterparties.
1.4.  By providing your personal data or using the Company's services, you confirm that you have read this Policy and agree to the terms of processing of your data.

The Company collects the following categories of personal data:

Personal data are processed exclusively on lawful grounds in accordance with Art. 6 GDPR:

4.1.  The Company may share personal data with the following categories of recipients:
• cloud service and tool providers (Google Workspace, Notion, Figma, Webflow, etc.) - solely to the extent necessary for their service delivery;
• accounting and legal advisors - for the purpose of fulfilling legal obligations;
• payment systems - for transaction processing;
• subcontractors - for the performance of specific project tasks.
4.2.  All recipients are required to comply with GDPR requirements. When engaging processors, the Company enters into Data Processing Agreements (DPAs) in accordance with Art. 28 GDPR.
4.3.  Transfer of personal data outside the EU/EEA is carried out only with appropriate safeguards in accordance with Art. 44–49 GDPR (Standard Contractual Clauses, adequacy decisions, etc.).
4.4.  The Company does not sell or disclose personal data to third parties for commercial purposes.

5.1.  The Company's website uses cookies - small text files stored in the visitor's browser.
5.2.  Types of cookies used:
• Strictly necessary (technical) cookies - enable basic website functionality. No consent required.
• Analytical cookies - collect anonymous visitor statistics to improve the website (Google Analytics or equivalent). Consent required.
• Marketing cookies - used to display relevant advertising. Consent required.
5.3.  On the first visit to the website, a cookie banner is displayed allowing the visitor to select cookie categories. Consent may be withdrawn at any time via the website settings or the browser.
5.4.  Session cookies are stored until the browser is closed. Persistent cookies are stored for a maximum of 2 (two) years.

Under GDPR (Art. 15–22) you have the following rights:

7.1.  The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, destruction, alteration or disclosure.
7.2.  Security measures include:
• encryption of data in transit (SSL/TLS);
• restricted access to personal data - only for authorised staff and partners;
• regular software and security updates;
• Data Processing Agreements (DPAs) with all data processors.
7.3.  In the event of a personal data breach that may pose a risk to the rights of data subjects, the Company notifies the supervisory authority (UOOU) within 72 hours and, where necessary, informs the affected data subjects in accordance with Art. 33–34 GDPR.

8.1.  Personal data are retained no longer than is necessary to fulfil the processing purpose or comply with legal obligations.
8.2.  Upon expiry of the retention period, data are destroyed or anonymised.
8.3.  Summary retention periods:
• data related to contract performance: 3 years after project completion;
• accounting and financial records: 10 years (Czech statutory requirement);
• marketing newsletter data: until consent is withdrawn;
• technical data (logs, cookies): up to 2 years;
• data processed for the protection of legitimate interests: until expiry of the limitation period.

9.1.  The Company does not carry out automated decision-making (including profiling) that would produce legal effects or similarly significantly affect data subjects within the meaning of Art. 22 GDPR.

10.1.  The Company reserves the right to amend this Policy. A new version takes effect upon publication on the website. Where material changes are made, we will notify you by email or via the website.
10.2.  We recommend that you periodically review the current version of the Policy on our website.