Data controller: Vinaři SADY z.s., company ID (IČO) 66610427, Solná cesta 309, Sady, 686 01 Uherské Hradiště, Czech Republic. Contact: jaromir@vinarisady.cz.
What we collect
Visitor numbers. We count them with Plausible Analytics, running on our server (stats.jaromir.io). It sets no cookies and doesn’t follow you from site to site. To tell that you’ve come back on the same day, it works out an identifier from your IP address and browser details, and that identifier changes every day; your IP address itself isn’t stored. It records which page you opened, where you came from, roughly which country, your device and browser, and what you clicked (a map or a photo, say). By the next day, nothing links those records to you. We keep them indefinitely and share them with no one. The legal basis is our legitimate interest in knowing which pages people read (Art. 6(1)(f) GDPR).
Invitations by e-mail. When you sign up, we store your e-mail address, the date you signed up, the language of your invitations and, where relevant, a note that an e-mail to you bounced. We don’t store your IP address. All of it sits in Listmonk, also on our server (list.jaromir.io). We don’t track whether you open an e-mail at all; on some links we count clicks, but only how many, never who. The legal basis is the consent you gave by signing up (Art. 6(1)(a) GDPR); since 9 September 2026 you also confirm it with a link in the first e-mail. Until you do, that address gets nothing from us but the first e-mail. We keep your address until you unsubscribe; after that we hold on to it only with a note that we mustn’t send you anything (legitimate interest, Art. 6(1)(f) GDPR). Ask us and we’ll delete it completely; it drops out of our backups within about a year. Our e-mails are delivered by Seznam.cz, a.s. (Seznam Email Profi), acting as our processor.
When you write to us, we have your address or number and what you wrote, so we can reply (legitimate interest, Art. 6(1)(f) GDPR). Seznam runs the vinarisady.cz mailboxes for us too. Messages stay in the mailbox as long as we need them, and we’ll delete them if you ask.
Server logs. Every time a page, image or video loads (videos from media.medek.wine included), the server records your IP address, the time, the full address of what you opened with its parameters (an ad click ID, for example), where you came from and your browser details. When the security filter catches a suspicious request, the server records the whole of it, including any form data and cookies sent. The logs help us find faults, protect the site from attacks and see what gets read (legitimate interest, Art. 6(1)(f) GDPR). They’re deleted after 15 days. We share the IP addresses attacks come from with CrowdSec (CrowdSec SAS, France), which builds a shared blocklist from them.
Where the data lives. The site, the statistics and the invitations run on a virtual server in a data centre in the Netherlands, rented to us by Microsoft (Azure) as our processor. We regularly back up the invitations, statistics, site files and the reports built from the server logs, encrypted, to a server in the Czech Republic. Backups are kept for about a year.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict how we process it, and to data portability. You can object (Art. 21 GDPR) to our visitor statistics, our server logs, the do-not-send note we keep on an unsubscribed address, and our holding on to your messages. Signing up for invitations is entirely up to you. We make no automated decisions about anyone. You can complain to the Czech Office for Personal Data Protection (ÚOOÚ). To unsubscribe, use the link at the end of any invitation. For anything else on this list, write to jaromir@vinarisady.cz.
Ad measurement with Google
Google runs the ads for this site for free, through its Google Ad Grants programme for non-profits. In return Google wants to see a result every month, such as a sign-up to our invitations. So on the page after signing up, and on the add-to-calendar page, we ask whether we may send Google a message about the result.
We ask only those who came to the site by clicking a Google ad. Until you say “Yes”, no Google code loads on the site and nothing is sent. Saying “No” changes nothing.
After “Yes”, this goes to Google:
- the ad click identifier, which sits in the page address,
- the page address,
- the fact that you signed up to the invitations or opened the add-to-calendar page,
- your IP address and browser details, which are sent with every connection.
We are responsible for the data being sent. What Google does with it afterwards is decided by Google Ireland Limited as an independent controller, under its own privacy policy; how Google uses data from sites that measure its ads is described at business.safety.google/privacy. It may also end up in the USA; Google says it complies with the EU-U.S. Data Privacy Framework (policies.google.com/privacy/frameworks).
Google also stores two cookies in your browser, _gcl_au and _gcl_aw, each for 90 days. Your browser connects to googleadservices.com, google.com and doubleclick.net while doing so; if it already holds Google cookies, it may send them too.
The legal basis is your consent (Art. 6(1)(a) GDPR and section 89(3) of Czech Act No. 127/2005 Coll.). To be able to prove it (Art. 7(1) GDPR), we record the time, page and click identifier, no IP address, and keep that for 24 months.
You can withdraw consent at any time: just delete the cookies _gcl_au and _gcl_aw in your browser, or e-mail us at jaromir@vinarisady.cz. We cannot call back a message already sent; you can manage whatever Google holds directly with Google (myadcenter.google.com). Withdrawal does not affect processing done before it.
Cookies
The site stores one technical cookie, and only when you switch language: that choice then stays in your browser for a year. We need no consent for it, because the language is your own choice, not tracking. Two more cookies from Google appear only if you arrive from an ad and say “Yes” (see Ad measurement with Google).
