Privacy policy

Paul Julian Heise
OSVČ / IT-Freelancer
Uralská 689/7, 160 00 Praha 6
Czech Republic
IČO: 23931752
DIČ (VAT ID): CZ687938738

Email: contact@pauljulianheise.com

Further details can be found in our legal notice.

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter: "data subject"). A natural person is considered identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

We only process personal data when this is necessary for the following purposes:

• Based on your request and consent (Art. 6(1)(a) GDPR)
• To enable use of the website and of your account (Art. 6(1)(b) GDPR)
• To maintain the security of the website and to improve it (Art. 6(1)(f) GDPR)
• To comply with legal obligations, such as tax regulations and recordkeeping duties (Art. 6(1)(c) GDPR)

Further details regarding data processing can be found under the respective headings below.

1. Access data and server log files

When visiting our website, the servers of our hosting provider automatically store information your browser transmits, known as server log files. This includes:

• Referrer (previously visited page)
• Requested URL or file
• Browser type and version
• Operating system used
• Device type used
• Preferred browser language
• Time of access
• IP address and the approximate location derived from it (country, region, city)

Temporary processing of this data is necessary to deliver the website to your device. In particular, the IP address must be processed for this purpose. This data is not merged with other sources and is used exclusively to ensure the technical operation and security of the server and hosting infrastructure, to detect errors and to prevent abuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, error-free operation of the website)

2. Contact by email

If you contact us by email, the personal data you provide (e.g. name, email address, message) as well as technical data (e.g. timestamp) will be processed to handle your inquiry and any follow-up questions.

Legal basis: Art. 6(1)(b) GDPR (for responding to inquiries)

3. User account

You can create an account on Lacunio with your email address and a password. We process:

• Your email address
• Your password, which is stored only in encrypted form (as a hash) by our authentication service and which we cannot read
• Your role and your plan (e.g. free or premium)
• The time of registration and of your last login
• Technical login data, held in cookies, that keeps you logged in

To confirm your registration and to reset your password, we send you emails through our email provider (see Section III). This data is used exclusively to operate your account and the services on Lacunio. We do not use it for advertising or profiling.

Legal basis: Art. 6(1)(b) GDPR (providing the account and the services you use), Art. 6(1)(f) GDPR (security of the account, e.g. session handling and access protection)

The database and the authentication service are operated on our behalf by our processor Supabase (see Section III).

4. Cookies and storage on your device

We do not use cookies for advertising or analytics, and we do not use any analytics or tracking services. Only the following technically necessary storage takes place:

• Language preference: when you open a language version, a cookie (lacunio_locale) stores this choice for up to one year, so that you see Lacunio in your language on your next visit.
• Login: after logging in, cookies of our authentication service hold your login session.
• Display preferences: if you switch between light and dark mode or choose an accent colour, this choice is stored in your browser's local storage (theme, lacunio-accent). It stays on your device and is not transmitted to us.

Legal basis: Art. 6(1)(f) GDPR; the storage is strictly necessary for the function you requested.

5. Fonts

We use the typeface "Satoshi". The font files are hosted on our own infrastructure and delivered together with the website. No connection to Google servers or any other third-party font provider is established.

Personal data may be disclosed to the following recipients, to the extent necessary:

Hosting

Vercel Inc.
440 N Barranca Ave #4133
Covina, CA 91723
United States

Vercel hosts the website and delivers it to your device. Any relevant sub-processors of Vercel are included.

Database and authentication

Supabase, Inc.
548 Market St, PMB 98450
San Francisco, CA 94104-5401
United States

Supabase provides the database and the authentication service for your account. Our database is hosted in a data center in Frankfurt (Germany), within the European Union. As Supabase is a US-based provider, access from or a transfer to the USA cannot be fully excluded; in that case the appropriate safeguards described below apply. Any relevant sub-processors of Supabase are included.

Email

Spaceship, Inc. (Spacemail)
4600 East Washington Street, Suite 300
Phoenix, AZ 85034
United States

We use Spacemail to send the emails for your account (confirmation of registration, password reset) and for our email correspondence. As a US-based provider, data may be transferred to the USA; the appropriate safeguards described below apply.

Beyond these cases, we will not share your personal data with third parties without your explicit consent, unless we are legally obligated to do so or the transfer is necessary to fulfill a contractual relationship with you.

Service providers processing personal data on our behalf in third countries (outside the EU or the EEA) are only used if an adequacy decision by the European Commission exists for the country (Art. 45 GDPR), or appropriate safeguards (Art. 46 GDPR) are in place, such as Standard Contractual Clauses (Art. 46(2)(c) GDPR) or Binding Corporate Rules (Art. 47 GDPR).

We delete personal data once the purpose for processing has been fulfilled and the legal basis for processing no longer applies, provided there is no statutory retention obligation.

• Server log files and IP addresses are automatically deleted no later than three days after collection.
• Session cookies are deleted at the end of your session or when you log out. The language cookie is stored until it expires after one year. You can view, restrict, or delete cookies at any time through your browser settings.
• Account data is stored for as long as your account exists. You can ask us to delete your account at any time by email; we will then delete your account data, unless a statutory retention obligation applies.
• Emails are processed until your inquiry has been completely handled and are deleted afterwards, unless a statutory retention obligation applies.

You are not legally required to provide personal data. However, an account requires your email address and a password. Without them, the functions that require an account are not available.

There is no automated decision-making; profiling does not take place.

Your rights as a data subject

In accordance with Articles 15 to 23 and Article 77 of the General Data Protection Regulation (GDPR), as supplemented by the Czech Personal Data Processing Act (Act No. 110/2019 Coll.), you have the following rights, provided the legal conditions are met:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure, "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR), with effect for the future
• Right to object (Art. 21 GDPR), see Section VI

Please send any requests to us. See Section I for contact details.

Right to lodge a complaint

If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), particularly in the member state of your residence, workplace, or the place of the alleged infringement. The competent supervisory authority for us is:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
www.uoou.gov.cz

1. Right to object on grounds relating to your particular situation

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Art. 6(1)(f) GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

2. Right to object to direct marketing

If your personal data is processed for direct marketing purposes, you have the right to object to this at any time. We will then no longer process your personal data for these purposes.

The objection can be made without any formal requirements and should preferably be sent to the contact details in Section I.