Privacy Policy

1. Who is the controller

The controller of the personal data described here is Loops Collective s.r.o., Company ID 29932386, with its registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 454220 — the operator of the Kaen service.

Write to hello@kaen.cz with anything concerning personal data. We have not appointed a data protection officer; we are not required to.

This policy does not cover data we process for a customer. When we analyse a customer’s analytics and product data, the customer is the controller and we are the processor — that relationship is governed by the Data Processing Agreement.

2. What we collect and why

When you visit kaen.cz

• Data: pages viewed, referrer, approximate location derived from IP address, device and browser type, a pseudonymous identifier stored in local storage or a cookie, and a recording of the session (clicks, scrolling and mouse movement) on our own pages.
• Why: to keep the site running securely and to see what works on it.
• Legal basis: our legitimate interest in running and improving our own website (Art. 6(1)(f) GDPR), and your consent for cookies that are not strictly necessary (Section 89(3) of Act No. 127/2005 Coll.). See Cookies.
• Retention: for as long as our analytics tool keeps it under its current plan, currently up to 12 months for recordings and longer for aggregated statistics.

When you ask for an audit or book a demo

• Data: your work e-mail, the website address you enter, what you want to improve, who your audience is, and anything else you write to us; the time and content of the booking.
• Why: to reply, prepare the audit or the call, and follow up on it.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and our legitimate interest in following up on an enquiry (Art. 6(1)(f) GDPR).
• Retention: 24 months from the last contact, unless a contract follows.

When you become a customer

• Data: contact details of the people we work with (name, work e-mail, phone, role), billing details, payment records, and the content of our communication, including the shared Slack or Basecamp channel.
• Why: to deliver the service, invoice it and keep the records the law requires.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations such as accounting and tax (Art. 6(1)(c) GDPR), and our legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).
• Retention: for the term of the contract, then 3 years; accounting and tax documents for the statutory period (up to 10 years).

When we send you e-mail

• Data: e-mail address, delivery and open records.
• Why: to send what you asked for (a report, a reply) and occasionally news about Kaen.
• Legal basis: performance of a contract, or your consent, or our legitimate interest in offering a similar service to an existing customer. Every e-mail has an unsubscribe link and unsubscribing takes effect immediately.
• Retention: until you unsubscribe, then a record of the unsubscribe itself.

3. Where the data comes from

Usually from you. We may also use public sources (a company register, a public website, LinkedIn) to prepare for a call or check an invoice detail.

We also receive leads from Trust Tornado (operated by Radek Šnajdr, Company ID 04771761) when you ask for an audit there and agree to be contacted by us. Trust Tornado is a separate controller for its own service; we become the controller of the data it passes to us.

4. Who we share it with

We do not sell personal data. We share it with suppliers who process it for us — hosting, the database, e-mail, payments, communication and AI analysis — and with our accountant and legal or tax advisers. The suppliers are listed at Subprocessors, together with the purpose, location and safeguards for each.

Where a supplier processes data outside the EU, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

5. Automated decision-making and AI

We use large language models to analyse data and draft findings. The result is a proposal that a human reviews before it reaches you. We make no automated decision that would have a legal effect on you or similarly significantly affect you within the meaning of Art. 22 GDPR. According to our supplier’s terms, inputs are not used to train their models.

6. Your rights

Under the GDPR you may ask us to:

• tell you what data we hold about you and give you a copy (Art. 15);
• correct it if it is wrong (Art. 16);
• delete it where we no longer have a reason to keep it (Art. 17);
• restrict processing, or object to processing based on legitimate interest (Art. 18 and 21);
• send data you gave us to another provider (Art. 20);
• withdraw a consent you gave, with effect for the future (Art. 7(3)).

Write to hello@kaen.cz. We reply within one month; if a request is complex, we may extend that by two months and will tell you.

You may also complain to the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.cz.

7. Security

Data is encrypted in transit and at rest with our suppliers. Access is limited to the people who need it, protected by two-factor authentication where the tool supports it, and we use read-only access to customer systems wherever it is enough. We review our suppliers and access rights periodically.

8. Changes

We may update this policy — for instance when the service or a supplier changes. The current version is always published at kaen.cz/privacy with its version number and effective date. Material changes affecting customers are announced by e-mail.

This policy is published in English and in Czech. In case of any discrepancy, the English version prevails.