Privacy Policy

1. Who is the controller

The controller of the personal data described here is Loops Collective s.r.o., Company ID 29932386, with its registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 454220 — the operator of the Kaen service.

Write to hello@kaen.cz with anything concerning personal data. We have not appointed a data protection officer; we are not required to.

This policy does not cover data we process for a customer. When we analyse a customer’s analytics and product data, the customer is the controller and we are the processor — that relationship is governed by the Data Processing Agreement.

2. What we collect and why

When you visit kaen.cz

• Data: pages viewed, referrer, approximate location derived from IP address, device and browser type, a pseudonymous identifier stored in local storage or a cookie, and a recording of the session (clicks, scrolling and mouse movement) on our own pages.
• Why: to keep the site running securely and to see what works on it.
• Legal basis: our legitimate interest in running and improving our own website (Art. 6(1)(f) GDPR), and your consent for cookies that are not strictly necessary (Section 89(3) of Act No. 127/2005 Coll.). See Cookies.
• Retention: for as long as our analytics tool keeps it under its current plan, currently up to 12 months for recordings and longer for aggregated statistics.

When you come from our ads

• Data: a pseudonymous identifier in a cookie (_fbp, _fbc, _gcl_au), the pages you view and what you do on them, such as requesting a website analysis or booking a demo.
• Why: to measure which of our ads on Facebook, Instagram and Google bring customers, and to show our ads on Facebook and Instagram again to people who have visited kaen.cz.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll.), given in the cookie bar and withdrawable there at any time.
• Retention: the cookies expire after 90 days; Meta and Google keep the data under their own terms.

When you ask for a website analysis or book a demo

• Data: what you enter in the analysis form — your website address, your work e-mail, a description of your business and what it offers, your target audience, the main goal of your website, what frustrates you about it, your competitors and any note you add — and anything else you write to us. When you book a demo, the name and e-mail you enter and the time and content of the booking.
• How: the analysis form is saved step by step from its first step, so an unfinished form still creates an enquiry (a lead) that we may follow up on. The enquiry is linked to the pseudonymous product-analytics session (PostHog) only to avoid duplicate enquiries and to measure how the form performs. Demo calls are booked through Calendly.
• Why: to reply, prepare the analysis of your website or the call, send you the result of the analysis, and follow up on it.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and our legitimate interest in following up on an enquiry (Art. 6(1)(f) GDPR).
• Retention: 24 months from the last contact, unless a contract follows.

When you become a customer

• Data: contact details of the people we work with (name, work e-mail, phone, role), billing details, payment records, and the content of our communication, including the shared channel in Slack, Microsoft Teams or Basecamp.
• Why: to deliver the service, invoice it and keep the records the law requires.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations such as accounting and tax (Art. 6(1)(c) GDPR), and our legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).
• Retention: for the term of the contract, then 3 years; accounting and tax documents for the statutory period (up to 10 years).

When we send you e-mail

• Data: e-mail address, delivery and open records.
• Why: to send what you asked for (the result of the analysis, a reply) and occasionally news about Kaen.
• Legal basis: performance of a contract, or your consent, or our legitimate interest in offering a similar service to an existing customer. Every e-mail has an unsubscribe link and unsubscribing takes effect immediately.
• Retention: until you unsubscribe, then a record of the unsubscribe itself.

3. Where the data comes from

Usually from you. We may also use public sources (a company register, a public website, LinkedIn) to prepare for a call or check an invoice detail.

We also receive leads from Trust Tornado (operated by Radek Šnajdr, Company ID 04771761) when you ask for an analysis there and agree to be contacted by us. Trust Tornado is a separate controller for its own service; we become the controller of the data it passes to us.

4. Who we share it with

We do not sell personal data. We share it with suppliers who process it for us — hosting, the database, e-mail, payments, communication, demo booking and AI analysis — and with our accountant and legal or tax advisers. The suppliers are listed at Subprocessors, together with the purpose, location and safeguards for each.

Data about visits to kaen.cz goes to the analytics and advertising tools described in Cookies: PostHog (EU cloud) and Google Ireland Limited (Google Analytics, Google Tag Manager, Google Ads) process it for us. For the Meta Pixel, Meta Platforms Ireland Limited is our joint controller for collecting the data on our site and passing it to Meta, and an independent controller for what it does with the data afterwards.

Where a supplier processes data outside the EU, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

5. Automated decision-making and AI

We use large language models to analyse data and prepare findings and variations. Findings shared with customers in their team chat may be generated by the agent automatically, without a human reviewing each one first. A test goes live on a customer’s website only after the customer has approved it. We make no automated decision that would have a legal effect on you or similarly significantly affect you within the meaning of Art. 22 GDPR. According to our supplier’s terms, inputs are not used to train their models.

6. Your rights

Under the GDPR you may ask us to:

• tell you what data we hold about you and give you a copy (Art. 15);
• correct it if it is wrong (Art. 16);
• delete it where we no longer have a reason to keep it (Art. 17);
• restrict processing, or object to processing based on legitimate interest (Art. 18 and 21);
• send data you gave us to another provider (Art. 20);
• withdraw a consent you gave, with effect for the future (Art. 7(3)).

Write to hello@kaen.cz. We reply within one month; if a request is complex, we may extend that by two months and will tell you.

You may also complain to the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.cz.

7. Security

Data is encrypted in transit and at rest with our suppliers. Access is limited to the people who need it, protected by two-factor authentication where the tool supports it, and we use read-only access to customer systems wherever it is enough. Write access is used only where a customer grants it to set up tracking or to run tests they approved. We review our suppliers and access rights periodically.

8. Changes

We may update this policy — for instance when the service or a supplier changes. The current version is always published at kaen.cz/privacy with its version number and effective date. Material changes affecting customers are announced by e-mail.

This policy is published in English and in Czech. In case of any discrepancy, the English version prevails.