Privacy
policy

1. Who I am and why this page exists

Dušan Kníže, Company ID (IČO): 24606553, a sole trader operating under the trade name NeovraX ("NeovraX", "I"), provides services in artificial intelligence, automation and digital transformation. I respect your privacy and process only the personal data strictly necessary to provide my services.

This page informs you about what data I collect, why I collect it, how long I keep it and what your rights are. Processing is carried out in accordance with EU Regulation 2016/679 (GDPR) and Czech Act No. 110/2019 Coll.

2. What personal data I process

Contact form (Web3Forms)

If you fill in the contact form on the Contact page, I process via the Web3Forms service:

• Full name
• E-mail address
• Company name (optional)
• Phone number (optional)
• Selected service
• The content of your message (optional)

This data is sent over an encrypted connection first to a serverless function on the Netlify hosting, which securely passes the form to Web3Forms (a processor) without exposing the integration key in the browser, and it is then delivered to my e-mail — see section 4. The data is kept for as long as needed to answer the inquiry, at most 3 years.

Direct communication (e-mail, phone)

If you contact me directly at dusan@neovrax.com or by phone, I process only the information you voluntarily share (name, e-mail, message content, phone number).

Traffic and behaviour analytics (with consent)

If you give consent in the cookie banner ("Accept all"), the following tools are activated:

Google Analytics 4 (GA4) — aggregated traffic statistics:

• Anonymised IP address
• Browser type and version, operating system
• Approximate location (country / region level)
• Pages you visit, time spent on the site, traffic source
• Device identifier (cookie)

Microsoft Clarity — heatmaps and anonymised behaviour recordings (where you click, how you scroll, where you pause). The recordings serve solely to understand website usability, not to profile you.

• Mouse movements, clicks, scroll position
• Anonymised IP address, browser, OS, screen resolution
• Session identifier (cookie)
• Sensitive content (input fields, passwords, card numbers) is automatically masked — Clarity cannot read what you type into forms

Leady — a tool for identifying business (B2B) visitors. Based on the IP address it recognises the organisation a visitor comes from and tracks site activity at the company level — the goal is to learn which companies visit the site, not to profile specific individuals.

• IP address and the organisation/company identification derived from it
• Pages visited, time spent on the site, traffic source
• If form-submission tracking is active, it may associate the e-mail address you fill in and submit in a form with the visitor profile
• Visitor identifier (cookie)

Without consent, neither GA4, nor Clarity, nor Leady runs at all. You can withdraw consent at any time by clicking "Cookie settings" in the website footer, by deleting cookies in your browser, or by request to the e-mail above.

Technical data (automatic)

When you visit the site, your browser automatically shares basic technical information (browser type, approximate country-level location, time of visit). I use this data solely to keep the site secure and working properly (Netlify hosting server logs).

3. The legal bases for processing

4. Who I share data with (processors)

I do not sell or rent your personal data to third parties. To run the website and provide my services I use the following processors:

• Web3Forms (web3forms.com/privacy) — processor of submitted contact forms; receives data server-to-server via a Netlify Function and delivers it by e-mail; EU servers; data is not shared with third parties or stored long-term.
• Google LLC — Google Analytics 4 (policies.google.com/privacy) — an analytics service recording website traffic; runs exclusively after your explicit consent in the cookie banner ("Accept all"); without consent GA4 never loads. Data is transferred to the USA under EU SCCs. IP addresses are anonymised. Measurement ID: G-GY1Y9GR9CX.
• Microsoft Corporation — Microsoft Clarity (privacy.microsoft.com) — a service for heatmaps and anonymised session recordings; helps understand how visitors use the site; runs exclusively after your explicit consent; without consent Clarity never loads. Data is transferred to Microsoft servers (US + EU regions) under EU SCCs. Sensitive content (form inputs, card numbers, passwords) is automatically masked and Microsoft has no access to it. Project ID: wha4twgmcr.
• Leady (leady.com) — a service for identifying business (B2B) visitors; based on the IP address it recognises the organisation a visitor comes from and tracks on-site behaviour at the company level; if form-submission tracking is active, it may associate an e-mail address submitted in a form with the profile. Runs exclusively after your explicit consent in the cookie banner ("Accept all"); without consent Leady never loads. EU servers (a Czech service). Tracking ID: JJjsDgRb5f3UsEFH.
• OpenAI, Inc. (openai.com/policies/privacy-policy) — provider of the GPT-4o-mini model powering the AI chatbot assistant on this site. If you write a message in the chatbot, it is transmitted encrypted over HTTPS to OpenAI servers in the USA to generate a reply. OpenAI processes message content solely to generate the response (API call logs are kept max. 30 days; Zero Data Retention is enabled for this project — no permanent data retention). Data is not used for model training. Transfers to the USA are based on EU Standard Contractual Clauses. You activate the chatbot voluntarily — simply browsing the site sends no data to OpenAI. Legal basis: Art. 6(1)(f) GDPR (legitimate interest — providing AI assistance at the user's request).
• Netlify, Inc. (netlify.com/privacy) — hosting of www.neovrax.com; processes server logs (IP address, user-agent) for security and CDN operation; EU + US servers, EU SCCs.
• Brevo SAS (brevo.com/legal/privacypolicy) — an e-mail marketing and newsletter platform; processes subscribers' e-mail addresses and names solely to deliver the commercial communications you consented to. EU servers (Brevo is a French company, data primarily in the EU); transfers outside the EU under EU SCCs. You can withdraw newsletter consent at any time via the "Unsubscribe" link in every e-mail or by request to the e-mail above.
• Accounting and legal advisors — only to the extent necessary to meet legal obligations (a Czech self-employed accountant; both under NDA).
• Public authorities — only where required by law (tax office, the Czech DPA, courts).

All data transfers outside the EU/EEA are covered by EU Standard Contractual Clauses (Art. 46 GDPR). An up-to-date list of processors and a copy of the DPA are available on request.

5. Your rights

Under the GDPR you have the following rights, which you can exercise at any time at :

• Right of access — I'll tell you what data I hold about you at any time
• Right to rectification — I'll correct inaccurate or incomplete data
• Right to erasure — the "right to be forgotten" — I'll delete your data where the law allows
• Right to restriction of processing — I'll restrict processing while an objection is being reviewed
• Right to data portability — I'll provide your data in a machine-readable format
• Right to object — to processing based on legitimate interest
• Right to withdraw consent — at any time, no reason needed

I respond to requests without undue delay, at the latest within 30 days. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, Prague 7, www.uoou.cz, or with your local EU supervisory authority.

6. Cookies and similar technologies

The website uses two kinds of browser storage:

Technically necessary (no consent needed)

• localStorage — stores only the record of your cookie banner decision (key _nv_cb) so the banner doesn't reappear. No personal data, nothing sent anywhere.
• sessionStorage — if you open the AI chat, it may keep recent messages for the current browser session so the chat isn't lost between pages. Deleted automatically when the session ends.
• Hosting server logs (Netlify) — automatic logging of IP and user-agent for security; kept max. 30 days.

Analytics (require consent)

Only after clicking "Accept all" in the cookie banner is the following activated:

• Google Analytics 4 — cookies _ga, _ga_* to identify unique visits; validity up to 2 years; stored on the visitor's device; can be revoked at any time by deleting cookies in your browser or via the Google Analytics Opt-out.
• Microsoft Clarity — cookies _clck (1 year, user identifier), _clsk (1 day, session); used to group the same visitor's actions within a visit; Clarity runs on this site exclusively after your consent — revoke it via "Reject all" in the cookie bar or by deleting cookies in your browser.
• Leady — stores a cookie with a visitor identifier to recognise return visits and link them to a company profile; runs exclusively after your consent — revoke it via "Cookie settings" in the footer or by deleting cookies in your browser.

The cookie banner follows the opt-in principle under the GDPR and the ePrivacy Directive — without consent, no analytics run. Choosing "Reject all" means basic website operation only, with no measurement.

This website uses no marketing or advertising cookies (Meta Pixel, Google Ads, etc.).

7. Data security

I apply technical and organisational measures appropriate to the processing risk:

• Encrypted data transfer (TLS 1.3, HSTS with preload)
• Security HTTP headers (CSP, X-Frame-Options, COOP/CORP, Permissions-Policy)
• Access rights on the least-privilege principle
• Processing primarily on EU infrastructure (Netlify may replicate to US servers under EU Standard Contractual Clauses)
• Regular dependency updates and vulnerability monitoring

For projects with sensitive data, extended measures are available on request: encryption at rest (AES-256), audit logs, penetration tests and on-premise deployment.

8. Changes to this policy

I reserve the right to update this policy. I will inform you of material changes by e-mail or via a notice on the website. The date of the last update is always shown at the top of the document.