Privacy policy

1. Who is responsible for your data

The controller is Vladimír Večeřa, operator of Krabix.cz. For privacy questions and requests, contact krabix@vladimir-vecera.cz.

You can use the configurator and download models without registering. You provide account, inquiry and publication data when using those features. Please do not include unnecessary information about other people in names, labels or messages.

2. Accounts, designs and the public gallery

For an account we process your nickname, e-mail, password hash, registration and last-login times, verification status and temporary verification or reset tokens. Saved designs, names, parameters, previews, labels and a work-in-progress draft are linked to your account. This provides the service you request under Art. 6(1)(b) GDPR. A nickname, e-mail and password are required to create an account.

Accounts and their content are retained until deletion. Deleting an account in its settings removes its designs, previews, draft and likes on those designs. Unverified registrations expire after 48 hours and are removed on the next application database access. Password-reset links are valid for 2 hours. Separate orders, delivered e-mails and backups are not automatically erased by account deletion; contact the controller to have them assessed.

Publishing a design is optional. When enabled, others can see your nickname, the design name, preview and content including labels, and can download the model. Designs are therefore not necessarily free of personal data. You can unpublish or delete a design. This cannot remove copies already downloaded by others or immediately erase search-engine results.

3. Print inquiries, messages and payments

Custom printing. We process your name, e-mail, phone number, delivery address or pickup point, design and preview, material, colour, quantity, price, order status and correspondence. Contact and delivery details are needed to handle the inquiry and delivery. The legal basis is steps towards a contract and its performance under Art. 6(1)(b) GDPR, not mandatory consent. Without necessary details we may be unable to fulfil the order.

The controller removes operational order copies after completion, within 30 days. This does not automatically erase the e-mail mailbox or accounting records. Records subject to statutory retention are kept for the period applicable to that record type under Art. 6(1)(c) GDPR. Where a specific complaint or legal claim must be handled, necessary related records are retained while it is being resolved and applicable time limits run, based on legitimate interests under Art. 6(1)(f) GDPR.

Ideas, bug reports and questions. Your message and optional reply e-mail are delivered to the operator. Without an e-mail we cannot reply directly. Our legitimate interest under Art. 6(1)(f) GDPR is answering inquiries, fixing problems and communicating about the service. Messages are retained until resolved, at most 12 months, unless needed for a specific legal claim. Messages no longer include automatically appended IP addresses, browser details or the open page address.

Payments and voluntary support. For a bank transfer, the bank provides payment details such as payer name, account, amount, date and payment reference. We use these to reconcile payments, record received support and meet any statutory duties. Order payments rely on contract performance (Art. 6(1)(b)), voluntary-support records on the legitimate interest in recording contributions (Art. 6(1)(f)), and mandatory records on legal obligations (Art. 6(1)(c)). You do not enter card details on this website. Banking and accounting records follow applicable statutory retention periods and the bank’s terms.

4. Cookies and browser storage

The application uses the following storage for sign-in and features you request. It uses no analytics or advertising cookies. Storage necessary to provide a requested feature does not require consent, but we inform you about its use.

The random like identifier is a pseudonym, not a guarantee of anonymity. We do not use it for traffic tracking or link it to an account. Voting and abuse prevention rely on legitimate interests under Art. 6(1)(f) GDPR. You can clear cookies and local data in your browser; this may sign you out and reset preferences. Clearing the cookie does not itself remove stored votes; contact the controller for their removal.

5. Security and aggregate statistics

IP addresses are technically processed to deliver requests and prevent abuse. Application security counters contain a short-lived IP-derived code and the hour, not a raw IP address; records older than two hours are removed the next time the protection is used. These are pseudonymous data. Our legitimate interest under Art. 6(1)(f) GDPR is website security and availability.

STL download counters store aggregate totals. Traffic is measured by JavaScript loaded from www.vladimir-vecera.cz/stats.js. It sends the site identifier, fixed page label /, navigation type and, where available, the referring domain; for some external referring pages it also sends their address without query parameters or fragments. The currently inspected version 3 uses no tracking cookies, local storage or visitor identifier and sends no measurement event when Do Not Track or Global Privacy Control is enabled. The browser connects directly to vladimir-vecera.cz, whose server technically receives the IP address and normal HTTP headers during that connection. The no-referrer setting restricts the HTTP Referer header; it does not prevent the referrer information described above from being included in the event body. Krabix no longer stores local PHP daily totals for this traffic measurement.

The host may keep separate operational and security logs, such as IP address, time, requested address and request outcome. These are not part of aggregate statistics. Their retention and backup cycle depend on the hosting service used. Backups support disaster recovery; deletion from the active system therefore does not necessarily mean immediate removal from every backup.

6. Who may receive data

The controller and, as necessary, hosting, e-mail and backup providers process data. For delivery we share necessary contact and delivery details with the chosen carrier, in particular Zásilkovna. Carriers and banks may act as independent controllers for their own legal and operational purposes; they are not automatically our processors. Accounting or tax records may be disclosed to those maintaining statutory records and competent authorities where required by law.

We do not sell personal data. Published designs are available to internet users, including outside the European Economic Area. Links to other websites do not themselves send your account content; when you open another website its own privacy rules apply.

7. Your rights and handling requests

Subject to GDPR conditions, you have rights of access and a copy of your data, rectification, erasure and restriction. You may exercise portability for data you provide that are processed automatically on the basis of a contract or consent. Erasure may not cover data required by law or for establishing, exercising or defending legal claims.

Right to object: You may object at any time to processing based on legitimate interests on grounds relating to your particular situation. We will stop unless we demonstrate compelling overriding grounds or a need relating to legal claims.

Contact the controller by e-mail. Requests are handled without undue delay and within one month. For complex or numerous requests, this may be extended by two further months; we explain the reasons within the first month. Where we have reasonable doubts we may request proportionate identity verification. If we refuse a request, we explain why and how you can challenge it.

You can lodge a complaint directly with the Czech Office for Personal Data Protection or another competent supervisory authority, particularly in the country of your habitual residence or workplace. You also have a right to a judicial remedy.

8. Consent and automated decisions

For accounts, inquiries and security we use the legal bases described above; no blanket consent to this policy is required. If we introduce optional consent-based processing, we will request consent separately and allow its withdrawal without affecting earlier lawful processing. We do not make solely automated decisions with legal or similarly significant effects or conduct such profiling. Print-price estimates are indicative and a person confirms the order.