Privacy Policy
Effective from: October 24, 2026
1. Identity of the controller
Controller: Jan Krásný
Natural person: Yes (not acting as a business)
Website: 7virides.com — a blog about soap making, natural cosmetics and permaculture
Contact: info@7virides.com
Data Protection Officer: Not appointed. Processing personal data is not the controller's core activity, so appointing a DPO is not required.
2. Overview of processing purposes and legal bases
| Purpose | Legal basis | Data subjects | Categories of data |
|---|---|---|---|
| Newsletter sign-up | Consent (Art. 6(1)(a) GDPR, Section 7 of Act No. 480/2004 Coll.) | People interested in the newsletter | E-mail, IP address, timestamp |
| Sending commercial communications | Consent (Art. 6(1)(a) GDPR, Section 7 of Act No. 480/2004 Coll.) | Newsletter subscribers | |
| Google Analytics 4 | Consent (Art. 6(1)(a) GDPR — cookie consent) | Website visitors | Cookie identifiers, IP address, device |
| Strictly necessary cookies | Legitimate interest (Art. 6(1)(f) GDPR) | Website visitors | Cookie storing the consent choice |
3. Detailed description of each processing purpose
3.1 Newsletter and commercial communications
Purpose: Sending e-mails with blog articles, information about natural cosmetics, soap making and permaculture, and promotion of products and services.
Legal basis: Consent of the data subject under Art. 6(1)(a) GDPR and Section 7(2) of Czech Act No. 480/2004 Coll., on Certain Information Society Services.
Collection mechanism (double opt-in):
- The user enters their e-mail address
- The system sends a confirmation e-mail with a clickable link
- By clicking the link, the user confirms their consent
Consent is stored with a timestamp, the IP address, the version of the information text and a consent identifier, so that it can be demonstrated in the event of an inspection by the supervisory authority.
Recipients: E-mails are sent via Sendy (self-hosted software) operated on the controller's own server in the EU. The data does not leave the controller's infrastructure and is not passed on to third parties.
Retention period: The e-mail address is kept for as long as the subscription is active. After unsubscribing, the address is moved to a suppression list (“Robinson list”) and kept for 3 years.
Right to withdraw consent: Consent can be withdrawn at any time by clicking the unsubscribe link at the bottom of every e-mail. Withdrawal does not affect the lawfulness of processing carried out while the consent was valid.
3.2 Google Analytics 4
Purpose: Website traffic analysis — number of visits, user behavior, popular pages, traffic sources.
Legal basis: Consent of the data subject under Art. 6(1)(a) GDPR. Consent is obtained via the cookie banner on the website. The website implements Google Consent Mode v2.
Processor: Google LLC (Google Ireland Limited for the EEA).
Transfers to third countries: Yes — data is sent to Google servers in the USA. Legal framework: EU-U.S. Data Privacy Framework (DPF). Fallback mechanism: Standard Contractual Clauses (SCCs). IP addresses are anonymized.
Retention period: GA4 retains detailed data for 14 months, after which it is aggregated.
For details of the individual cookies, see the Cookie Policy.
3.3 Strictly necessary cookies and services
Purpose: Storing the cookie consent choice and controlling script loading (Google Tag Manager).
Legal basis (storing cookies): Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications — strictly necessary cookies are exempt from the consent requirement.
Legal basis (processing of data): Legitimate interest of the controller under Art. 6(1)(f) GDPR.
The complete list of cookies can be found in the Cookie Policy.
4. Data subjects and their rights
4.1 Right of access (Art. 15 GDPR)
The data subject has the right to ask the controller to confirm whether their personal data is being processed and to obtain a copy of it. The controller will provide the data within 30 days at the latest.
How to exercise it: E-mail info@7virides.com with the subject “Request for access to personal data”.
4.2 Right to rectification (Art. 16 GDPR)
The data subject has the right to have inaccurate data corrected.
How to exercise it: E-mail info@7virides.com with the subject “Request for rectification of data”.
4.3 Right to erasure (Art. 17 GDPR) — “right to be forgotten”
The data subject has the right to request the erasure of their personal data if:
- The data is no longer necessary for the original purpose
- The data subject withdraws consent and there is no other legal basis
- The data subject objects to the processing under Art. 21
- The data has been processed unlawfully
How to exercise it: E-mail info@7virides.com with the subject “Request for erasure of data”.
4.4 Right to restriction of processing (Art. 18 GDPR)
The data subject has the right to request restriction of processing if they contest the accuracy of the data, if the processing is unlawful, or if they object to the processing.
How to exercise it: E-mail info@7virides.com with the subject “Request for restriction of processing”.
4.5 Right to data portability (Art. 20 GDPR)
The data subject has the right to receive their data in a structured, commonly used and machine-readable format (CSV, XML, etc.).
How to exercise it: E-mail info@7virides.com with the subject “Request for data portability”.
4.6 Right to object (Art. 21 GDPR)
The data subject has the right to object to the processing of their data. Where the legal basis is legitimate interest (Art. 6(1)(f)), the controller must stop the processing without undue delay unless it demonstrates compelling legitimate grounds.
How to exercise it: E-mail info@7virides.com with the subject “Objection to processing of data”.
4.7 Right to withdraw consent (Art. 7 GDPR)
Consent to processing can be withdrawn at any time. For the newsletter, simply click “Unsubscribe” in the e-mail or write to info@7virides.com.
4.8 Automated decision-making
The website does not carry out any automated decision-making or profiling.
4.9 Right to lodge a complaint with the ÚOOÚ
Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Phone: +420 234 665 411
E-mail: posta@uoou.gov.cz
Website: www.uoou.gov.cz
5. Security measures and data protection
The controller implements physical, technical and organizational measures to protect personal data:
- Encrypted communication (HTTPS)
- Database access restricted to the controller only
- Regular data backups
- Server firewall and antivirus protection
- Strong passwords and two-factor authentication
In the event of a personal data breach, the controller will notify the ÚOOÚ within 72 hours.
6. Voluntary provision of data
Providing personal data is voluntary. No legal or contractual requirement obliges the data subject to provide it. The website is fully functional without consent to analytics cookies.
7. Retention periods — overview
| Type of data | Purpose | Retention period |
|---|---|---|
| E-mail + consent (newsletter) | Sending newsletters | For as long as the subscription is active, then 3 years on the suppression list (Robinson list) |
| GA4 data on Google servers | Analytics | 14 months |
| Cookie consent record (random identifier, choice, time) | Proof of consent | 3 years |
How long cookies are stored in the browser is described in the Cookie Policy.
8. Language versions
This Policy is available in Czech, English and German. In the event of any discrepancy, the Czech version prevails.
9. Changes to this Policy
The controller reserves the right to amend this Policy. In the event of a significant change, the controller will inform newsletter subscribers by e-mail.
10. Contacting the controller
Jan Krásný
E-mail: info@7virides.com
Website: 7virides.com
Effective from: October 24, 2026
