Privacy Policy
1. Personal Data Controller
The controller of personal data processed in connection with the operation of the website hafoknih.cz is:
hafoknih.cz
Email: info@hafoknih.cz
(hereinafter "controller")
The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter "GDPR") and Act No. 110/2019 Coll. on the processing of personal data.
2. What personal data we process
a) Account data (required)
- email address — used for login and essential communication (registration confirmation, password recovery),
- password — we store only in the form of a secure hash, never in readable form,
- when logging in via Google, instead of a password we store your Google account identifier and the email that Google provides to us.
b) Profile data (optional)
Completing this is entirely up to you; it's used to personalize your profile and recommend books:
- displayed name, "About me" text (bio) and profile picture (avatar),
- age group, favorite genres and preferred languages for recommended books,
- privacy settings (what from your profile is public).
c) Content you create on the website
- book comments and ratings,
- favorite books, bookshelves (read, currently reading…),
- membership in reading clubs and voting in them,
- following other readers and notifications about their activity.
Parts of this content may be visible to other users depending on your privacy settings (Profile → Privacy), which you can change at any time.
d) Technical data
- IP address and basic browser information in server technical logs — for security and troubleshooting,
- cookies necessary for website functionality and analytics tools (see section 5),
- text entered into AI search — the query is processed by the language model provider (see section 6); we do not link it to your identity.
We do not collect any payment data — the website does not sell anything; for book offers we only link to third-party e-shops.
3. Purpose and legal basis of processing
| Purpose | Data | Legal basis |
|---|---|---|
| Maintaining user account and providing website services | account data, profile, created content | contract performance (Article 6(1)(b) of GDPR) |
| Essential operational communication (registration confirmation, password recovery) | contract fulfillment | |
| Notifications about followed readers' activity | tracking data | contract performance; can be disabled in settings |
| Service security and abuse prevention (logs, reCAPTCHA) | technical data | legitimate interest (Art. 6 para. 1 lit. f) GDPR) |
| Measuring traffic and improving the website | analytics cookies | consent (Art. 6 para. 1 lit. a) GDPR) |
We do not use your email address to send commercial messages or newsletters unless you give us separate consent.
4. Data retention period
- We retain account and profile data for the duration of the user account; after account deletion, we delete it without undue delay, within 30 days at the latest, unless a legal obligation requires further retention.
- Public content (comments, ratings) is deleted or anonymized when the account is deleted.
- Server technical logs are deleted automatically, typically within 90 days.
5. Cookies and analytics
The hafoknih.cz website uses:
- technical cookies necessary for the website to function (maintaining login) — do not require consent,
- Google Tag Manager / Google Analytics for anonymous traffic measurement,
- Google reCAPTCHA v3 during registration and contact form submission (protection against bots); Google evaluates browser technical signals in the process.
6. Sharing data with third parties
We do not share your data with third parties for their own purposes (such as marketing).
Only our data processors who ensure the website operates have technical access to your data, always limited to what's necessary to provide their service:
- Aruba S.p.A. (Italy/Czech Republic) — server infrastructure; data is stored in the EU,
- Google Ireland Ltd. — Google sign-in, reCAPTCHA, analytics,
- Mailjet (Sinch) — sending operational emails,
- BunnyWay d.o.o. (Bunny.net, Slovenia) — CDN for image delivery,
- Anthropic and Voyage AI (USA) — processing AI search queries (not linked to your account).
These processors are bound by confidentiality obligations and may only process data according to our instructions.
Data is primarily stored in the EU. For US providers (Google, Anthropic), any transfer takes place based on an adequacy decision — EU-U.S. Data Privacy Framework, or alternatively standard contractual clauses.
7. Data Security
We have implemented appropriate technical and organizational measures to protect your personal data from loss, misuse, or unauthorized access, including encrypted website connection (HTTPS) and secure password storage using hashing.
8. Your Rights
In connection with the processing of your personal data, you have the following rights:
- right of access to personal data we process about you (Article 15 GDPR),
- right to rectification of inaccurate data (Article 16 GDPR) — you can edit your profile directly in account settings,
- right to erasure ("right to be forgotten", Article 17 GDPR) – for example by deleting your account,
- right to restrict processing (Article 18 GDPR),
- right to data portability (Article 20 GDPR),
- right to object to processing (Article 21 GDPR),
- right to withdraw consent where processing is based on consent.
You can exercise your rights by email at: info@hafoknih.cz. We will respond to your request within one month.
You also have the right to lodge a complaint with the supervisory authority, which is:
Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Prague 7
www.uoou.cz
9. Changes to these policies
We may update these policies from time to time. The current version is always available at hafoknih.cz. We will inform you of material changes by email or notice on the website.
These policies are effective from 8.7.2026.