Privacy Policy

1. Who we are

Aveo Engineering Group, s.r.o., registered office č.p. 209, 261 01 Drásov, Czech Republic, Company ID (IČO) 26739721, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 90756 ("Aveo", "we"), is the controller of personal data processed through the website aveoengineering.com.

Contact for anything in this policy: inquiry@aveoengineering.com.

2. What we collect, why, and on what legal basis

a) Enquiry form. When you send an inquiry we process your name, email address, organization (if you provide it), the topic you select and the text of your message. We use this solely to respond to you. Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business correspondence (Art. 6(1)(f) GDPR).

b) Newsletter. When you sign up we process your email address together with a record of your consent (the wording version you agreed to and a timestamp). We use double opt-in: your subscription only becomes active after you confirm it by clicking the link in the confirmation email, and no newsletter is sent to an unconfirmed address. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link included in every email; withdrawal does not affect the lawfulness of processing before withdrawal.

c) Bot protection. Our forms are protected by Cloudflare Turnstile, which distinguishes people from automated abuse and may process your IP address and technical browser characteristics for that purpose. Turnstile operates invisibly, without puzzles. Its data handling is described in Cloudflare's Turnstile Privacy Addendum. Legal basis: our legitimate interest in keeping the website secure and spam-free (Art. 6(1)(f) GDPR).

d) Hosting and technical logs. The website is served by Cloudflare, which processes IP addresses and request data in short-lived technical logs as part of operating and protecting the service. Legal basis: legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

e) Visitor statistics. We use, or plan to use, cookieless aggregate analytics (Plausible Analytics, hosted in the EU). It counts visits and pages without cookies, without persistent identifiers, and without building profiles of individual visitors.

3. Cookies

This website sets no advertising, analytics or profiling cookies, which is why you see no cookie banner. Only strictly necessary technical mechanisms are used (for example the bot-protection check described above).

4. Who processes data for us

• Brevo SAS (France, EU): email platform used to manage newsletter subscriptions and send the confirmation and newsletter emails.
• Cloudflare, Inc. (USA): website hosting, delivery and bot protection.
• Plausible Insights OÜ (Estonia, EU): cookieless visitor statistics (if/when enabled).

These providers process personal data only on our instructions as processors. We do not sell, rent or trade personal data to anyone. We disclose it beyond the processors above only if you direct us to, or where the law requires it.

5. Transfers outside the EEA

Cloudflare, Inc. is based in the USA. Transfers are safeguarded under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

6. How we protect data

We maintain technical and organizational safeguards appropriate to the risk: all connections to the website are encrypted, data is held with the processors listed above rather than on our own servers, and access is restricted to the people who need it to answer your inquiry or operate the newsletter.

7. How long we keep data

• Enquiries and related correspondence: for as long as needed to handle the matter, then up to 3 years after the last contact.
• Newsletter: until you unsubscribe. We then retain the record of your consent and its withdrawal for 4 years to be able to demonstrate compliance.
• Technical logs: typically no longer than 30 days.

8. Your rights

Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. To exercise any of these, email inquiry@aveoengineering.com. You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

9. Children

This website is aimed at professionals and businesses and is not directed at children. We do not knowingly collect personal data from children; if you believe a child has submitted data to us, contact us and we will delete it.

10. No automated decision-making

We do not use your data for automated decision-making or profiling.

11. Changes to this policy

We may update this policy as the website evolves. The current version is always published at this address. Material changes affecting newsletter processing will be announced by email.