This document has not yet been reviewed by an attorney and is not in effect. Passages marked [[ TO COMPLETE: … ]] are to be completed by the operator or by counsel.
Are your details in a public business record? This policy covers visitors of the website. If you are an officer, registered agent or sole proprietor and want to know how the business database handles your details, read the Data Notice. To ask for removal, use Remove my data.
The website flfirms.com is operated by:
Martin Adamec (sole proprietor)
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
Czech business ID (IČO): 19552319
Email: info@flfirms.com
Phone: +420 720 950 900 (Central European Time)
The operator is established in the European Union. The EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") therefore applies to the processing described here, wherever you are located (Article 3(1) GDPR), and the operator is the "controller" within the meaning of Article 4(7) GDPR. More about the operator: Company details.
This policy explains how we handle personal information of people who visit this website, who contact us, and who buy from us or act as a contact person of a customer. It does not cover the records in our business database; for those, see the Data Notice.
The website runs on a virtual private server located in the European Union that we rent from Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. [[ TO COMPLETE: confirm the hosting provider and the data center location (EU member state) from the hosting account ]] The provider acts as our processor under a contract that meets Article 28 GDPR. [[ TO COMPLETE: confirm that the data processing agreement with the hosting provider is in place ]]
When you open a page, the web server processes technical data sent by your browser and stores it in log files:
Purpose: delivering the website and keeping it stable and secure, in particular detecting and stopping attacks and abuse (for example by limiting the number of requests per IP address). Legal basis: Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Retention: log files are deleted [[ TO COMPLETE: log retention period, e.g. 14 days – confirm the logrotate setting on the server ]] after they are created, unless they are needed longer to investigate a specific security incident.
The connection to the website is encrypted with TLS.
If you contact us through the contact form, by email or by phone, we process what you tell us. In the contact form this is: your name, company, tax or registration number, email address, phone number, what you are interested in, the market, the industry and your message. Required fields are marked. To protect the form against automated submissions (spam), we evaluate the time of submission and a control field that is invisible to people. The message we receive also contains the IP address of the sending device and its user agent (browser and operating system). [[ TO COMPLETE: align with the final version of /api/kontakt.php (fields transmitted, IP address, user agent, rate limiting) ]]
Purpose: answering your inquiry, preparing a quote and corresponding with you; protection against abuse. Legal basis: Article 6(1)(b) GDPR where your inquiry aims at a contract (steps prior to entering into a contract); otherwise Article 6(1)(f) GDPR, our legitimate interest being to answer inquiries and to protect the form against abuse. [[ TO COMPLETE: counsel – the checkbox in the contact form: decide whether it is a consent (Article 6(1)(a)) or only an acknowledgment of this policy, and align the form wording ]]
How it works: the form is sent to our server and forwarded from there as an email to our mailbox info@flfirms.com. The mailbox is operated by [[ TO COMPLETE: email provider, address, data processing agreement ]]. If the email cannot be delivered, the server temporarily stores the inquiry in a directory that is not publicly accessible, so that it is not lost. [[ TO COMPLETE: retention period of these backup copies ]]
Retention: inquiries that do not lead to a contract are deleted [[ TO COMPLETE: retention period for inquiries, e.g. 12 months after the correspondence ends ]]. If a contract is concluded, Section 6 applies.
Through the form on the page Remove my data we process the details needed to handle your request: the company or name, the Florida document number or other registration number, the details you want removed, your email address for our reply, and your message. As with the contact form, the IP address and user agent of the sending device are transmitted with the request.
Purpose: handling your request, being able to show that it was handled, and keeping a suppression list so that the details are not added again when the database is next updated from its sources. Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 12, 17 and 21 GDPR; for the suppression list also Article 6(1)(f) GDPR. Retention: [[ TO COMPLETE: retention period of removal correspondence and of the suppression list ]]
For quotes, performance of contracts and invoicing we process data of the customer and its contact persons (name, company, address, contact details, tax and registration numbers, order and payment data). Legal basis: Article 6(1)(b) GDPR (contract) and Article 6(1)(c) GDPR (statutory record-keeping duties). For contact persons of business customers the basis is Article 6(1)(f) GDPR; our legitimate interest is communication with the contracting party.
Retention: contract data is kept until the limitation periods have expired; accounting records and invoices are kept for the statutory retention periods. [[ TO COMPLETE: applicable retention periods under Czech tax and accounting law – accountant ]]
At present this website sets no cookies and stores no information on your device. It uses no analytics or advertising services (such as Google Analytics, Google Ads or the Meta Pixel), no social media plugins, and it loads no fonts, scripts or other content from third-party servers; everything is delivered from our own server. For that reason no cookie banner is shown, and there is no cross-context behavioral or targeted advertising to opt out of.
Links to external websites (for example to public registers and government agencies) are recognizable as such. Data is sent to the operator of such a website only when you click the link; that operator is responsible for its own processing.
Personal information is disclosed only to those who need it for the purposes above:
We do not sell, rent or trade the personal information of website visitors, of people who contact us or of customers, and we do not share it with third parties for their own marketing.
Our server is located in the European Union. If you use this website from the United States or another country outside the EU, the information you send us is therefore transmitted to and processed in the EU, whose data protection rules may differ from those of your country.
We do not transfer the personal information described in this policy from the EU to recipients in other countries, except that our replies and deliveries naturally reach you where you are. [[ TO COMPLETE: confirm – check the sub-processors of the hosting and email providers; if a provider outside the EU/EEA is used, name the country and the safeguard under Articles 44 et seq. GDPR ]]
Because the operator is established in the EU, you have the following rights regardless of your citizenship or place of residence, subject to the conditions set by GDPR:
Right to object (Article 21 GDPR): where we process your data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. An informal message to info@flfirms.com is enough.
To exercise a right, write to the contact details in Section 1. We reply without undue delay and at the latest within one month (Article 12(3) GDPR). You are neither legally nor contractually required to give us personal data; without the fields marked as required, however, we cannot handle an inquiry or a request. We do not use automated decision-making or profiling within the meaning of Article 22 GDPR.
You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority competent for the operator is:
Úřad pro ochranu osobních údajů (Office for Personal Data Protection, Czech Republic)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.gov.cz
If you live or work in another EU or EEA country, you may also contact the authority of that country.
No sale of visitor information. We do not sell personal information of website visitors, of people who contact us or of customers, and we do not use it for targeted advertising. What we offer for sale are exports of business records compiled from public sources; that activity is described separately in the Data Notice.
Florida Digital Bill of Rights. The consumer rights and controller duties of the Florida Digital Bill of Rights (Fla. Stat. §§ 501.701–501.722) apply to a "controller," which Fla. Stat. § 501.702(9) defines as a for-profit business that conducts business in Florida, makes more than $1 billion in global gross annual revenues, and in addition derives at least 50 percent of those revenues from the sale of advertisements online, operates a consumer smart speaker and voice command service, or operates an app store offering at least 250,000 applications. The operator of this website does not meet these thresholds, so those provisions do not apply to it.
Sensitive data. A separate provision, Fla. Stat. § 501.715, applies without the revenue threshold: a for-profit business that conducts business in Florida and collects personal data about consumers may not sell sensitive data without the consumer's prior consent. We do not collect or sell sensitive data as defined in § 501.702(31) (such as data revealing racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation or immigration status, genetic or biometric data, data of a known child, or precise geolocation data).
Other states. We have not identified a comprehensive state privacy law whose applicability thresholds the operator meets. [[ TO COMPLETE: counsel – confirm for California (CCPA/CPRA, including the data broker registration rules) and other states once the customer base and the data set are known ]]
Whatever state you live in, you may use the rights described in Section 10; we do not treat requests differently depending on where you live.
Note for counsel (remove before publishing): (1) Please confirm the reading of § 501.702(9) and § 501.715. Under § 501.702(8) a "consumer" is a Florida resident "acting only in an individual or household context," and under § 501.702(19) and (28) "personal data" excludes "publicly available information," which includes information lawfully made available through government records. (2) Please confirm that the statement "we do not sell personal information of website visitors" is accurate and sufficiently distinguished from the sale of business records, so that it is not misleading under Section 5 of the FTC Act. (3) Whether a "Do Not Sell or Share" link or a recognition of Global Privacy Control signals is advisable although no law we identified requires it at present.
This website is a business-to-business service. It is not directed to children under 13 (the age relevant under the U.S. Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506) or to minors under 16 (the default age for a child's consent under Article 8 GDPR), and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.
We update this policy when the processing or the law changes, in particular before we start using analytics or advertising services. The version published at flfirms.com/privacy/ applies.
Last updated: October 2026 (draft)
