Privacy Policy

1. Data controller

The data controller is Český Institut pro AI a Data z.ú. (CIAD), a registered institute with its seat at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, Company ID (IČO) 297 52 736, registered under file no. U 1452 with the Municipal Court in Prague. Contact email: office@ciad.cz.

We have not appointed a Data Protection Officer (DPO). For questions about personal data and to exercise your rights, contact us at office@ciad.cz.

This policy describes what personal data we process, for what purpose, and what rights you have.

2. What data we process

• Email address and optional name · when subscribing to the weekly newsletter. The server stores the time, IP address, browser identifier (User-Agent) and form label with the signup. If you tick the newsletter box in another of our forms (downloadable pack, contact form below a test or analysis result), we also take the name from that form if you filled it in.
• Service inquiry and consultation booking · depending on the form, first name, surname, email, phone, company, website, area and subject of interest, number of people, indicative budget, message and the chosen consultation slot. The server stores the time, IP address, browser identifier (User-Agent), form label and your consent choices with the inquiry and, after marketing consent, also the campaign source (see section 5). We may add public data about the company and its representatives from ARES, the Commercial Register, the Collection of Deeds and the company website to a company inquiry.
• Inquiry from a Facebook or Instagram lead ad form · name, email, phone, company where given and answers to the form questions, together with the time, campaign name and identifier, form identifier and Meta lead identifier. The form is operated by Meta Platforms Ireland Limited, from which we take the data into our inquiry records.
• Downloadable pack · name, email, time, IP address, browser identifier, the chosen pack, the channel you came from (web, Instagram, Facebook), the version of the form text and whether you ticked the newsletter box. Your browser notes in local storage that you unlocked the pack (see section 5).
• Keyword comment under our Instagram or Facebook post · username, account identifier, comment and post identifiers, the chosen pack and the status of our reply. We do not store the comment text.
• Online meeting recording · if the assistant "Záznam schůzky (CIAD)" joins a meeting with CIAD, an audio and video recording is made (voice, image and display names of participants and content shared in the meeting), together with its transcript and summary.
• Client portal and academy · for clients with portal or academy access, name, work email, username, a secure password hash, role, login sessions, messages to support, consultations and training progress.
• Business contacts at companies · name and position of the contact person, work email or phone, company name and Company ID, the source of the contact and the communication history including your replies. We obtain this data mainly from public registers (ARES, Commercial Register) and company websites.
• Contact correspondence · data provided in an email, press inquiry, training request or security report. Emails to office@ciad.cz and info@ciad.cz are logged in our inquiry records.
• Contacts of journalists and newsrooms · name, work email, media outlet, section or role, links to no more than five public articles with headline and publication date, topics the author covers, outreach order, date and source of the contact and the history of our communication. We obtain contacts from public media pages (newsroom contacts and author profiles) and, for some addresses, from the publicly documented email format of the outlet. We do not store full article texts or journalists' opinions.
• Access logs · IP address, access time, URL, browser. Kept for a maximum of 30 days in server operational records.
• Answers and technical data in the indicative NIS2 and AI Act test · when you complete the test at /nis2-test/, we submit the selected answers, result band, IP address and browser identifier (User-Agent); the server adds the submission time and a technical submission identifier to the record. The test is therefore not anonymous. This step does not submit your name, email address or free text. If you separately submit the voluntary contact form below the result, your contact details are accompanied by a prefilled summary of the result band, organisation type, selected AI uses and status of internal rules.
• Website analysis query · when you run the analysis at /pokuty-ai-act/, we submit the company name, Company ID or website address you enter. The server adds the time, the company found and its Company ID, the website domain, the resulting score and finding identifiers. We do not store the IP address with the record; it is used only transiently to limit the number of queries. To find the company we query the public ARES register of the Ministry of Finance; if you do not enter a website, we look it up by company name in the Seznam.cz search engine. We load the website as an ordinary visitor would. Email and phone shown on the company website are prefilled into the contact form below the result; they are only sent if you submit that form yourself. For an in-depth review we pass the public website text and register data to a language model through OpenRouter, Inc. (USA). Free models may retain inputs and use them for improvement, so enter only a company name, Company ID or website address.
• Availability request · when the booking calendar is displayed, the browser sends a technical request for available slots to CIAD's own server. The request contains no form fields, name, email address or phone number; as with every network request, the server nevertheless receives the IP address, User-Agent, time and requested URL.

The forms on this website include a hidden field to detect automated bots (a "honeypot"). The field is invisible to human users and normally stays empty · if a bot fills it in, the request is rejected; the field itself is not stored or further processed by CIAD.

3. Purpose and legal basis of processing

Newsletter delivery: We process your email address and any optional name you provide solely to deliver and personalise the weekly CIAD newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). Newsletter signup is also governed by Czech Act No. 480/2004 Coll. on certain information society services (§ 7(2)) · the newsletter, as a commercial communication, is sent only on the basis of explicit prior consent confirmed by clicking a confirmation link (double opt-in). You may withdraw consent at any time by unsubscribing (link in every email) or by writing to office@ciad.cz. Providing an email address is voluntary and not a statutory or contractual obligation; without it, the newsletter cannot be delivered. The name is optional and you can subscribe without it.

Contact correspondence: Personal data provided in an email, press inquiry or training request are processed to handle your request. The legal basis is the controller's legitimate interest (Art. 6(1)(f) GDPR). Data is retained for as long as necessary to handle the request, generally no more than 3 years from the last contact.

Service inquiry and consultation booking: We process data from the inquiry and booking forms and from a Facebook or Instagram lead ad form to handle your inquiry, arrange a consultation and prepare an offer. The legal basis is steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for company representatives, our legitimate interest in handling their company's inquiry (Art. 6(1)(f) GDPR). We add public company data from registers and from its website on the basis of our legitimate interest in preparing an offer that fits the company (Art. 6(1)(f) GDPR). We may use language models for this (see section 5), but a person always decides on next steps. Please do not enter health data or other special categories of personal data in the form. We will not start sending you the newsletter because of an inquiry; only if you tick the separate box and confirm the signup by email. Providing data in the inquiry and for the downloadable pack is voluntary; without contact details, however, we cannot reply or give you access to the pack.

Downloadable pack: We process your name and email to give you access to the requested pack and email you a link to it. The legal basis is handling your request (Art. 6(1)(b) GDPR). We process technical data, the channel and the form-text version on the basis of our legitimate interest in documenting what we told you at submission, protecting the form against abuse and evaluating where people come from (Art. 6(1)(f) GDPR). You get the pack without the newsletter. We send the newsletter only if you tick the separate box and confirm the signup by email.

Keyword comment: When you write a keyword under our Instagram or Facebook post, we send you a link to the pack. We process the comment data to handle your request and avoid replying twice. The legal basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

Online meeting recording: We make the recording, transcript and summary to keep an accurate record of the meeting and follow up on what was agreed. The legal basis is our legitimate interest in documenting the meeting (Art. 6(1)(f) GDPR). The assistant joins the meeting under the name "Záznam schůzky (CIAD)". If you do not want to be recorded, say so at the start of the meeting or at any time during it, or write it in the chat. We will then not record, or we will stop recording and delete the parts already recorded. You can also object later at office@ciad.cz.

Client portal and academy: We process the account and portal data to provide the agreed services, consultations and training (Art. 6(1)(b) GDPR). For employees and representatives of a client, the legal basis is our legitimate interest in performing the contract with their organisation (Art. 6(1)(f) GDPR). We process login sessions for account security (Art. 6(1)(f) GDPR).

Business outreach: We offer our services to companies and their representatives, in particular audits of compliance with the Artificial Intelligence Act and training. The legal basis is our legitimate interest in offering services to companies (Art. 6(1)(f) GDPR). We use work contact details only. We sort replies to our messages with the help of a language model into interest, refusal or question, and the model suggests a reply. A person always decides on the reply, whether to send it and on next steps. You can object to processing for direct marketing at any time: just reply STOP or write to office@ciad.cz. We will not send you any further commercial communications and will keep your address or number only on a suppression list so that we do not contact you again.

Outreach to journalists and newsrooms: We write to journalists and newsrooms individually and offer CIAD data and commentary as material for their own articles. The purpose is offering data to the media. The legal basis is the controller's legitimate interest (Art. 6(1)(f) GDPR) in sharing publicly available data and the institute's research results with people who report on these topics professionally. We use only work contact details published by the newsroom or the author, and links to their public articles, so that we offer a topic matching their section. We do not evaluate journalists' opinions, and we do not buy contacts or provide them to any recipient other than the processors listed in section 5. Every message states the sender, and messages to named journalists also state the source of the contact. A STOP reply or any other refusal is treated as an objection under Art. 21 GDPR and we send no further messages.

Indicative test statistics: We process the answers, result band, submission time, technical submission identifier, IP address and browser identifier on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR) to assess aggregate preparedness among Czech organisations and improve the test. Because technical identifiers are stored, the data is not anonymous. Any public summary will be aggregated and will not identify individual people or organisations.

Website analysis: We process the query and a summary of the result on the basis of the controller's legitimate interest (Art. 6(1)(f) GDPR) in operating the service, preventing abuse and assessing in aggregate which companies and sectors use the analysis. Records are deleted after 30 days. For the in-depth review we pass the public website text and register data to the processor OpenRouter, Inc. (see sections 5 and 7); we do not pass the records to any other recipient.

Operational logs: Retained on the basis of the controller's legitimate interest in ensuring the security and functionality of the web service (Art. 6(1)(f) GDPR). The interest in security and operational stability outweighs the impact on visitors, since logs are kept for a maximum of 30 days and are not shared with third parties.

Whether you must provide data: No law requires you to provide personal data and our forms are voluntary. A contact detail is, however, necessary for us to handle an enquiry and negotiate a contract, or to send a downloadable pack or the newsletter. Without it we cannot process the request. Optional fields may be left blank. Login details for the client portal are necessary to perform the contract.

4. Retention period

We retain your email address and any optional name you provide for as long as you remain subscribed to the newsletter. After unsubscribing, data is deleted within 30 days.

Contact correspondence is generally retained for no more than 3 years from the last contact, or as long as necessary to resolve the matter.

Inquiries, including lead ad inquiries and added company data, are retained for no more than 3 years from the last contact. If we conclude a contract, we keep them for its duration and then for as long as required by law or for the protection of our legal claims.

Data from the downloadable-pack form is retained for no more than 12 months from submission. If you also subscribed to the newsletter, the subscription period applies to your email and name.

Records of keyword comments are deleted after 180 days; records of comments that needed no reply are deleted after 14 days.

A meeting recording, its transcript and summary are retained for no more than 24 months from the meeting.

Client portal and academy accounts are retained for the duration of the cooperation and no more than 3 years after it ends.

Business contacts at companies are retained for no more than 24 months from the last contact. If you decline further outreach, we keep only your address or number on a suppression list.

Database backups containing inquiry records are retained for no more than 12 months.

Contacts of journalists and newsrooms are retained for no more than 24 months from the last contact. If you decline further messages, we keep only your email address on a suppression list so that we do not write to you again; other data is deleted.

Server operational logs and website analysis records are deleted after 30 days.

Records of the NIS2 and AI Act orientation test, including the IP address and browser identifier, are retained for no more than 12 months from submission.

5. Recipients of personal data

We run the website, forms and inquiry records on CIAD's own servers rented from Contabo GmbH in Germany (EEA), which processes data for us as the hosting provider.

Other processors are: Google (Gmail for email correspondence, Google Drive for database backups and for meeting recordings, transcripts and summaries); Anthropic, PBC (USA) for adding data to inquiries and for meeting summaries; NVIDIA Corporation (USA) for adding data to inquiries; Groq, Inc. (USA) for meeting transcription; OpenRouter, Inc. (USA) for the in-depth review in the website analysis (providers of free models to which OpenRouter routes the request may also process the public website text and registry data for their own purposes); and a provider of a language-model interface for sorting replies to our messages, whose identity we will disclose on request. We receive lead ad inquiries from Meta Platforms Ireland Limited.

Newsletter signups and delivery are processed by a self-hosted Listmonk instance (newsletter.ciad.cz) operated on a CIAD server in Germany (EEA). Signup uses double opt-in; the platform records the timestamp of consent and IP address in line with Art. 7(1) GDPR (demonstrability of consent). Listmonk's operational logs are retained on the same terms as other server logs · max. 30 days. Unsubscribing is available via a link in every email.

We prepare and send emails to journalists and newsrooms through Google's Gmail service, so a copy of that correspondence is also stored with Google. CIAD keeps the contact list itself; a copy is stored with Google (Gmail) as our processor, and we do not provide it to any other recipient.

We use Google Tag Manager to manage optional tags from Google Ireland Limited. It is not loaded when cookies are rejected or when a visitor consents only to marketing. It loads only after analytics consent; only then can it load Google Analytics 4 (GA4, measurement ID G-4W8JRQ1F44). Before loading, Google Consent Mode sets analytics and advertising storage, advertising user data and ad personalisation to denied. An analytics-only choice keeps advertising consent denied.

After analytics consent, GA4 measures aggregate traffic, landing and most-viewed pages, engagement and website events. We added measurements for categories of internal-link and contact-call-to-action clicks, form starts, submitted site searches without the search text, and reaching 50% and 90% of a page. These events contain no form field values or search text; page and referrer locations have query parameters and URL fragments removed before sending. Engagement time comes from standard GA4 measurement. The CIAD team panel shows aggregate counts by day, page, event and channel; it does not show visitor identities or individual histories. CIAD's own aggregate campaign measurement stores daily counts only. The IP address is used only transiently to limit abuse and is not stored with an analytics event. Daily aggregate counts are retained for no more than 400 days. GA4 retention depends on the service settings. Marketing consent enables campaign attribution, marketing tags, Meta Pixel provided by Meta Platforms Ireland Limited, and the ChatGPT Ads measurement pixel provided by OpenAI Ireland Limited; these tags do not load GA4. Meta and OpenAI receive a page-view event only after marketing consent. Automatic matching against form fields is switched off for this pixel, so it does not read or send contact fields. After an inquiry is actually accepted, the website may send a lead event to GA4 only after analytics consent and to Meta and OpenAI only after marketing consent. A random opaque identifier links the same event in the browser and any configured server endpoint; it contains no form content. Depending on the active tag, providers may receive the canonical page path, referrer, IP address, technical device and browser data, and events measured by that tag. Browser events contain no contact-form fields or free text. After marketing consent, once an inquiry is accepted we may also pass your email to Meta through a server interface (Conversions API), but only as a one-way SHA-256 hash, so that Meta can attribute the inquiry to a campaign. The website does not use optional analytics or marketing cookies until you consent. See the Google Privacy Policy, Meta Privacy Policy, Meta Privacy Centre and the OpenAI EEA Privacy Policy. Provider retention depends on the service configuration and provider policy; CIAD retains its own attribution record for no more than 90 days.

We store the following items in browser local or session storage:

The items above are set by CIAD itself. Only after your consent may Google, Meta and OpenAI set their own cookies, in particular these:

Until you give consent, none of these cookies is created · the tools that set them are not loaded at all. On withdrawal we attempt to remove them; cookies the browser does not expose to the site for security reasons can be cleared in your browser settings.

You can change your choices at any time using "Privacy settings" in the site footer. When you change a choice, we update Google Consent Mode. On withdrawal, we delete CIAD's stored attribution, attempt to remove accessible first-party analytics and marketing cookies, and reload the page without the withdrawn tools. Withdrawal does not affect processing that took place before it.

6. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, and to withdraw consent.

Data portability (Art. 20 GDPR): The right to portability applies only to processing based on your consent or a contract · in practice, this means data you provided yourself in the newsletter, an inquiry, the downloadable-pack form and the client portal. It does not apply to processing based on legitimate interest (contact correspondence, logs).

Right to object (Art. 21): You have the right to object to the processing of your personal data where processing is based on legitimate interest or is for direct marketing purposes. You can object to direct marketing at any time and without giving reasons; we will then no longer process your data for that purpose.

Automated decision-making (Art. 22): We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects. We use language models as an aid: they suggest how to sort replies, summarise meetings and add company data. A person always decides whether and how we reply, whom we deal with and what we offer.

You may lodge a complaint with the supervisory authority · the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.gov.cz, website: uoou.gov.cz.

To exercise your rights, contact office@ciad.cz. We respond to your request without undue delay and at the latest within one month of receiving it. In complex cases or where there are many requests, we may extend this period by a further two months; we will inform you of the extension and the reasons within one month of receiving the request.

7. International transfers

CIAD's own server processing and Listmonk run in the EEA. After your optional consent, Google, Meta and OpenAI may also process data in countries outside the EEA, particularly the United States. Google may also process copies of email correspondence in Gmail and files on Google Drive outside the EEA. The providers state that they use applicable GDPR safeguards, such as an adequacy decision, the EU-US Data Privacy Framework or Standard Contractual Clauses, depending on the transfer. See Google's international data-transfer information, the Meta Privacy Policy and the OpenAI EEA Privacy Policy.

Language-model and transcription providers in the United States: for Anthropic, PBC and Groq, Inc., the transfer relies on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), which form part of their data processing agreements. NVIDIA Corporation is certified under the EU-US Data Privacy Framework. OpenRouter, Inc. is not certified under that framework, so we do not rely on an adequacy decision and the transfer is covered by Standard Contractual Clauses (Module 2) in its data processing agreement. For other recipients, we will tell you their identity and place of processing on request. You can request a copy of the Standard Contractual Clauses at office@ciad.cz.

8. Security and incident reporting

In the event of a personal data breach, we follow Art. 33 and 34 GDPR · we report the incident to the Czech Office for Personal Data Protection within 72 hours of becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of individuals, and in the case of high risk we inform the affected data subjects directly. Report website security vulnerabilities to office@ciad.cz.

9. AI use in content production

Part of the news and blog content on the CIAD website (published in the Aktuality / "News" section) is prepared and published by an automated editorial system using artificial intelligence tools (large language models). The system compiles a Czech-language article from publicly available sources according to fixed editorial rules: it verifies relevance and facts against multiple independent sources, removes duplicates, and checks that the content matches the sources; each article lists the sources used. CIAD bears editorial responsibility for the resulting content and reviews outputs on an ongoing basis, correcting or withdrawing articles where inaccuracies are found. You may send a correction request to office@ciad.cz. Articles produced this way are clearly labelled.

Where such content mentions specific individuals (typically public representatives of companies, or quoted experts), processing of their personal data takes place under the journalistic exemption of Art. 85 GDPR and § 17 of Czech Act No. 110/2019 Coll. It is limited to their professional role and relevant, publicly made statements, and does not include unnecessary personal data. An objection to processing or a correction request can be submitted to office@ciad.cz.

Generating a draft text using artificial intelligence does not constitute automated decision-making with legal effects on individuals within the meaning of Art. 22 GDPR, see section 6.

10. Internal CIAD API v2 tool and YouTube Data API

To manage CIAD's official YouTube channel, the institute uses the internal tool CIAD API v2, which accesses YouTube channel data (video statistics, video uploads) through YouTube Data API v3. Access is limited to the CIAD team and serves solely to manage the institute's own channel. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Changes to this policy

This policy may be updated from time to time. The current version is always available at ciad.cz/zasady-ochrany-dat (Czech, legally binding) and ciad.cz/en/privacy.

Last updated: 14 October 2026