Privacy policy

1. Who the controller is and how to contact us

The controller of personal data is Ladislav Blecha, ID No. (IČO) 01670816, registered office Hlohová 367, 326 00 Letkov, Czech Republic, a natural person entered in the Trade Licensing Register kept by the Pilsen City Authority (VAT payer from 1 November 2026), the operator of the omnicore.vision website and of the OmniCore Vision project ("we").

For matters concerning personal data, write to us at info [at] omnicore [dot] vision, or by post to the registered office. We have not appointed a data protection officer: we are not obliged to under Article 37(1) GDPR or Section 14 of Act No. 110/2019 Coll.

Processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR") and by Act No. 110/2019 Coll., on the processing of personal data.

2. Overview of processing

3. Inquiry form

What data we process

• the company name or ID No., your first name and surname and e-mail as you fill them in,
• what you need (a choice from the list) and your note, including any links and data you put in it yourself,
• the time of sending and the button on the website you used to open the form.

Please do not put data in the note that we do not need for the inquiry, especially other people's personal data (for example names of a competitor's employees) or sensitive data. A link to the tender and the company name or ID No. are enough.

Why and on what legal basis

We use the data to handle your inquiry: we prepare an analysis or an offer, get back to you and keep a record of our communication. If you inquire on your own behalf as a sole trader, we process the data to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). If you act as an employee or representative of a company or institution, the legal basis is our legitimate interest in answering the inquiry and discussing cooperation with your company (Art. 6(1)(f) GDPR).

We do not use the contact from an inquiry to send commercial communications, such as newsletters or offers you did not ask for, unless you give separate consent.

Filling in the form is voluntary; it is not a statutory or contractual requirement. We do need the fields marked with an asterisk (company, name, e-mail), though: without them we cannot reply.

4. Visiting the website

• Server logs. Every time a page loads, our server records the IP address, date and time, the request (page address), the result of the request and the size of the response, the referring page and the browser identification. They serve to keep the website running, detect attacks and fix errors; our legitimate interest is a secure and working website (Art. 6(1)(f) GDPR). The logs are deleted automatically after 15 days at the latest. We keep longer only an extract needed to investigate a specific security incident, until the incident is closed.
• Form protection. To prevent the form from being flooded, the server counts the attempts to send it from each IP address. It keeps this count only in working memory and stores it nowhere: our application deletes it after 11 minutes at the latest, the web server continuously as newer entries overwrite it, and at the latest when it restarts (Art. 6(1)(f) GDPR). Like every page load, the request itself also appears in the server logs.
• No cookies or tracking. The public website omnicore.vision uses no cookies or other storage of data in your browser, has no analytics or advertising tools and loads nothing from third-party servers (we host the fonts ourselves). That is why we do not need your consent to cookies.

5. When you write to us or call us

If you contact us by e-mail, WhatsApp, LinkedIn or phone, we process your contact details and the content of the message so that we can reply and deal with the matter. The legal basis and retention period are the same as for the inquiry form. Our AI assistant may first send an automatic reply to your message and ask for your name and the reason for the message; the substantive answer always comes from a person on our team.

LinkedIn. When you send us a message on LinkedIn or write a comment with a request under our post (for example "ROZBOR"), we record your name, company and job title as stated in your profile, the link to your profile and the text of the message or comment. We need the profile link to recognise you and to respect your refusal if you refuse further contact. We reply by LinkedIn message, or by e-mail if you send us your address. We do not use automatic replies on LinkedIn; a person always writes to you directly.

In person and by referral. When you contact us in person (for example at a professional event), or someone you know introduces us at your request, we record your name, company, the contact you or the person introducing us give us for this purpose, and what you are interested in. We do not store the name of the person who introduced us. The legal basis and retention period are the same as for the inquiry form.

6. When we work together

If you conclude a contract with us, we process contact and billing details and the communication about the assignment in order to perform the contract (Art. 6(1)(b) GDPR; for a company's contact person, our legitimate interest in performing the contract with the company under point (f)). We keep accounting and tax records because tax and accounting legislation requires us to (Art. 6(1)(c) GDPR). We keep the contract and related communication after the cooperation ends in case of a dispute (legitimate interest in the defence of legal claims, Art. 6(1)(f) GDPR).

We need contact and billing details (name or business name, registered office, ID No., where applicable VAT No.) to conclude and perform the contract, and we must state them on accounting and tax documents. Providing them is therefore both a contractual and a statutory requirement; without them we can neither conclude nor perform the contract.

Payments and invoicing. We issue and archive invoices ourselves and send them by e-mail. You can pay by bank transfer to our account with Air Bank a.s. or by card via the payment service Stripe. We process billing details, amounts, dates and status of payments and refunds and the related communication (Art. 6(1)(b) and (c) GDPR). You enter card details directly with Stripe; we neither see nor store them. We usually return money the same way it came in.

7. Data from public registers

Our service works with publicly available data on public procurement and contracts. Data about companies are not personal data; the names of people listed with companies, contracts and tenders, and data about sole traders, however, are personal data. We do not obtain these data directly from you, so we inform you about their processing under Article 14 GDPR.

• Sources: the Register of Contracts, the Public Procurement Bulletin and contracting authority profiles, the Commercial and Trade Licensing Registers (ARES) and publicly available company websites. All these sources are publicly accessible.
• Data: first name and surname, function, company, for sole traders also the ID No. and registered office, and data on contracts and tenders (contracting authority, subject, price, dates). We do not store work e-mails and phone numbers of people from the registers.
• Purposes: analyses of public procurement and contracts that we prepare for our clients. We may note companies (name, ID No., sector), but not the personal contacts of their people.
• Recipients: our clients, to whom we provide analyses, and the providers listed in section 8.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in providing services based on public data. We work primarily with company data and use personal data from the registers only to the extent they are published there and needed for the purpose.
• Contact with offers: we do not send you unsolicited commercial communications, whether by e-mail, SMS or chat apps (Section 7(2) of Act No. 480/2004 Coll.), and we do not call you with offers (Section 96 of Act No. 127/2005 Coll.). We get in touch only if you contact us first or give us your consent. Every message from us contains a simple way to refuse further contact.
• When we inform you: we do not store work contacts (e-mail or phone) from the registers, so we inform you through this page. If we ever changed that, we would first update this policy and send everyone whose contact we store this information in a separate message without any offer, within one month of obtaining it (Art. 14(3) GDPR).

8. Who works with the data

Only authorised members of our team work with the data. The following recipients may also have access to them:

• the server (hosting) provider in the Czech Republic: SecurityNet.cz s.r.o. (the Hukot.net service), where this website, the database of form inquiries and our internal systems run,
• the provider of the mailbox we use to communicate with you: info [at] omnicore [dot] vision (Czech Republic), and the operator of WhatsApp if you write to us through it,
• LinkedIn Ireland Unlimited Company (Ireland) if you communicate with us through LinkedIn; it processes messages and comments on its network as a separate controller under its own privacy policy,
• providers of artificial intelligence tools that help us analyse inquiries and prepare replies (cloud services established in the EU or the USA),
• providers of automation tools that connect our internal systems,
• Air Bank a.s. (Czech Republic), which holds our account, if you pay or we refund you by bank transfer,
• Stripe Payments Europe, Limited (Ireland), if you pay by card: it processes the payment under its agreement with us and some data (for example for fraud prevention and its own legal obligations) as a separate controller under its own privacy policy,
• our clients, to whom we provide analyses of public procurement and contracts; the analyses may contain data from public registers under section 7 (names of people listed with contracts and tenders and, for sole traders, data on their contracts and prices), which the clients then handle as separate controllers,
• public authorities, where the law requires us to disclose data.

Providers that process data on our behalf (processors) may handle them only on our instructions and on the basis of a data processing agreement. We will tell you the specific recipients on request. We do not sell or rent contact data from inquiries or from public registers.

The internal notification via Telegram contains only the information that a new inquiry has arrived and the chosen area of interest; it contains no name, company, contact or text of the inquiry.

9. Transfers outside the European Union

Some of the providers listed (especially providers of cloud, communication and AI services) or their subcontractors may process data outside the European Economic Area, mainly in the USA, or in other countries where they have data centres. Transfers to the USA take place on the basis of Commission Decision (EU) 2023/1795 on adequate protection (EU-U.S. Data Privacy Framework) where the recipient is certified under it, and otherwise, as for other countries without an adequacy decision, on the basis of standard contractual clauses under Commission Implementing Decision (EU) 2021/914 (Articles 45 and 46 GDPR). Stripe states that its US company Stripe, LLC is certified under the EU-U.S. Data Privacy Framework and that it otherwise uses standard contractual clauses. We will send you a copy of the relevant safeguards on request.

10. How long we keep data

11. Your rights

You have the right:

• to obtain confirmation from us as to whether we process your data, and a copy of them (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure of data if we no longer need them or process them unlawfully (Art. 17 GDPR),
• to restriction of processing, for example while the accuracy of the data is being verified (Art. 18 GDPR),
• to portability of data you provided to us in connection with concluding or performing a contract (Art. 20 GDPR),
• to be told which recipients we notified of a rectification, erasure or restriction of processing (Art. 19 GDPR).

Send your request to info [at] omnicore [dot] vision. We handle it free of charge without undue delay, within one month at the latest; for complex requests we may extend the period by a further two months and will tell you why. So that we do not disclose data to someone else, we may ask you to verify your identity. On request we will tell you how we balanced our legitimate interest against your interests.

If you want us to erase the record of your refusal of contact as well, we will. We then cannot ensure that we will not contact you again in the future.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Praha 7 – Holešovice, e-mail posta@uoou.gov.cz, data box ID qkbaa2n, uoou.gov.cz.

12. Automated decision-making and artificial intelligence

There is no automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Artificial intelligence tools help us sort inquiries, prepare analyses and draft replies. Our AI assistant may send an initial automatic reply to a message (section 5); a person always decides on the content of an offer, the price and any cooperation.

13. Security

The website and the form communicate over an encrypted connection (HTTPS). The database of inquiries and contacts is stored on our server and only authorised team members with an access key can reach it. We choose providers that offer sufficient guarantees of data protection.

14. Changes to this policy

We update this policy when the way we work with data or the legislation changes. The current version is always on this page and the effective date is at the top.