Privacy Notice

Critical Web Ops is operated by Bc. Michal Poluch in the Czech Republic, business ID 75702592, VAT/tax ID CZ7901204608. Business correspondence starts by email. A postal contact and invoice details are provided before acceptance of paid work and on verified business, legal, or data-protection request.

Privacy requests: hello@criticalwebops.com. General service contact: hello@criticalwebops.com. Security contact: hello@criticalwebops.com.

For website visits, service inquiries, qualification, orders, billing, support records, legal records, and our own business administration, Critical Web Ops normally acts as an independent controller.

When we access a client website, hosting account, logs, checkout records, customer records, analytics, or payment-provider diagnostics only to deliver the accepted service, we may act as a processor for the client. In that case the client remains responsible for its own lawful basis, notices, access rights, and instructions, and a data processing agreement must be agreed where GDPR processor work is involved.

• Contact data: name, email address, company, role, country, timezone, billing contact, and messages.
• Free diagnostic data: submitted website URL, work email, authorization confirmation, diagnostic result, request time, report identifier, optional report-email request, and any reply requesting a follow-up.
• Project intake data: website URL, symptoms, recent changes, screenshots, logs, plugin/theme/hosting details, analytics context, and business impact notes.
• Access-related data: temporary account identifiers, SFTP host, port, username, root path, independently confirmed host-key fingerprint, access approval records, access-removal records, audit notes, and security-relevant communications. Do not send passwords, private keys, or recovery codes in plain email or public forms.
• Client-site diagnostic data: error logs, server logs, order-flow evidence, screenshots, configuration exports, plugin lists, and limited customer or order data where strictly necessary for the agreed work.
• Billing and tax data: order scope, invoices, payment status, VAT/tax treatment, payment references, refunds, accounting records, and related communications.
• Website and security data: IP-derived security logs, browser metadata, basic analytics, spam prevention signals, and consent records where enabled.

• Pre-contract and contract: reviewing inquiries, qualifying fit, quoting work, delivering diagnostics, preparing reports, supporting the engagement, and handling payment.
• Legitimate interests: securing the website and client engagements, preventing abuse, documenting decisions, improving service quality, managing disputes, and maintaining business records.
• Legal obligations: accounting, tax, compliance, sanctions, dispute, and statutory recordkeeping duties.
• Consent: optional marketing, testimonials, non-essential analytics, or other optional processing where consent is required.
• Client instructions: where Critical Web Ops acts as processor for client-site data under a client order or data processing agreement.

• Vercel: website hosting, form processing, deployment and function logs, TLS, edge delivery, operational metadata, and short-lived isolated Sandbox workers used for accepted access-assisted diagnostics.
• Cloudflare: domain DNS and domain security controls.
• Google Workspace: business email and service correspondence sent to hello@criticalwebops.com.
• Cloudflare Turnstile: bot and abuse prevention for the public free-diagnostic form, including token validation and related security metadata.
• Upstash Redis: short-lived hashed network and domain identifiers for public-diagnostic abuse prevention, hashed SFTP invitation and session tokens, and encrypted SFTP intake envelopes linked only to opaque job identifiers.
• A payment, accounting, secure-access, or project-delivery provider is used only when identified in the accepted order, invoice, or data-processing terms relevant to that engagement.

Critical Web Ops may use automation to route intake forms, send confirmation emails, prepare internal tasks, create project notes, generate checklists, and remind about quote, payment, access, delivery, and follow-up steps.

Automation is used for operations and triage support. It does not automatically accept priority work, approve access, decide legal rights, or make a similarly significant decision about a person.

Public intake may submit a structured request through the website form and send it to the business mailbox. If email delivery is unavailable, the form may prepare an email draft from the visitor's own mail client. A CRM, newsletter, retargeting, or payment automation must not be enabled until this notice and the processor list are updated.

The free diagnostic performs bounded public DNS and TLS checks plus a limited automated read of the submitted domain's homepage, standard robots, sitemap, and security-contact locations. It does not perform a broad crawl, login, form submission, purchase, or exploit attempt. The result is not used to make a legal or similarly significant decision. If a report copy is requested, the email asks the recipient to reply YES before one diagnostic follow-up is permitted; no offer is sent merely because an address was entered or the report copy was requested.

Some providers may process data outside the EU, EEA, UK, or Switzerland. Where required, Critical Web Ops relies on an appropriate safeguard such as an adequacy decision, the EU-U.S. Data Privacy Framework for certified recipients, Standard Contractual Clauses, a transfer risk assessment, and supplementary measures where needed.

Client-site data should be minimized before transfer. Sensitive exports should not be moved into general-purpose tools unless the accepted order and data-processing terms allow it.

• Unqualified inquiries: normally up to 18 months unless a shorter period is requested or a legal reason requires retention.
• Accepted project records, audit evidence, delivery notes, and dispute records: normally up to 6 years unless a longer legal, accounting, tax, or dispute period applies.
• Billing, tax, invoice, and accounting records: retained for the statutory period required by applicable tax and accounting law.
• Access credentials and temporary accounts: removed, revoked, rotated, or deleted after the engagement or when no longer needed. Access-removal evidence may be retained as part of project records.
• SFTP access diagnostics: invitation tokens normally expire within 24 hours, access sessions within 2 hours, isolated key workers within 24 hours, and encrypted intake or diagnostic-report job records within 14 days unless an accepted engagement or legal obligation requires a different period. Encrypted intake details are removed when execution reaches a terminal state.
• Security logs: normally retained only as long as needed for security, abuse prevention, diagnostics, and incident evidence.
• Marketing consent records: retained while consent remains active and for a reasonable proof period after withdrawal.

Our operating model is least-privilege access, temporary accounts, secure credential sharing, backup-first changes, staging where possible, documented change sequence, access-removal reminders, and limited storage of client data.

No website or service can promise absolute security. If a security incident affects personal data, Critical Web Ops will assess investigation, mitigation, client notice, data-subject notice, and supervisory-authority notification duties under applicable law.

For GDPR-covered individuals, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to a supervisory authority.

Critical Web Ops responds to valid requests without undue delay and normally within one month, subject to identity verification, client-controller instructions where we act as processor, and legal limits.

The supervisory authority in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

The current website setup uses necessary hosting, security, and delivery logs and may set a short-lived secure, HTTP-only session cookie after a valid one-time SFTP access invitation is exchanged. It does not use advertising cookies or cross-site behavioral advertising. Optional privacy-aware analytics may be added only after the notice, processor record, and consent or opt-out position are checked.

If non-essential analytics, advertising pixels, retargeting, session replay, or similar tools are added, the site must update this notice and add the required consent or opt-out mechanism before those tools are enabled.

Critical Web Ops does not intend to sell personal information or share personal information for cross-context behavioral advertising.

If CCPA/CPRA or another US state privacy law applies to Critical Web Ops or a client-specific processing activity, the required categories, purposes, retention periods, rights instructions, and opt-out mechanisms are added before that processing starts.