Privacy and cookies

Who is responsible

MK Events & DMC, Monika Klomfarová, Italská 2581/67, Prague 2, Czech Republic. E-mail contact@mkevents.cz, telephone +420 732 800 658.

We are the controller of the data described below.

The contact form

The form asks for your name, your e-mail address and a description of your project of up to 6,000 characters. Those three are what an enquiry needs, and the form will not send without them. Company and country are optional and only help us judge what to propose, and you may attach up to three documents in PDF, DOC or DOCX format, each up to 8 MB.

None of this is required of you by law or by any contract. If you would rather not fill the form in, the only consequence is that no enquiry reaches us; you can write to contact@mkevents.cz instead.

When you send it, the form produces two e-mails: one to our mailbox and a confirmation to the address you gave. The mail leaves through our hosting provider’s mail server.

Nothing you send is stored on this website. There is no database and no copy of your message; attachments are read from the server’s temporary upload file, attached to the e-mail and gone as soon as the request ends. What remains is the e-mail itself, in our mailbox, with your documents attached to it. The server does write two small things of its own, and neither holds what you wrote: the timestamp file described under the next heading, and a line in the site’s error log if a message cannot be sent or a submission is rejected.

The legal basis is your own request: dealing with an enquiry about a possible programme is a step taken at your request before entering into a contract, Article 6(1)(b) of the GDPR. Since the website keeps nothing, how long the data lives is a question about our mailbox. Your enquiry stays there while we are discussing the project, and afterwards with the rest of our correspondence for as long as it could still matter to a booking, an invoice or a claim, after which we clear it out. Ask and we will delete it sooner, unless one of those reasons still stands, in which case we will tell you so.

Please send only what the enquiry needs. Your message arrives in an ordinary mailbox, so it is not the place for health, dietary or accessibility details about your group, or anything else sensitive about the people travelling; raise those with us directly and we will agree a proper way to handle them.

Keeping the form free of abuse

Three simple measures keep the form usable: a hidden field that bots tend to fill in, a minimum time a genuine person needs to complete it, and a limit on how many messages one internet connection can send.

The limit works without keeping your IP address: the server writes a small file named with a one-way hash (SHA-256) of the address and a secret value, holding nothing but the times of recent messages. Those files are cleared out once they are more than two hours old. Your address does appear in the notification e-mail that reaches us, so that we can recognise abuse.

The basis is our legitimate interest in a working contact form that is not flooded with spam, Article 6(1)(f).

Analytics, only if you agree to it

We use Google Analytics 4 (measurement ID G-DTKG4M6VP3) to see how many people visit and which pages they read. It loads only after you have accepted it on the banner, where accepting and refusing are equal choices. Until then nothing belonging to Google is loaded and no analytics cookie is set. If you refuse, the only thing that happens is that your refusal is remembered in this browser. If you ignore the banner, nothing is stored at all and it will ask again on your next visit.

What Google receives is the page you looked at and when, the address of the page that sent you, your device, browser and language, and the approximate location worked out from your IP address, which Google then discards, together with the random identifier held in the _ga cookie. Nothing you typed into the contact form is sent to Google, and neither is your name or your e-mail address.

Google is the recipient, and the data may be processed outside the European Economic Area, including in the United States, under the EU-U.S. Data Privacy Framework and the standard contractual clauses in Google’s data processing terms, which Google publishes. Write to contact@mkevents.cz if you would like a copy of those safeguards and we will point you to them.

Google keeps the event-level data for 14 months and then deletes it. The aggregated reports built from it last longer.

The legal basis is your consent, Article 6(1)(a), together with the ePrivacy rule on storing or reading information on your device. You can change your mind at any time: the Cookies button in the footer of every page brings the banner back, and choosing Decline there deletes the _ga cookies and stops the measurement. Withdrawing does not affect what was lawful before.

Cookies and what is kept in your browser

Two cookies and one local-storage entry are everything this site can leave on your device, and the two cookies only if you accepted analytics.

• _ga – set by Google Analytics to tell one visitor from another. A first-party cookie, expiring about two years after it is set or last refreshed.
• _ga_DTKG4M6VP3 – also Google Analytics, holding the state of your current visit; its name is the measurement ID without the G- prefix. A first-party cookie, refreshed each time you visit, and lasting up to about two years.
• mk-consent – not a cookie but an entry in your browser’s local storage, set by this site rather than by Google, holding your answer to the banner. It has no expiry date: it stays until you change your answer or clear your browser’s storage. It is written whether you accept or refuse, because it is what lets the site honour your choice, and it is not itself something we ask consent for.

What this site does not do

No advertising or remarketing tags, no social network pixels, no embedded maps or videos, no A/B testing, no session recording, no newsletter and no chat widget. The fonts are part of the site, not fetched from elsewhere. There is no profiling, no automated decision-making, and your data is never sold or shared beyond the parties named here.

Hosting and server logs

The site is hosted by Active24 / Websupport on servers in the European Union, and it is their mail server that carries the two e-mails the form sends. Like any web server, the host keeps standard access logs of the pages requested, the time and the IP address, as part of running the server and keeping it secure. Those logs are the host’s own, under its rules and its retention periods rather than ours, and we do not use them to analyse visits.

Separately, the site writes a line to its own error log when the contact form cannot send a message or a submission is rejected. It records the reason rather than your message, though a failed delivery can leave an e-mail address in it. The basis for both is our legitimate interest in a site that stays up and can be repaired, Article 6(1)(f).

Your rights

Under the GDPR you may:

• ask what data we hold about you, and get a copy
• have anything inaccurate corrected
• have your data erased
• ask us to restrict how we use it
• object to processing we base on legitimate interest
• receive your data in a common machine-readable format, or have us send it straight to someone else where that is workable
• withdraw your consent to analytics at any time, without affecting what was lawful before

Write to contact@mkevents.cz. We may need a question or two to be sure who we are talking to, and we answer within a month.

Complaints

If you think we have handled your data badly, tell us first; most things are quickly put right. You may also complain to a supervisory authority: ours is the Úřad pro ochranu osobních údajů, the Office for Personal Data Protection, at www.uoou.gov.cz, since the business is established in the Czech Republic. If you live or work elsewhere, you may complain to the authority in your own country instead.