Privacy Policy

1. Scope and privacy contact

This policy explains personal data processing for the UltraFIX website, enquiries, contracts and technical services. The controller and service provider are identified at the end of this document.

For privacy questions or to exercise your rights, contact [email protected]. This notice explains the categories of data, purposes, legal bases, recipients, retention and rights relevant to those activities.

The website is an informational presentation. It does not contain registration, purchasing or contact forms. Enquiries and service administration take place through the contact and ordering arrangements provided separately.

2. Where personal data comes from

We receive information you give us in an enquiry, order, support message, cancellation or complaint. Technical connection data is generated when a service connection starts and ends. Website delivery and security may involve technical request information processed by hosting or infrastructure providers.

Payment providers may send us transaction status, references and information necessary for billing, fraud prevention or a dispute. We do not obtain your full payment card number or card security code. We do not obtain nationality from service connection logs.

3. Data categories, purposes and legal bases

Enquiries and correspondence

Data: your email address, any name you provide and the content and context of your message. Purpose: answering a question, discussing an order, providing support, handling cancellation or resolving a complaint. Basis: steps at your request before a contract or performance of a contract, Article 6(1)(b) GDPR; where a message is outside that relationship, our legitimate interest in responding and keeping a necessary record, Article 6(1)(f).

Service and contract administration

Data: identification and contact details supplied for an order, service identifiers, contract records, activation and cancellation information. Purpose: establishing and performing the service contract and administering access. Basis: Article 6(1)(b) GDPR, and Article 6(1)(c) where a record is legally required.

Billing and transactions

Data: billing name and address, country where required for billing or tax treatment, transaction references, amounts, dates, status, refund information and invoices. Purpose: payment administration, accounting, tax compliance and resolving payment issues. Basis: contract, Article 6(1)(b); legal obligations, Article 6(1)(c); and legitimate interests in preventing fraud or defending a specific claim, Article 6(1)(f).

Service connection logs

Data: the connecting IP address and the connection and disconnection timestamps, as detailed in section 4. Purpose: technical operation, troubleshooting, security, investigation of unauthorised or shared access and necessary evidence concerning a service or payment dispute. Basis: Article 6(1)(b) where strictly necessary to provide the service, and Article 6(1)(f) for the legitimate interests in security, abuse prevention and establishing or defending claims.

Website delivery and security

Data: information accompanying an HTTP request, such as an IP address, requested resource, request time and browser or device information made available with the request. Purpose: delivering the page and protecting infrastructure. Basis: our legitimate interest in operating a functional and secure website, Article 6(1)(f). This is separate from service session logging and is not used by us for advertising analytics.

Legal obligations and claims

Data: the records relevant to a particular statutory obligation, complaint, incident or claim. Purpose: complying with the law and establishing, exercising or defending legal claims. Basis: Article 6(1)(c) for a legal obligation and Article 6(1)(f) for the legitimate interest in protecting legal rights.

4. Exactly what connection logs contain

The routine UltraFIX service connection record contains only:

• the IP address used to connect;
• the date and time the connection starts;
• the date and time the connection ends.

We do not add nationality, inferred demographic profiles, precise geolocation or message contents to these routine connection logs. Those logs are not a record of the content transmitted through the connection. Billing and correspondence records described elsewhere in this notice are separate records.

An IP address and associated timestamps can be personal data. We therefore apply the data protection safeguards and retention limits in this notice to them. Connection logs are used for the stated technical, security and legal purposes, rather than for advertising or demographic profiling.

5. Required and optional information

Information needed to provide access, communicate about your order or issue legally required billing documents is a contractual or legal requirement. Without the necessary information, we may be unable to conclude or perform the contract. Technical information necessary for a connection is generated through its use.

For an enquiry you can choose how much additional information to provide, but we need a way to reply. Do not send passwords, full card details, identity documents or special categories of personal data unless a specific lawful and secure process has been agreed. Unnecessary data sent to us is not requested for ordinary service use.

6. Who receives personal data

We disclose information only where relevant to the stated purposes and with an appropriate legal basis. Recipient categories include:

• Hosting, server, network and security providers involved in delivering and protecting the website and technical infrastructure.
• Email and communication providers involved in delivering correspondence, credentials, support and notices.
• Payment service providers, which may act both as processors and as independent controllers for their own legal obligations, transaction security and fraud prevention.
• Accounting, tax and legal advisers where needed for compliance or a specific matter, subject to their duties of confidentiality.
• Public authorities, courts and other legally entitled recipients where a disclosure is required or justified by law.

Processors acting for us must process data under the applicable contractual and confidentiality requirements. Independent controllers determine their own processing for their own purposes under their own privacy information. We do not sell personal data.

7. Transfers outside the EEA

Email, payment or infrastructure providers may process information outside the European Economic Area, including in the United States. A transfer must have an applicable basis under Chapter V GDPR.

That may be a valid European Commission adequacy decision. For a United States recipient, the EU–US Data Privacy Framework applies only where the recipient and processing are covered by participation in that framework. Otherwise, appropriate safeguards may include the Commission's standard contractual clauses, together with transfer assessment and supplementary measures where necessary.

You can contact us for information about the transfer basis relevant to your data or for a copy of applicable safeguards, subject to necessary protection of confidential information and the rights of others.

8. Retention and deletion

We keep identifiable data only as long as necessary for its stated purpose or as required by law. Different records serve different purposes:

• Routine service connection logs: no longer than 13 months from the recorded connection. They are then deleted or irreversibly anonymised.
• Enquiries: for dealing with the enquiry and necessary follow up; after that, only if a particular record remains necessary for a contract, legal obligation or claim.
• Contract, access and service administration records: for the service relationship, then only for applicable legal retention and limitation periods. The ordinary Czech civil limitation period is generally three years, but its start and any longer period depend on the claim and circumstances.
• Accounting records: for the period required for that type of document. Under the Czech Accounting Act, accounting documents and books are generally kept for five years and financial statements and annual reports for ten years, counted from the end of the relevant accounting period. A specific tax rule, pending matter or other legal obligation may require a different period.
• Website technical and security information: for delivering the request and any period necessary and proportionate to security, troubleshooting or an identified incident; routine website requests are not retained by us for advertising analysis.

If particular evidence must be preserved for an actual incident, dispute or legal requirement, the necessary extract may be retained separately with restricted access for that matter. This does not justify keeping all routine connection logs beyond the normal limit. Retention is reassessed when the matter ends.

Deletion and minimisation also apply to copies and backups according to their purpose and the applicable legal obligations. We do not keep personal data indefinitely merely because storage is available.

9. Automated payment checks and profiling

Payment service providers may automatically screen a transaction for fraud or security risks and may require additional authentication or block a payment. Their independent processing is explained in their own privacy information. Contact us if a transaction decision affects your order and you wish to raise an issue or request an available human review.

We do not use routine service connection logs for advertising or demographic profiling. We do not otherwise make decisions based solely on automated processing that produce legal or similarly significant effects on you. If a processing activity changes in a way requiring additional information or safeguards, those must be provided before it is introduced.

10. Access controls and security

We use technical and organisational measures appropriate to the risk, including limiting access to people who need the data for their duties, protecting credentials and restricting unnecessary disclosures. Service connection data is accessed for the technical, security and legal purposes described here.

No transmission or storage method can be represented as completely risk free. Tell us promptly if you suspect that your credentials have been disclosed. This does not affect our own obligations to protect personal data or respond to a personal data breach.

11. Your data protection rights

Depending on the conditions in the GDPR, you may:

• ask whether we process your data and obtain access and a copy;
• have inaccurate data corrected or incomplete data completed;
• request erasure where there is no lawful reason to keep the data;
• request restriction of processing in the circumstances provided by law;
• receive data you provided in a structured, commonly used, machine readable format, and request transfer to another controller where portability applies;
• withdraw consent at any time where a processing activity relies on consent, without affecting the lawfulness of earlier processing;
• exercise applicable safeguards relating to solely automated decisions.

Right to object: where processing relies on legitimate interests, you can object on grounds relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

These rights are subject to their legal conditions. For example, erasure does not require us to delete a record that we must retain under an applicable law. We explain any lawful restriction when responding.

12. How to make a request

Write to [email protected], describe the right you want to exercise and provide information sufficient to locate the relevant records. We may request proportionate additional information if reasonably needed to verify identity. We do not require unnecessary identification.

We respond without undue delay and ordinarily within one calendar month of receiving a request. Where the GDPR permits, this may be extended by up to two further months because of complexity or the number of requests. If so, we explain the extension and reasons within the first month.

Requests are normally free. A fee or refusal is possible only within the conditions permitted by law for a manifestly unfounded or excessive request, with an explanation of the reason and your remedies.

13. Supervisory authority and remedies

You can lodge a complaint with the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů (ÚOOÚ): official information from the Czech data protection authority (https://uoou.gov.cz/en).

You may also complain to a competent supervisory authority in the place of your habitual residence, place of work or alleged infringement, and exercise any applicable judicial remedy. You do not have to contact us before approaching an authority, although we welcome the opportunity to resolve an issue.

14. Cookies, browser storage and email links

The UltraFIX website code does not set cookies or use local or session storage. It contains no analytics, advertising scripts, tracking pixels, embedded social widgets or third party fonts. The copy email button writes the displayed address to your clipboard only when you press it.

A hosting or security provider may use strictly necessary technical storage where needed to deliver a service you request or protect its operation. Any optional storage or tracking would require a separate assessment, updated information and consent where applicable before use. No optional tracking is included in this version.

An email link opens your chosen email application. The website does not send a message on your behalf. If you choose to send one, your email provider processes it under its own terms and privacy practices.

15. Changes to this notice

We update this notice when processing, applicable requirements or relevant operational arrangements change. A new version identifies its date. Where a change materially affects how your data is used, we provide appropriate additional notice before the change where required.

A privacy notice is information about processing; it is not a request for blanket consent. Any consent needed for a separate processing activity must be obtained separately. See the Terms & Conditions for service arrangements and Legal Information for provider details.

16. Service provider and data controller

UltraFIX is a service provided by VSNX s.r.o. VSNX s.r.o. is the controller of personal data processed for the UltraFIX website, enquiries, contracts and technical services, except where another organisation acts as an independent controller for its own purposes.

VSNX s.r.o.
Plzeňská 3352/156, Smíchov
150 00 Praha 5, Czech Republic
Company identification number (IČO): 30162718

For privacy questions and requests, contact [email protected].