Privacy Policy

What we know about you when you visit tappcookie.cz or have a website checked, and how the tapp cookie service works from a data protection perspective.

Effective from 7 September 2026 · Translation of the Czech original, which prevails in case of doubt.

1. Who the controller is

The controller of personal data processed on the tappcookie.cz website is TAPP Studio s.r.o., company ID (IČO) 23839074, VAT ID CZ23839074, registered office Národní třída 3687/42, 695 01 Hodonín, Czech Republic (“we”). Contact for data protection matters: info@tapp-studio.cz. We have not appointed a data protection officer, as we are not required to.

This policy covers two things: (a) the tappcookie.cz website you are reading, and (b) the tapp cookie service we operate for our clients’ websites. For the client service we act as a processor; the controller is always the operator of the website on which the banner runs (see section 6).

2. What data the tappcookie.cz website collects

Contact by e-mail

The website has no contact form. “Write to us” links open your e-mail client. If you write to us, we process your e-mail address and the content of your message in order to reply and, where relevant, negotiate a contract (Art. 6(1)(b) GDPR), for the duration of the negotiations and for 3 further years in case of a dispute (Art. 6(1)(f) GDPR).

Website check (“Check your website”)

When you enter a website address, our server loads it and evaluates which tracking codes and cookie banner it contains. On the server we process the address you entered, your IP address (to limit the number of checks from one address), the time, your ticked confirmation that you operate the website or are authorised to check it, and the result of the check. We keep these records for at most 30 days to protect against abuse and for debugging. The legal basis is our legitimate interest in providing the tool you requested and in protecting the service (Art. 6(1)(f) GDPR). The terms of use of the check are on the page Podmínky kontroly webu (in Czech).

Server logs

Hosting (AWS Amplify Hosting and the CloudFront network, Amazon Web Services) creates technical access logs (IP address, time, requested page, browser, status code) kept for at most 30 days, solely to ensure the security and operation of the website (Art. 6(1)(f) GDPR). We do not link the logs to other data or analyse them for marketing. If logging of the AWS WAF protective layer is enabled, it contains the same data with the same retention period and purpose.

Cookies and traffic measurement

The website uses our own tapp cookie banner. The strictly necessary cookie tapp_consent stores only your choice (Section 89(3) of the Czech Electronic Communications Act; necessary for the service you requested).

With your consent we measure traffic with Google Analytics 4 (Google Ireland Limited), loaded via Google Tag Manager. We process a pseudonymous identifier from the _ga cookie, the pages visited and the traffic source, the device and browser type and an approximate location derived from the IP address; Google Analytics 4 does not store the IP address itself. The purpose is traffic statistics and improving the website; the legal basis is your consent (Art. 6(1)(a) GDPR and Section 89(3) of the Electronic Communications Act), which you can withdraw at any time via the “Privacy settings” link in the footer. Without consent, Google’s scripts are not loaded at all; Google also receives a Consent Mode signal with your choice. Google Analytics keeps event-level data for 2 months; afterwards only aggregated reports without identifiers remain. The website does not use marketing cookies. Details are in the Cookie Policy (in Czech).

3. Who we share data with

We process data on the infrastructure of Amazon Web Services EMEA SARL (AWS) in the eu-central-1 region (Frankfurt am Main, Germany). AWS is our processor under the standard AWS Data Processing Addendum. For protection against attacks we use AWS WAF and certificates that AWS technically operates in the us-east-1 region (USA); no stored personal data passes through these services.

We receive and send e-mail communication (enquiries, erasure requests, support) via Google Workspace; the provider is Google Ireland Limited under the Google Workspace Data Processing Amendment. Google processes the sender’s e-mail address and the message content and does not guarantee a specific storage region.

Traffic measurement of tappcookie.cz (after consent) is provided by Google Analytics 4; Google Ireland Limited is our processor under the Google Ads Data Processing Terms. Data may be transferred to Google LLC in the USA; the transfer relies on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), under which Google LLC is certified. We do not share data with other recipients, except public authorities where required by law.

4. How long we keep data

  • e-mail communication: for the duration of negotiations, then 3 years,
  • website check records (address, IP, confirmation, result): at most 30 days,
  • hosting and CloudFront access logs, and WAF logs if any: at most 30 days,
  • Google Analytics 4 (only after consent): event data 2 months, the _ga cookie in your browser 2 years (delete it by withdrawing consent or in your browser),
  • accounting and contractual documents with clients: for the period set by law (usually 10 years).

5. Your rights

You have the right of access to your data, to rectification or erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Send your request to info@tapp-studio.cz; we will reply within one month at the latest. You also have the right to lodge a complaint with a supervisory authority; in the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz, or the supervisory authority of your place of residence in the EU.

6. The tapp cookie service on clients’ websites

On our clients’ websites, tapp cookie displays a banner for giving consent to cookies and stores a record of every visitor decision so that the website operator can prove consent (Art. 7(1) GDPR and Section 89(3) of Act No. 127/2005 Coll., on electronic communications). The controller of these records is the operator of the respective website; we process them on its behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

The record contains:

  • a random consent ID (also stored in the tapp_consent cookie in your browser),
  • the time and type of decision (accept all, reject all, custom choice, withdrawal),
  • the chosen categories and the version of the list of tools you consented to,
  • the country derived from the IP address (without storing the IP address), the language, a shortened browser identifier,
  • a fingerprint of the IP address (HMAC-SHA256 of the truncated address with a secret key) from which the IP address cannot be recovered.

We keep the records for 5 years from the decision (or a shorter period if the website operator sets one) in the AWS Frankfurt region. You can have your record looked up by the consent ID shown in the banner settings; please address the request to the website operator. More about our role as a processor, sub-processors and security measures is on the page Pro klienty (in Czech).

7. Changes to this policy

We may update this policy, for example when the hosting or the scope of the service changes. The current version is always on this page; the effective date is shown at the top. Previous versions are available on request.