Privacy Policy
Last updated: May 2026 — Pursuant to EU Regulation 2016/679 (GDPR) and Czech Act No. 110/2019 Sb.
1. Controller
Brown Rock Investments s.r.o.
Americká 362/11, 120 00 Praha 2 – Vinohrady, Czech Republic
Email: hello@brownrock.com
IČO: 22269045
We are the data controller for personal data collected through this website.
2. What Data We Collect
2.1 Data you provide directly
- Contact form: name, email address, message content
- Newsletter subscription: email address
- B2B enquiries: company name, contact name, email, telephone, country
2.2 Data collected automatically
- Server logs: IP address, browser type, operating system, pages visited, date/time of access
- Cookies: see our Cookie Policy
- Analytics: website usage statistics via Google Analytics (subject to your cookie consent)
3. Legal Basis for Processing
| Purpose | Data | Legal Basis |
|---|---|---|
| Responding to contact / enquiry forms | Name, email, message | Legitimate interest (Art. 6(1)(f) GDPR) / Contractual necessity (Art. 6(1)(b)) |
| Newsletter | Email address | Consent (Art. 6(1)(a) GDPR) |
| B2B partner management (CRM) | Business contact data | Legitimate interest / Contract performance |
| Website analytics | Usage data, cookies | Consent (Art. 6(1)(a) GDPR) |
| Security / fraud prevention | IP address, logs | Legitimate interest (Art. 6(1)(f)) |
4. Third-Party Services & Data Processors
We use the following third-party services that may process your personal data:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Google Analytics | Google LLC | Website analytics and user behaviour | USA (EU SCC) |
| Meta Pixel (Facebook) | Meta Platforms Inc. | Marketing analytics | USA (EU SCC) |
| HubSpot CRM | HubSpot Inc. | Customer relationship management, email communications | USA (EU SCC / DPF) |
| Airtable | Formagrid Inc. | Internal data management and B2B partner records | USA (EU SCC) |
| Cloudflare | Cloudflare Inc. | Security, DDoS protection, CDN | USA (EU SCC) |
| GoDaddy | GoDaddy.com LLC | Website hosting and traffic analytics | USA (EU SCC) |
| WordPress / Elementor | Automattic / Elementor | Website platform | USA (EU SCC) |
All transfers to the United States are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, or where applicable, the EU-U.S. Data Privacy Framework (DPF).
5. How Long We Keep Your Data
- Contact form enquiries: 2 years from last contact
- Newsletter subscriptions: until you unsubscribe
- B2B partner records: duration of the business relationship + 5 years (legal obligation)
- Server logs: 30 days
- Analytics cookies: up to 13 months (Google Analytics default)
6. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of access (Art. 15) — obtain a copy of your data
- Right to rectification (Art. 16) — correct inaccurate data
- Right to erasure (Art. 17) — request deletion (“right to be forgotten”)
- Right to restriction (Art. 18) — limit how we process your data
- Right to portability (Art. 20) — receive your data in a machine-readable format
- Right to object (Art. 21) — object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact us at: hello@brownrock.com
You also have the right to lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7 | www.uoou.cz
7. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including SSL/TLS encryption, access controls and regular security reviews.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised “last updated” date.