Contact

Privacy Policy — DealShip

This policy explains which personal data we process when operating dealship.io, why, for how long, and what rights you have.

Effective: 18 October 2026

The controller of personal data is Pavel Picek, company ID (IČO) 74959107, Budínek 51, Svaté Pole, 263 01, Czech Republic.

Contact for questions about personal data: pavel.picek@dealship.io.

When you write to us through the contact form, we process your name, e-mail address, the text of your message and the language of the page you send the form from (Czech or English). We use them to reply to you and, where relevant, to prepare cooperation. Please do not include sensitive data in your message.

The legal basis is taking steps prior to entering into a contract at your request, or our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f) GDPR).

The message reaches us as an e-mail sent through Amazon SES; the form does not store it in any database. After you submit the form, an automatic confirmation of receipt is sent to the address you entered, in Czech or English according to the page language. Its delivery cannot be guaranteed (for example because of your mailbox settings or anti-abuse limits); the confirmation does not replace our reply.

To prevent the form from being abused to send spam we use:

  • a hidden field and a check that the form was not submitted unnaturally fast (the timing data is not stored),
  • a daily limit on the number of messages and confirmations per address: for this purpose your e-mail address is technically kept in an AWS DynamoDB database for 48 hours,
  • a per-IP request limit at network level (AWS WAF),
  • Cloudflare Turnstile, which tells a human from a robot.

The Turnstile script is loaded from Cloudflare, Inc. only when you start filling in the form. According to Cloudflare, Turnstile processes technical signals about the visitor, in particular the IP address, a TLS connection fingerprint, the User-Agent header, the site identifier and browser-environment data, and it does not read what you type into the form. For bot detection Cloudflare acts as our processor; it also processes the signals as an independent controller to improve Turnstile's protection.

The legal basis is our legitimate interest in securing the site and protecting it from spam (Art. 6(1)(f) GDPR).

The site runs on Amazon Web Services infrastructure (S3, CloudFront). On every visit your IP address and request details (e.g. page address, browser type) are processed as strictly necessary to deliver the page and keep it secure. We ourselves do not keep or analyse access logs of the site. Error logs of the form service (AWS CloudWatch) contain technical information about sending errors; message content is not written to them, but an error entry may occasionally contain an e-mail address.

The legal basis is our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR).

The site itself uses no analytics or advertising cookies, no measurement tools, and stores nothing in your browser's storage for its own purposes. Fonts are part of the site and are not loaded from a third party.

During the Turnstile check, Cloudflare may use technical cookies or browser storage in your browser, used solely to protect the form; their exact scope is determined by Cloudflare in its own policies. These are technical elements serving to protect the form. If you click a link to a third-party site (see section 6), that site may use its own cookies.

The "Schedule a meeting" buttons lead to the external booking service Calendly (Calendly, LLC, USA) and the LinkedIn icon to a profile on LinkedIn. These are plain links: nothing from these services is loaded into the site and no data is passed to them until you click the link. If you book a meeting, you enter your name, e-mail and other details directly in Calendly, which is an independent controller; Calendly's privacy policy applies to that data, not this document. The same applies to LinkedIn.

Your data may be processed by:

  • Amazon Web Services EMEA SARL (Luxembourg): website hosting, sending the form's e-mails (Amazon SES), running the form service (AWS Lambda), the database counter (DynamoDB), logs (CloudWatch) and network protection (WAF);
  • Cloudflare, Inc. (USA): protecting the form with Turnstile (section 3);
  • the e-mail service provider that operates the mailbox to which form messages are delivered.

We do not sell your data and do not use it for marketing.

Processing with AWS takes place in the EU (Frankfurt region). When content is delivered through the CloudFront network, data may also be transferred outside the EU. Cloudflare, Inc. is based in the USA and data may be transferred to the USA during the Turnstile check. Amazon Web Services states that its contractual terms include the standard contractual clauses approved by the European Commission and that it is certified under the EU–US Data Privacy Framework; Cloudflare states that for transfers to the USA it relies on its EU–US Data Privacy Framework certification and, as a fallback, on the standard contractual clauses. Whether and to which countries the e-mail mailbox provider transfers data depends on its service and its contractual safeguards. Calendly and LinkedIn process data on their own responsibility and may transfer it to the USA.

We keep personal data sent through the contact form only for as long as necessary to handle your enquiry and any follow-up communication. If a business cooperation arises, relevant data may be kept further in accordance with applicable legal obligations.

Technical data: the e-mail address in the anti-abuse database counter for 48 hours; error logs of the form service for 30 days. Data processed by Cloudflare during the Turnstile check, and data you enter in Calendly or on LinkedIn, are governed by those companies' policies.

You have the right of access to your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Just write to pavel.picek@dealship.io; we will respond without undue delay, as a rule within one month; in justified cases (in particular given the complexity or number of requests) this period may be extended under the GDPR by two further months, in which case we will inform you of the extension and the reasons. To find your data in our e-mails we need the address you wrote from.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).

Providing your name, e-mail and message is necessary so that we can reply; without them the form cannot be submitted. The Turnstile check is required to submit the form. We carry out no profiling. The automatic anti-spam checks (section 3) serve only to tell a human from a robot and to limit abuse of the form; they may automatically prevent the form from being submitted, but they do not lead to decisions with legal effects or similarly significant effects on you. If you cannot submit the form, write to us at pavel.picek@dealship.io.

We may update this policy. The current version is always on this page with its effective date.