Privacy Policy

Last updated: 22 July 2026

1. Controller

Onfria s.r.o., ID No. 29728878, registered office at Vlněna 526/5, Trnitá, 602 00 Brno, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, Insert 152584 (hereinafter "Onfria", "we", "us").

Contact for data protection matters: legal@onfria.com

2. Technical data and website logs

This website is an informational marketing site. We process technical log data as described below, contact details submitted through the form in section 3 and, only after your consent, limited analytics data as described in section 4.

When you visit this website, technical data may be recorded automatically as part of the HTTP request and in server, error or security logs. This may include:

• IP address
• date and time of access
• requested page or URL, HTTP method, status code and transferred data volume
• information about the device, operating system and browser
• referrer URL, if sent by the browser
• technical errors and security-event information

We process this data to ensure the security, stability and proper functioning of the website, diagnose errors and protect the website against misuse. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in operating and securing a publicly accessible website. Log data is not used for profiling or cross-site tracking.

WEDOS retains all categories of operational and security logs generated through the Webhosting and WEDOS Protection services for 18 months from their creation and then deletes them automatically. The same retention period applies to snapshots of those logs. Onfria can access the most recent 31 days through its protected Grafana dashboard. The logs and snapshots are stored in WEDOS data centres in the Czech Republic; access is limited to selected WEDOS SOC personnel and authorized Onfria personnel where necessary. If a specific record is required to investigate a security incident, protect our legal rights or comply with a legal obligation, an authorized copy may be retained for the period necessary to resolve that case. Any such exception must be documented, time-limited and reviewed when the reason for retention ends.

Under our data processing agreement, after the hosting service ends, personal data remaining on active servers must be deleted without undue delay and no later than 30 days. Data contained in existing backups is removed through the provider's backup lifecycle, no later than 180 days after the relevant backup was created.

3. Contact form and e-mail correspondence

If you use the contact form on this website, we process the data you enter — your name, e-mail address, optionally your company, and the content of your message — plus the language version of the submitted form, in order to respond to your inquiry. The form does not use any third-party form service: your submission is processed by a script on our own hosting and delivered to our mailbox as an e-mail. We do not store form submissions in a separate database; they are retained only as e-mail correspondence, as described below.

If you contact us via the e-mail addresses listed on this website, we process your name, e-mail address and the content of your message for the purpose of responding to your inquiry.

Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest in handling business inquiries).

General inquiries that do not lead to a contract or further cooperation are normally retained for 12 months after they have been resolved. Business inquiries and related correspondence that do not lead to a contract are normally retained for 2 years from the last contact. After the relevant period, messages are deleted or anonymized unless another lawful reason requires their continued retention.

Correspondence relating to a contractual relationship, accounting records, orders, complaints, legal claims, security incidents or data-protection requests is retained for the period appropriate to its purpose and for as long as required by applicable law or necessary to establish, exercise or defend legal claims.

4. Analytics, cookies and consent

With your prior consent, we use Google Analytics 4 to understand how the website is used, evaluate campaign performance and measure successful contact-form submissions. The Google tag is not loaded and no analytics data is sent to Google before you consent. Rejecting analytics does not limit access to the website. The legal basis is your consent under Article 6(1)(a) GDPR and the applicable ePrivacy rules.

Analytics may process a randomly generated cookie identifier, pages visited, language version, approximate location derived from the IP address, browser and device information, referrer and validated campaign parameters, and interactions such as page views, scrolls, outbound-link clicks and a successful form submission. We do not send names, e-mail addresses, company names, message content or other data entered into the form to Google Analytics.

The website uses the following browser storage:

• onfria_consent — a necessary first-party cookie that stores the consent version, your analytics choice and the time of that choice for up to 12 months
• _ga and _ga_<ID> — Google Analytics first-party cookies, created only after consent and configured to expire after 12 months
• onfria.pendingLead — a session-only marker created only after consent when the contact form is submitted; it ensures that a confirmed submission produces one generate_lead event and is then removed

Google Analytics user-level and event-level data is retained for 14 months. The option to reset this period on new activity is disabled. Standard aggregated reports are not affected by this user and event data-retention setting. Google Signals, advertising personalization and Google Ads linking are disabled, and advertising consent remains denied.

You can withdraw your consent at any time through Cookie settings. After withdrawal, we immediately stop further analytics measurement and remove analytics cookies and temporary analytics identifiers from this browser. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn. You may exercise your right to erasure by contacting us at legal@onfria.com.

5. Service providers and third-party tracking

Website assets are self-hosted except for the Google Analytics tag, which is requested directly from Google only after analytics consent. We do not load advertising or social-network tracking services.

We use the following processors to operate the website and to communicate with you:

• Website hosting and security: WEDOS a.s. and relevant WEDOS Group companies (Czech Republic, EU) — host this website, process contact-form submissions and provide WEDOS Protection, including reverse proxy, DDoS and web application firewall protection and content delivery network services. In providing these services, they may process the server, error and security logs described above under a data processing agreement.
• E-mail: Microsoft (Microsoft 365) — hosts our mailboxes and, together with its subprocessors, processes the contact details, message content and associated technical metadata described in section 3 as necessary to deliver and secure the service. This processing is governed by the Microsoft Products and Services Data Protection Addendum (Microsoft DPA). Microsoft may process data outside the EEA; where that happens, transfers are protected by the safeguards described in the Microsoft DPA, including EU Standard Contractual Clauses.
• Analytics: Google Ireland Limited — provides Google Analytics 4 after your consent and processes the limited analytics data described in section 4 under the Google Ads Data Processing Terms. Google and its subprocessors may process data outside the EEA. Where applicable, transfers are protected by the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses, as described in Google's data-transfer framework information.

These providers process technical or correspondence data only to the extent necessary to provide their services and under a data processing agreement. Relevant processing locations, access controls, backup arrangements and retention settings are maintained in our internal records and reviewed when a provider or configuration changes.

6. Your rights

Under applicable data protection law you have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure ("right to be forgotten") where applicable (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interest (Art. 21 GDPR)

To exercise these rights, contact us at legal@onfria.com.

7. Supervisory authority

You have the right to lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
uoou.gov.cz

8. Changes to this policy

We may update this policy from time to time. The current version is always available at this URL. Material changes will be communicated via the website.