Privacy Policy

1. Introduction & Controller Identity

This Privacy Policy explains how nomadrift.ink ("we", "us", or "our") collects, uses, and protects your personal data when you visit nomadrift.ink (the "Website") and when you register interest in our courses through our forms.

For the purposes of the General Data Protection Regulation (GDPR) and UK GDPR, the data controller is:

• Legal entity: Látky od Janečků
• Registered address: Krásná 269, 739 21 Krásná, Czechia
• Contact email: [email protected]

We do not appoint a Data Protection Officer (DPO) because we do not carry out large-scale processing of special-category data. If you have questions about this policy or about your privacy rights, contact us using the email address above.

2. Personal Data We Collect

We collect personal data that is necessary to operate the Website, respond to registration requests, improve course content, and (if you consent) measure and improve marketing performance. The categories of data we may collect include:

• Identity and contact data: your full name and email address.
• Account and access data: the password you create for registration. Passwords should be treated as confidential. If our infrastructure stores passwords, it is expected to store them as salted, one-way hashes rather than readable text.
• Form content: details you submit through forms (for example, course interests or registration metadata if included).
• Technical data: IP address, browser type and version, device type, operating system, and language settings.
• Usage data: pages viewed, time spent, approximate navigation paths, and referring pages.
• Cookies and identifiers: cookie identifiers and consent status (see Section 4).
• Conversion events: events indicating that a form was submitted or that key pages were viewed, used for performance measurement when consent is provided.

We do not intentionally collect special-category data (such as health data, religious beliefs, political opinions), financial account details, or government identification numbers through our standard Website forms. Please do not send such information to us.

3. Why We Process Personal Data & Legal Bases (GDPR Art. 6)

We process personal data only when we have a lawful basis to do so. Depending on how you interact with the Website, the lawful bases may include:

Automated decision-making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

4. Cookies & Tracking

The Website uses cookies and similar technologies. Cookies are small text files stored on your device. Some cookies are essential for basic operation, while others are used for analytics and marketing only if you consent.

Essential cookies (always active)

These cookies are necessary for the Website to function and cannot be switched off through our cookie preferences panel. Examples include: _site_session (session continuity) and cookie_consent (stores your consent choice). Retention ranges from session to 12 months.

Analytics cookies (consent required)

If you consent, we may use Google Analytics 4 (GA4) to understand how visitors use the Website. We aim to configure analytics to minimize data collection (for example, using IP anonymization where available). Example cookies include _ga and _ga_XXXXXXXXXX. Analytics data retention is typically set to 14 months.

Marketing cookies (consent required)

If you consent, we may use marketing technologies from providers such as Google and Meta to measure conversions and show relevant ads. Examples include _gcl_au (Google Ads conversion linker) and _fbp / _fbc (Meta pixel identifiers), typically with 90-day retention depending on your browser settings.

Beyond cookies

Some measurement may also occur via pixel tags or server-side event delivery where implemented. When used, these mechanisms may combine device-level signals (for example, IP address and user-agent) with event data (such as page views or form submissions). Where required by law, analytics and marketing features activate only after you provide consent via our cookie banner or preferences modal.

For more detail, including a cookie table and management options, see our Cookie Policy.

5. Consent (EEA/UK)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie (typically 12 months).

You may withdraw or change consent at any time by using the "Manage cookie preferences" link in the footer or by clearing cookies in your browser. Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew consent.

6. Sharing With Advertising & Service Partners

We share limited data with service providers that help us operate the Website and, when consent is given, measure marketing performance. We do not sell personal data. The categories of partners may include:

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, remarketing): cookie identifiers, usage data, and conversion events. Policy: policies.google.com/privacy.
• Meta Platforms, Inc. (Meta Pixel, Custom Audiences, lookalike audiences, Conversion API): page views, conversion events, audience membership signals, and (where used) hashed identifiers. Policy: facebook.com/privacy/policy.
• Cloudflare (CDN and security): IP-based threat detection and performance optimization. Policy: cloudflare.com/privacypolicy.

We do not permit these providers to use Website data for their own independent commercial purposes beyond providing services to us, subject to their contractual terms and applicable law.

7. International Transfers

Some of our service providers may process data outside the EEA/UK, including in the United States. Where international transfers occur, we rely on appropriate safeguards such as:

• EU-US Data Privacy Framework (where applicable, since July 2023), including the UK Extension and Swiss-US framework where relevant.
• Standard Contractual Clauses (EU 2021/914) as a fallback.
• UK International Data Transfer Agreement (IDTA) as a fallback.

If you want more information about transfers and safeguards, contact us at [email protected].

8. Retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law. Typical retention periods include:

• Registration and contact submissions: up to 2 years from the last interaction.
• Analytics data: typically 14 months (where enabled by consent).
• Marketing cookies: retained according to cookie lifetimes (often around 90 days), subject to browser settings and consent.
• Email correspondence: for the duration of the relationship plus 1 year.
• Server security logs: typically up to 90 days.
• Consent record: up to 3 years for audit purposes.
• Legal and tax obligations: as required by applicable law (often 6 to 10 years for certain records).

9. Your Rights (GDPR & UK GDPR)

If GDPR or UK GDPR applies to you, you may have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))
• Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise rights, email [email protected]. We normally respond within 30 days. This period may be extended by up to 60 days for complex requests.

Supervisory authority references: EU guidance: edpb.europa.eu; UK: ico.org.uk; Czech Republic: uoou.cz.

10. Children

This Website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data without verifiable parental consent, contact us and we will delete the information promptly.

11. Do Not Track

This Website does not respond to Do Not Track (DNT) browser signals. Third-party providers may have their own approaches to DNT or similar mechanisms.

12. Data Deletion Requests

You can request deletion of personal data by emailing [email protected] with the subject line "Data Deletion Request". We will process requests within 30 days after we verify your identity. We may retain limited information where required by law or needed to establish, exercise, or defend legal claims.

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred to a successor entity. If such a transfer materially changes how personal data is used, we will provide notice on the Website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights to know, delete, and correct personal information, and to opt out of the sale or sharing of personal information. In the last 12 months, the categories of personal information we may collect include:

• Identifiers: name, email, IP address, cookie IDs.
• Internet/network activity: pages viewed, interactions, device signals.
• Inferences: preferences inferred from site usage (only when marketing/analytics are enabled by consent).

We do not sell personal information as defined by CCPA. We may share information for cross-context behavioral advertising when marketing cookies are enabled. California residents may opt out via our cookie preferences panel available through the footer link "Manage cookie preferences".

To submit a verified request, email [email protected] with the subject "California Privacy Request". We may request information to verify identity. Authorized agents may submit requests with written permission.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. We do not sell personal data and do not engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject "Virginia Privacy Request". If we decline to act on your request, you may appeal by emailing with the subject "Appeal of Refusal — Privacy Request". We respond to appeals within 60 days. If the appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject "Nevada Do Not Sell Request". We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide a notice on the homepage at least 14 days before the new terms take effect. The "Last Updated" date at the top of this page reflects the latest version.

18. Contact

If you have questions about privacy, data use, or this policy, contact:

• Látky od Janečků
• Address: Krásná 269, 739 21 Krásná, Czechia
• Email: [email protected]