Privacy notice
Version 1.0 — effective 24 September 2026
This notice explains how we handle personal data on this website and when you ask us for a consultation: what we collect, why, on which legal basis, for how long, who helps us, and what you can ask of us.
Who we are
The controller is Business Growth Architects s.r.o., Pekařská 426/48, Staré Brno, 602 00 Brno, Czech Republic, Company ID (IČO) 21985995, VAT ID CZ21985995, registered in the Commercial Register kept by the Regional Court in Brno, file C 140960. We trade as Business Growth Architects (BGA).
For any privacy question or request, write to assistant@bga-consulting.com. We have not appointed a data protection officer, because the law does not require one for our processing; this address reaches the people responsible.
What we collect and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answering your consultation request | Your name, work email, company, your message and any finder choices you send with it. | Steps you ask for before a contract (GDPR Art. 6(1)(b)). When you write for your employer: our legitimate interest in answering you (Art. 6(1)(f)). | Contact details are kept encrypted for 365 days. |
| Deciding how to follow up | A readiness score that fixed rules calculate from your request, and the status history of your request. | Our legitimate interest in planning our reply (Art. 6(1)(f)). | Request facts without contact details: 730 days. |
| Linking your browsing to your request | The pseudonymous visitor ID and campaign information from our own analytics, only if you allowed analytics. | Your consent (Art. 6(1)(a)). | Visitor links: 90 days. |
| Protecting the form from spam and abuse | reCAPTCHA Enterprise signals when you submit; a keyed hash (HMAC) of your IP address for rate limits (we do not store the raw IP address); digests of request attempts and CAPTCHA tokens that stop duplicates and replays. | Our legitimate interest in security (Art. 6(1)(f)). | Rate-limit counters 48 hours; CAPTCHA digests 5 minutes; attempt digests 365 days. A request that fails the automatic check is kept encrypted for 30 days for manual review. |
| Optional newsletter request | Your newsletter choice with the notice version and time, stored encrypted with your contact details. We send nothing until you confirm by email. | Your consent (Art. 6(1)(a)) and §7 of Czech Act No. 480/2004 Coll. | Until you withdraw it; at most 365 days, together with your contact details. |
| Our own analytics and campaign attribution | Only with your consent: pseudonymous visitor and session IDs, pages and on-page actions (such as finder changes and film playback) and sanitized campaign parameters. Advertising click IDs only with marketing consent. | Your consent (Art. 6(1)(a)); for storage on your device, §89(3) of Czech Act No. 127/2005 Coll. | Raw events 90 days; analytics sessions 24 hours; aggregated reports 730 days. |
| Security and operations logs | Technical records without contact details. Raw request logs, which contain IP addresses, are excluded from storage. | Our legitimate interest in running a secure service (Art. 6(1)(f)). | 30 days. |
| Keeping erasures effective | Erasure records that keep deleted data deleted, also after a restore; queued processing jobs; audit records of operator actions. | Our legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)). | Erasure records as long as they are needed for that purpose; queued jobs 30 days; audit records 90 days. |
The periods are maximums. Expired records stop being used at once and are deleted automatically, usually within a day.
The readiness score only helps us order our work; a person reads every request. We make no decision with legal or similarly significant effect on you by automated means alone (Art. 22 GDPR).
We never send your message, company, email address or hashes of your contact details to analytics. Sending a request does not subscribe you to marketing. Please do not include sensitive personal information in your message. Cookies and similar browser storage are listed on cookies and consent.
Who receives data
- Google Cloud EMEA Limited (Ireland), as our processor under the Google Cloud Data Processing Addendum: hosting on Cloud Run in europe-west1 (Belgium); the Firestore database in the EU multi-region; the BigQuery analytics warehouse in the EU; encryption keys in Cloud KMS and secrets in Secret Manager, both in europe-west1; logging and monitoring.
- Google reCAPTCHA Enterprise, which checks form submissions for abuse. It processes device and browser signals and your IP address on Google’s side. The Google Privacy Policy and Terms of Service apply.
- Our email provider, an EU hosting provider, when we reply to you by email.
We do not sell personal data. We use no advertising services and no third-party analytics.
Transfers outside the EEA
We store your data in the EU. Google may process limited data outside the EEA, for example reCAPTCHA signals and data needed for support and security operations. These transfers rely on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the Standard Contractual Clauses in Google’s data processing terms. Application logs are kept in a global Google Cloud Logging bucket; they contain no contact details.
Your rights
You can ask us for access to your data, its rectification or erasure, restriction of processing, and a portable copy. You can object to processing based on our legitimate interests. You can withdraw consent at any time with effect for the future: cookie choices through Cookie settings at the bottom of every page, and a newsletter request by email to assistant@bga-consulting.com. We answer within one month; if the law allows us longer and we need it, we will tell you why.
You can also complain to the supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz, or to the authority where you live or work.
Giving us your details is voluntary. Without contact details we cannot answer your request.
Security
We encrypt contact details with managed keys (Cloud KMS) before we store them. People and services get only the access they need. Our backend is private: it accepts requests only from our website service.
Changes
When this notice changes, we update the version and date at the top.