Effective date: 8 October 2026
This policy explains what personal data we collect on aenix.io, why, who processes it for us, how long we keep it, and what rights you have.
Who is responsible
The controller for personal data processed through this website is:
AENIX s.r.o.
U Trojice 2661/1e, České Budějovice 3
370 04 České Budějovice, Czech Republic
IČO 21493871, DIČ CZ21493871
Email: [email protected]
For contracts with US customers, AENIX INC (131 Continental Drive, Suite 301, Newark, Delaware 19713, USA) is the contracting party and controls the data it needs for that contract. Questions about either company go to the same address: [email protected].
We have not appointed a data protection officer.
What we collect and why
| What | Purpose | Legal basis (GDPR) |
|---|---|---|
| What you enter in our forms — name, work email, company, role, phone (optional), message, and the page and campaign you came from | Reply to your enquiry, arrange a call, send a requested document, register you for a workshop or webinar | Steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Analytics data — pages visited, referrer, approximate location, device and browser type, cookie identifiers | Measure traffic and improve the site | Your consent (Art. 6(1)(a)) |
| Campaign parameters in the link you followed (utm_* and gclid) | Know which campaign or event brought an enquiry | Our legitimate interest in measuring our own marketing (Art. 6(1)(f)) |
| Your cookie choice | Remember whether you accepted or rejected analytics | Necessary to honour your choice (Art. 6(1)(c) and (f)) |
| Server logs kept by our hosting provider — IP address, time, requested URL | Deliver the site and keep it secure | Our legitimate interest in running a secure website (Art. 6(1)(f)) |
| Business contact data from other sources (for example Apollo.io, LinkedIn or event attendee lists) — name, company, role, work email | Contact companies that may need our platforms, in a business-to-business context | Our legitimate interest in B2B marketing (Art. 6(1)(f)); you can object at any time |
| Certification programme data | Run the Cozystack certification exam | See Certification programme below |
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Cookies and similar technologies
When you first visit, a banner asks whether you accept analytics. Analytics scripts load only after you accept. You can change your choice at any time:
The same control is available as Cookie settings in the footer of every page.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
aenix-consent-v1 | Browser storage (first party) | Remembers your cookie choice | Until you clear it |
aenix_utm_first, aenix_utm_last | Cookie (first party) | Store the campaign parameters of the link you arrived from, so a later form submission can be attributed | 90 days |
Google Analytics (_ga, _ga_*) | Cookie (first party, set by Google’s script) | Traffic measurement — only after consent | Up to 2 years |
| Ahrefs Analytics | Script (no advertising cookies) | Traffic measurement — only after consent | — |
Who processes data for us
We use the following service providers. Each processes data on our behalf under a data processing agreement or the provider’s standard terms for business customers.
| Provider | What it does on this site | Data involved | Where |
|---|---|---|---|
| Google Ireland Ltd. / Google LLC — Google Analytics 4 | Traffic measurement, only after consent | Analytics data, cookie identifiers; IP addresses are not stored | EU and USA |
| Ahrefs Pte. Ltd. — Ahrefs Analytics | Traffic measurement, only after consent | Pages visited, referrer, device and browser type | Singapore and other countries |
| Pipedrive OÜ — web forms and CRM | Hosts our contact, demo, partner, course, workshop and download forms, and stores the enquiries | Form contents, campaign parameters | EU, with sub-processors in other countries |
| Google — reCAPTCHA | Protects the Pipedrive forms against spam; loads together with a form when you scroll near it | IP address, browser and interaction data | USA |
| GitHub, Inc. — GitHub Pages | Hosts the website | Server logs (IP address, time, requested URL) | USA |
| Google — YouTube embeds | Shows talk recordings on some pages; YouTube loads when the page with the video is opened | IP address, device and browser data; YouTube’s own cookies when you play a video | USA |
| zcal | Calendar booking, if you choose to book a call or a tour meeting through a zcal link | Name, email, chosen time, message | USA |
International transfers
Some of the providers above are based in, or use sub-processors in, countries outside the European Economic Area, mainly the USA. Where a provider is certified under the EU–US Data Privacy Framework, transfers to it rely on the European Commission’s adequacy decision; otherwise they rely on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at [email protected].
How long we keep data
- Form submissions and email correspondence that do not lead to a contract: up to 24 months after our last contact with you, then deleted. If you ask us to delete them earlier, we do.
- Data relating to a contract: for the duration of the contract and afterwards for as long as Czech accounting and tax law requires (generally up to 10 years for accounting records).
- Analytics data: Google Analytics keeps event data for up to 14 months.
- Campaign cookies: 90 days. Your cookie choice: until you clear your browser storage.
- Business contact data from other sources: until you object, or when it is no longer relevant to our B2B marketing.
Your rights
Under the GDPR (Articles 15–22) you have the right to:
- access the personal data we hold about you and get a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability for data you gave us, where processing is based on consent or a contract (Art. 20);
- object to processing based on our legitimate interests, including direct marketing — for direct marketing we always stop (Art. 21);
- not be subject to a decision based solely on automated processing that significantly affects you (Art. 22) — we make no such decisions.
Where processing is based on consent, you can withdraw it at any time with the cookie settings above, without affecting what happened before.
To exercise any right, write to [email protected]. We answer within one month, as the GDPR requires. You also have the right to complain to a supervisory authority — in the Czech Republic, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority in the EU country where you live or work.
Visitors in US states with privacy laws, including California: we do not sell or share personal information for cross-context behavioural advertising. You can ask us what we hold, ask us to correct or delete it, and opt out of analytics with the cookie settings above, by writing to [email protected].
Changes to this policy
When we change this policy, we update the effective date at the top of the page.
Certification programme
This section covers the Cozystack certification programme at aenix.io/certification: the CCF exam, certificates and the workshop labs badge.
Who processes the data. AENIX s.r.o., U Trojice 2661/1e, České Budějovice 3, 370 04 České Budějovice, Czech Republic, IČO 21493871. Write to [email protected] with any question about this section.
What we collect. Your name in Latin script, e-mail address and company, given when we issue your exam access. Your exam attempts: which questions you were shown, what you answered, when, and the result. The serial number of any certificate issued to you. If you upload a labs bundle, the file itself — check identifiers and their outcomes, with a cluster identifier and platform version.
Why we may do this. To run the exam and issue the certificate you asked for, and to keep the exam meaningful — which is why attempts are logged and why we can revoke a certificate. We do not rely on consent here: consent can be withdrawn, and a signature that has already been published cannot be recalled.
How long we keep it. The issuance record — serial number, name, dates, status — for the certificate’s validity plus twelve months, because without it we cannot revoke a certificate or confirm one. Attempts and answers for twelve months, to set the pass mark from real data. Labs bundles until the badge is decided, plus six months.
What is public, and by whose hand. A certificate is a link containing your name and a signature over it. Nothing is published by us: you publish it, when and where you choose. Once you have, it cannot be recalled from the internet — not by you and not by us. What we can do is add its serial number to the revocation list, after which the verification page reports it as revoked.
The verification page carries no analytics. Your name sits in that page’s address, and it must not travel onward. That page loads no third-party scripts at all, and our build fails if it ever does.
Your rights. Ask us for a copy of what we hold, ask for corrections, ask for deletion. Deletion means we remove your account, attempts and bundles, and add your certificate to the revocation list — the published link itself is beyond anyone’s reach, including ours. You may also complain to the Czech data protection authority (Úřad pro ochranu osobních údajů).