Privacy Policy

Data controller

Nandaru s.r.o.
with its registered office at Nad lesním divadlem 1213/2, Prague 4, Company ID No. 06938582

The company is registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 291718.

(also referred to below as “we”)

Processing of personal data

We provide the following information to our customers, users of our website, and participants in lectures, training courses and conferences organised by us about the collection of personal data described below and our privacy principles.

Protecting your personal data is important to us. We will therefore always follow this Policy in our dealings with you.

Our website is not intended for children under 16 years of age. We process the personal data of children under 16 only where it is provided to us by their legal representative.

If you need any part of this Policy explained, require advice, or wish to discuss any further processing of your personal data, you may contact us at any time at info@nandaru.cz.

Scope of personal data processing

We obtain personal data when you:

  • contact us through the website;
  • register on our website or in our application;
  • register for one of our lectures, training courses or conferences;
  • attend one of our lectures, training courses or conferences;
  • make a purchase in our online shop;
  • subscribe to our newsletter;
  • send us an enquiry about our services;
  • enter into a contract with us;
  • provide the data to us yourself by email, telephone or another method.

We process the following data:

  • first name and surname or business name;
  • date of birth or company identification number and tax identification number;
  • telephone number;
  • email address;
  • postal address;
  • group photographs taken at lectures, training courses or conferences;
  • IP address;
  • browser and operating-system identifiers and other information used for traffic analysis;
  • cookies;
  • data from contact and enquiry forms, in particular the information you enter, the form identifier, source page and submission time;
  • microlearning usage data: a random session identifier, the client-link identifier, event times and types, video playback progress, displayed and selected answers including changes, completion, restart and material download events, a 1–5 rating and any voluntarily submitted comment.

Microlearning does not require a name or email address. We intentionally do not store IP addresses, browser identifiers or device fingerprints in the event database. A record is, however, associated with a random session identifier and the client-link identifier. A voluntary comment may contain personal data, so participants are asked not to include a name, email address or other personal data in it.

Who has access to your personal data

To help us improve the quality of our services and carry out certain activities, your personal data will be processed on our behalf by processors and other controllers that provide us with:

  • server, web and cloud services;
    • Google, Inc. (G Suite, Gmail)
    • Cloudflare, Inc. (website hosting, CDN and security, Workers, the D1 database and Cloudflare Web Analytics)
  • marketing services:
    • The Rocket Science Group, LLC (Mailchimp)
    • Facebook Ireland Ltd.
    • Google, Inc.
  • postal and delivery services:
    • Česká pošta a.s.
    • Slovenská pošta, a.s.

When providing its global infrastructure, Cloudflare processes in particular IP addresses and technical network-traffic data. It acts as a processor in relation to data processed for Nandaru. Any transfer outside the European Economic Area is governed by Cloudflare's Data Processing Addendum and the applicable international-transfer mechanisms.

How long we process personal data

We will process your personal data for as long as we provide services to you or perform our mutual contract and, where the processing is based on a legitimate interest, for a further five years.

We will subsequently process personal data for as long as necessary to comply with archiving obligations under applicable law (the Accounting Act, the Archives and Records Management Act, the Value Added Tax Act, laws governing mandatory data retention, and government orders requiring the retention of data connected with an investigation or data that must be retained for litigation). These requirements may differ for different types of data and products, so the actual retention period may vary considerably.

Where we have told you that personal data will be retained for a specific period in a particular case, we will not exceed that period.

Where you have consented to the processing of personal data, we will not exceed the period stated when that consent was given.

Microlearning session records and website-form data are not subject to automatic deletion. We assess whether they remain necessary and delete them manually once they are no longer needed to evaluate the relevant programme, handle the request or protect legal claims, no later than the limits stated above unless the law requires longer retention. After deletion, they may remain in the provider's technical backups for a limited period.

Purposes of processing and their legal bases

Performance of a contract

We use the data you provide to respond to your requests, perform a contract, process your orders, and arrange and organise our lectures, training courses and conferences.

All personal data is processed lawfully and transparently. We request only data that is adequate, relevant and necessary for the purpose of processing.

Providing personal data for the performance of a contract and for responding to your questions or requests for information is a contractual requirement. If you do not provide it, we may be unable to enter into the contract or respond to your questions.

Newsletter (consent)

With your consent, we may use your email address and region to send you a regular newsletter about events, publications or services that we provide and that we believe may interest you.

Consent may be given through our website, by email, in writing during one of our training courses, or through Mailchimp.

You may stop the processing of your personal data for newsletter distribution at any time without affecting any other relationship between us. Click the unsubscribe link in the marketing communication you received, or email your request to the address from which we sent that communication.

Direct marketing (legitimate interest)

If you become our customer, the processing of personal data may include sending newsletters and marketing communications for direct-marketing purposes. These may include invitations to new editions of conferences, offers of follow-up training or services, special events and discounts.

We will send direct-marketing communications only to a reasonable extent (usually once a month and no more than three times a month), and only where we reasonably believe that the offer may interest you.

You may object to the processing of your personal data for direct marketing at any time without affecting any other relationship between us. Click the unsubscribe link in the marketing communication you received, or email your request to the address from which we sent that communication.

The legal basis for this processing is our legitimate interest.

Photographs (legitimate interest)

We may use photographs of you taken at events organised by us, to a reasonable extent, to promote our company and raise awareness of it. We will process photographs only to the extent necessary and in a form that does not portray you negatively.

If you object to the publication of your photograph, contact us at info@nandaru.cz. We will then refrain from publishing it or remove it without delay.

The legal basis for this processing is our legitimate interest.

Website operation, traffic analysis and microlearning (legitimate interest)

We use Cloudflare Web Analytics for aggregate analysis of website traffic and performance. According to the provider, the service does not use cookies or localStorage for analytics, does not create a visitor fingerprint, and does not track individuals across websites.

In microlearning, we record the session and choices described above so that we can evaluate use of the programme, identify technical or content obstacles and improve the service. A 1–5 rating is stored when selected. Optional text is submitted only after the participant presses the ‘Send comment’ button.

We store contact and enquiry forms in the D1 database so that we can handle the request and document its receipt. The legal basis for this processing is described above under ‘Performance of a contract’.

The legal basis for operational and microlearning records is our legitimate interest in secure operation, evaluation and improvement of our services. You may object to processing based on a legitimate interest.

Other legal obligations and legitimate interests

We will process personal data in server backups and logs of activity for troubleshooting and security purposes.

Another important form of processing your personal data is processing for accounting purposes. All these forms of processing are necessary for our operation and are connected with the purposes already described above.

We may also use your personal data for our internal purposes, in particular to monitor your satisfaction, optimise and improve the quality of the products and services provided, develop new products, and reduce risks.

The legal basis for this processing is compliance with our legal obligations or our legitimate interest.

Your rights in relation to personal data processing

Right of access

You may ask us at any time to confirm whether we process your personal data. Where we do, you may ask about the purposes and extent of the processing, the recipients to whom the data is disclosed, how long we will process it, your rights to rectification, erasure, restriction of processing and objection, the source of the personal data, and whether the processing involves automated decision-making, including profiling.

You also have the right to obtain a copy of your personal data. The first copy is provided free of charge; for further copies, we may charge a reasonable administrative fee of CZK 100.

Right to rectification

You may ask us at any time to correct or complete your personal data if it is inaccurate or incomplete.

Right to erasure

We must erase your personal data where:

  • (i) it is no longer necessary for the purposes for which it was collected or otherwise processed;
  • (ii) the processing is unlawful;
  • (iii) you object to the processing and there are no overriding legitimate grounds for the processing;
  • (iv) we are required to do so by law; or
  • (v) you withdraw the consent given for the processing.

Right to restriction of processing

Until any disputed matter concerning the processing of your personal data has been resolved, we may do no more than store the data. We may otherwise use it only with your consent or for the establishment, exercise or defence of legal claims.

Right to object

You may object to the processing of your personal data where we process it for direct-marketing purposes or on the basis of a legitimate interest.

If you object to processing for direct-marketing purposes, your personal data will no longer be processed for those purposes.

If you object to processing based on a legitimate interest, we will assess the objection and tell you either that we have upheld it and will cease processing your data, or that the objection was not justified and the processing will continue. In either case, processing will be restricted until the objection has been resolved.

Right to data portability

You have the right to receive personal data concerning you that is processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format, and to have that personal data transmitted directly to another controller.

Cookies

Our website uses cookies (small text files placed on your device) to provide websites and online services and to collect data.

Details of the cookies used and how to disable them are set out in our Cookie Policy.

Reporting security incidents

There is always a risk that your personal data could be disclosed, misused or lost. In the course of our activities, we will do everything within our power to prevent such a security incident, in particular by training our employees and using only reliable technical solutions.

If, despite our best efforts, a security incident occurs and is likely to present a high risk to your rights and freedoms, we will inform you without delay using the email address provided and by publishing the information, including all necessary details, on our website.

Supervisory authority

Our activities are also supervised by the Office for Personal Data Protection, with which you may lodge a complaint if you are dissatisfied. More information is available on the authority’s website (www.uoou.cz).

Contact

If you have a comment or complaint about data protection, a question for the person responsible for data protection in our company, or wish to exercise any of your rights, contact us at info@nandaru.cz. We will respond to your questions or comments within 30 days.

Changes to this Policy

We may amend this Privacy Policy from time to time. We will not restrict your rights under this Privacy Policy without your express consent.

We will publish all changes to this Privacy Policy on this page. If the changes are material, we will inform you by email.

We archive previous versions of this Privacy Policy so that you can access them in the future.

Effective date

This Privacy Policy takes effect on 7 August 2026.