← Back to Contact

Privacy Policy

Last updated:

1. Data Controller

MN Media s.r.o., registered at Varšavská 715/36, Vinohrady, 120 00 Praha 2, Czechia (IČO: 240 45 764), is the data controller responsible for the processing of your personal data.

You can contact us at info@mnmedia.io.

2. What Data We Collect

When you contact us through the form or by email, we process your name, email address, message, correspondence and submission time so we can respond. You may use a preferred name. Providing this information is voluntary and is not a statutory or contractual requirement; we need a reply address and enough information to answer your inquiry. Please do not send sensitive personal information that is unnecessary for your inquiry.

To deliver and protect the website, our hosting and content delivery providers process connection information, including IP addresses, requested URLs, timestamps, browser headers and security events. The contact endpoint also temporarily stores the connecting proxy's IP address and a submission hash for abuse prevention. These technical operations take place whether or not you allow optional analytics.

We do not use advertising cookies or cross-site tracking. If you choose an analytics preference, we store that choice, its date and the notice version in your browser's local storage for 180 days. This preference is used to respect your choice, not as an analytics identifier.

3. Website Analytics

Optional analytics are off by default. If you select Allow analytics in the footer, we use Plausible Analytics, hosted on our server in Frankfurt, Germany, to count visits to our two pages and successful contact form submissions. You can use the website and contact us without allowing analytics.

With your permission, we process the page path, event type and time, browser and operating-system information, and approximate location derived from your IP address (which may include country, region and city). Plausible uses the IP address and user agent to derive a site-specific daily identifier and session statistics. The raw IP address is not kept in the analytics event database. These are privacy-reduced statistics; we do not promise that every stored record is anonymous.

We do not send message contents, names, email addresses, URL query strings, URL fragments or referrers to Plausible. Our measurement code does not collect scroll depth or engagement time. Each accepted event includes an affirmative consent indicator and the notice version as evidence of the choice received. The browser choice time is checked when accepting an event, but is not retained as a visitor identifier.

Select Turn analytics off in the footer at any time to withdraw consent in this browser. This stops future measurement and does not affect the lawfulness of processing before withdrawal. The choice applies to this browser; repeat it on other browsers or devices. A missing, expired or unreadable preference keeps analytics off. For requests concerning information already collected, use the contact address in section 8.

4. Purpose and Legal Basis

  • Responding to inquiries — Our legitimate interest in receiving and answering correspondence you initiate (Art. 6(1)(f) GDPR).
  • Website delivery and security — Our legitimate interest in operating a reliable website, preventing abuse and protecting correspondence (Art. 6(1)(f) GDPR).
  • Optional website analytics — Your consent (Art. 6(1)(a) GDPR). Declining or withdrawing has no effect on the contact form.
  • Privacy choices and rights requests — Compliance with our data-protection obligations, including respecting and demonstrating consent and responding to requests (Art. 6(1)(c) GDPR).

The contact form's privacy acknowledgment confirms that the notice has been presented; it is not a request for consent to inquiry processing. We do not use your inquiry for marketing or make decisions with legal or similarly significant effects solely by automated processing.

5. How We Process Your Data

Requests pass through Bunny's content delivery network to our Hostinger-hosted server. A contact submission is first placed in a PostgreSQL delivery queue, then sent to our Proton email inbox over a connection that requires verified TLS encryption. The application deletes the queue row after the email provider accepts delivery. Failed deliveries remain available for recovery within the retention period below.

Optional analytics requests also pass through Bunny, then through our server to our own Plausible instance. We do not use Plausible's hosted analytics service. Self-hosting does not mean that network and hosting providers do not process the requests.

6. Data Retention

  • Correspondence: Kept while needed to handle your inquiry, then deleted during the next monthly inbox review. Correspondence needed for a continuing business relationship, a legal obligation or a specific dispute is retained only for that purpose and reviewed separately.
  • Delivery queue: Deleted after the email provider accepts the message. Daily cleanup removes failed copies older than 29 days, normally within 30 days of submission.
  • Rate-limit ledger: Used within a one-minute window. Daily cleanup removes rows older than one hour, normally within 25 hours of creation.
  • Analytics events and sessions: Daily cleanup removes records older than 89 days, normally within 90 days. Analytics backup copies are removed after 14 days by daily cleanup, normally within 15 days, so an event can remain in a backup for up to 105 days in total. Restores must reapply expiry before the data is used.
  • Browser preference: Expires after 180 days, or is replaced when you change your choice. Expired preferences are ignored and removed when the website next reads them.
  • CDN request logs: Bunny's standard logging window is three days. IP anonymization is enabled; permanent log storage and log forwarding are disabled. Security, provider backups and legal obligations may involve separate provider retention, described in their linked policies.

Cleanup failures are monitored and require corrective action. Deletion from an active system does not immediately erase every isolated provider backup; access to backups is restricted and expiry or erasure must be reapplied after restoration.

7. Data Sharing and Transfers

  • BunnyWay d.o.o. (bunny.net): Content delivery and security, including website requests, contact submissions and opted-in analytics traffic. Its network is global and processing may occur outside the EEA. See Bunny's data-protection information and subprocessors.
  • Hostinger: Hosting for our website, contact database and self-hosted analytics server in Frankfurt, Germany. Support and subprocessors may involve international processing. See Hostinger's data processing addendum, including its transfer safeguards.
  • Proton AG: Email delivery and storage of correspondence. Proton operates in Switzerland and Europe. Switzerland has an EU adequacy decision; Proton's terms describe safeguards for onward transfers. See Proton's data processing agreement and Mail privacy policy.

For transfers outside the EEA, relevant mechanisms include an EU adequacy decision or contractual safeguards such as the EU Standard Contractual Clauses. You can request details and a copy of the safeguards relevant to your data using the contact address in section 8. We do not sell personal data or share it with third parties for marketing.

8. Your Rights Under GDPR

Depending on the applicable conditions, you can request access, rectification, erasure or restriction of your personal data.

You can object to processing based on legitimate interests because of your particular situation. We will assess the objection and stop that processing unless the GDPR permits us to continue.

You can withdraw analytics consent using the footer controls. Where automated processing is based on consent or contract, you may also have the right to data portability. We do not collect additional identifying information solely to identify you in analytics records; if we cannot identify the relevant records, we will explain this and consider additional information you choose to provide.

Contact us at info@mnmedia.io. We respond without undue delay and within one calendar month of receiving a request. If its complexity or the number of requests requires an extension of up to two further months, we will tell you within the first month and explain why. We may request proportionate information to verify identity where reasonably necessary. Requests are normally free of charge.

9. Complaints

You may complain to the Office for Personal Data Protection of the Czech Republic (ÚOOÚ), or to a supervisory authority in the EU country where you live, work or believe an infringement occurred.

10. Security

We protect personal data with HTTPS, verified TLS for email submission, restricted server and database access, input validation, rate limiting, maintenance and security monitoring. Access to correspondence is limited to people who need it to handle inquiries and operate the company.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.