How we handle your data
Effective from 2 October 2026
This policy explains how Eden makers s.r.o. processes personal data when you visit our website, send us an inquiry, register for a workshop, apply for a job or work with us.
1. Who the controller is
Eden makers s.r.o., company ID 24518344, registered office Plzeňská 3352/156, Smíchov, 150 00 Prague 5, Czech Republic, registered with the Municipal Court in Prague under file no. C 442608.
For anything related to personal data, write to gedeon@edenmakers.ai or by post to our registered office. We have not appointed a data protection officer, as we are not required to.
2. What we process, why and for how long
You send an inquiry or use the calculator
- Data
- name, email, phone, company, company ID, project description, where you came from (UTM parameters and ad click identifiers)
- Purpose
- replying and preparing an offer
- Legal basis
- steps prior to a contract at your request (Art. 6(1)(b) GDPR)
- How long
- 3 years from the last contact if no contract follows
We work together
- Data
- contact and billing details, correspondence, comments and approvals in the review portal, electronic signature records
- Purpose
- performing the contract
- Legal basis
- performance of a contract (Art. 6(1)(b))
- How long
- 10 years from the end of the contract
We invoice
- Data
- billing details
- Purpose
- accounting and tax
- Legal basis
- legal obligation (Art. 6(1)(c))
- How long
- 10 years
You register for a workshop or consultation
- Data
- name, email, phone, company, payment status (we never see card numbers; Stripe processes the payment)
- Purpose
- registration, organisation, attendance records
- Legal basis
- performance of a contract (Art. 6(1)(b))
- How long
- 3 years from the event; accounting records 10 years
You subscribe to the newsletter
- Data
- email, name, language
- Purpose
- sending news
- Legal basis
- consent (Art. 6(1)(a)); for existing clients, legitimate interest (Art. 6(1)(f))
- How long
- until you unsubscribe
We contact you at work
- Data
- name, work email, role, company, public LinkedIn profile
- Purpose
- offering our services to businesses
- Legal basis
- legitimate interest in business-to-business direct marketing (Art. 6(1)(f))
- How long
- 12 months without a reply; deleted immediately if you object
You apply for a job
- Data
- name, email, LinkedIn, portfolio, CV, motivation, availability, rate expectation
- Purpose
- recruitment
- Legal basis
- steps prior to a contract (Art. 6(1)(b))
- How long
- 6 months after the process ends; longer only with your separate consent
You open our offer or a review link
- Data
- time and length of the view, browser type, a hash of your IP address; for reviews also name and email
- Purpose
- knowing the offer arrived, and securing access
- Legal basis
- legitimate interest (Art. 6(1)(f))
- How long
- 24 months
You open a presentation at edenmakers.ai/s/…
- Data
- the email, if you enter one, country and city derived from your IP address, device type, time watched; we do not store the IP address itself, it is passed to ipapi.co on each visit to determine location
- Purpose
- access control and engagement measurement
- Legal basis
- legitimate interest (Art. 6(1)(f))
- How long
- for as long as the presentation exists; deleting the presentation deletes this data too
You visit the website
- Data
- cookies and online identifiers (see section 5)
- Purpose
- analytics and campaign measurement
- Legal basis
- consent (Art. 6(1)(a))
- How long
- see section 5
If you do not give us the data needed to enter into a contract, we cannot prepare an offer or work with you. Otherwise, providing data is voluntary.
We do not make decisions based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). We use AI tools internally, for example to summarise an inquiry, but a person always decides.
3. Where the data comes from
You give us most of it yourself. When we contact you at work, the data comes from public sources: your company website, professional networks (LinkedIn) and the commercial register.
4. Who we share data with
We do not sell data. We share it only with:
- processors who run our operations: cloud database and hosting (Supabase, Lovable), email and office tools (Google Workspace, Resend), team communication (Slack), payments (Stripe), invoicing (iDoklad, Fakturoid), presentation delivery (Bunny.net), location determination (ipapi.co) and AI tools for internal processing (OpenAI, Anthropic, Google);
- our external accountant and, where needed, our lawyer, both bound by confidentiality;
- public authorities where the law requires it;
- analytics and advertising providers (Google, Meta, TikTok, LinkedIn), only with your cookie consent.
Transfers outside the EU
Some processors are based in, or process data in, the United States. Transfers rely on the European Commission adequacy decision (EU-US Data Privacy Framework) or on the Commission’s standard contractual clauses. We will provide a copy of these safeguards on request.
6. Your rights
You have the right to:
- access your data and receive a copy,
- have inaccurate data corrected,
- have data erased when we no longer need it or process it unlawfully,
- restrict processing,
- data portability for data you provided to us,
- object to processing based on legitimate interest; we always honour an objection to direct marketing,
- withdraw consent at any time, without affecting processing before the withdrawal,
- lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz) or the authority in your country.
How to exercise them
Write to gedeon@edenmakers.ai. We reply within one month. To make sure we do not hand your data to someone else, we may ask you to confirm your identity, usually by replying from the email address we have on file.
7. Client materials
When a client gives us materials containing personal data, such as footage or voices of people, we process them as a processor, on the client’s instructions and under a data processing agreement. We do not use these materials to train AI models.
8. Security
We use encrypted data transfer, multi-factor authentication, role-based permissions, and project data is accessible only to that project’s team. Clients can ask us for details.
9. Changes
We may update this policy. The current version, with its effective date, is always on this page.
Eden makers s.r.o. · Plzeňská 3352/156, 150 00 Praha 5 · gedeon@edenmakers.ai