Casta Product Privacy Policy

Casta Product is the trading name of Stensmann Group s.r.o. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit https://casta-product.com/, contact us, book a session, make a payment, or engage us for consulting and product services.

1. Controller details

The controller responsible for processing your personal data is:

2. Scope of this policy

This Privacy Policy applies to the processing of personal data by Casta Product as a data controller. It covers website visitors, prospective clients who book consultations, clients entering into consulting engagements, and individuals communicating with us.

This Privacy Policy does not replace any client-specific data-processing agreement, statement of work, confidentiality agreement, or other contract that may apply to a particular engagement.

3. Personal data we may process

Depending on how you interact with us, we may process:

• Identity and Contact Data: Name, professional title, email address, phone number, company name, registered office, VAT/company number.
• Appointment and Intake Data: Date/time of booking, project challenges, selected service area, notes submitted in booking forms.
• Financial and Transaction Data: Invoicing details, billing address, bank details, payment references. We do not store full credit card numbers; card transactions are processed securely by Stripe.
• Communications Data: Emails, calendar invitations, messages, meeting notes, project requirements.
• Technical and Usage Data: IP address, browser type, device information, access logs collected automatically by our hosting and CDN provider (Cloudflare).
• Client Project Context: High-level business summaries and product strategy documents shared during scoping calls or engagements.

4. Purposes and legal bases for processing

5. Recipients and service providers

We may share personal data with trustworthy third-party service providers who assist our operations:

• Hosting & CDN: Cloudflare (Cloudflare Pages, edge infrastructure).
• Scheduling: Google Calendar (Google Workspace).
• Communications & Email: Google Workspace (Gmail, Google Meet).
• Payment Processing: Stripe Payments Europe Ltd.
• Professional Advisers: Legal counsel, accountants, tax advisors licensed in the Czech Republic.

6. International data transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards in accordance with Chapter V of the GDPR, such as European Commission adequacy decisions (including the EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs).

7. Data retention schedule

• Inquiries and unscheduled leads: Retained for up to 12 months from last contact.
• Client engagement contracts and project records: Retained for the duration of the engagement plus 3–5 years (statutory limitation period under the Czech Civil Code).
• Accounting and tax records: Retained for 10 years following the end of the tax period, pursuant to Act No. 235/2004 Coll., on Value Added Tax, and Act No. 563/1991 Coll., on Accounting.
• Server access logs: Retained by Cloudflare for up to 30 days for security and operational monitoring.

8. Cookies and telemetry

Casta Product uses strictly essential technical cookies necessary for platform navigation, security, and scheduling embeds. We do not use third-party marketing, ad-tracking, or cross-site tracking cookies. For full details, consult our Cookie Policy.

9. Data from other sources

We primarily collect data directly from you. We may verify corporate information using publicly accessible sources such as the Czech Commercial Register (justice.cz), ARES, or professional public profiles (LinkedIn).

10. Provision of personal data

Providing basic identity, contact, and invoicing data is necessary to schedule calls, conclude contracts, and receive services. Without this data, we cannot enter into an agreement or deliver product services.

11. Data security

We employ technical and organisational safeguards including HTTPS/TLS encryption in transit, multi-factor authentication (MFA) on business accounts, principle of least privilege access, and secure device management.

12. Data-subject rights

Under Chapter III of the GDPR, you have the right to:

• Access: Request confirmation and copies of your personal data (Art. 15).
• Rectification: Request correction of inaccurate personal data (Art. 16).
• Erasure: Request deletion where statutory retention no longer applies (Art. 17).
• Restriction: Request restriction of processing under certain circumstances (Art. 18).
• Data Portability: Receive your data in a structured, machine-readable format (Art. 20).
• Object: Object to processing based on legitimate interests (Art. 21).

13. How to exercise your rights

To exercise any GDPR right, contact us by email at hello@casta-product.com. We will respond within one month without undue delay.

14. Right to lodge a complaint (ÚOOÚ)

If you believe that your personal data is being processed in breach of data protection legislation, you have the right to lodge a complaint with the Czech supervisory authority:

15. Children's privacy

Our services and website are intended exclusively for business professionals, founders, and adults aged 18 and older. We do not knowingly collect personal data relating to minors.

16. Automated decision-making

We do not carry out automated decision-making or profiling producing legal effects concerning data subjects within the meaning of GDPR Article 22.

17. Third-party websites

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party platforms.

18. Changes to this policy

We may update this Privacy Policy periodically to reflect operational changes or statutory updates. The date of the latest update is displayed at the top of this document.