Privacy Policy
This policy explains what personal data the Rovefold Travel Blog uses, why we use it and the choices available to you.
1. Who is responsible
The data controller is Martin Zbořil, Smrková 194/3, Strašín, 251 01 Říčany, Czech Republic, Company ID (IČO) 07520301, not registered for VAT, trading as Rovefold.
Email: support@rovefold.com. Please use “Privacy request” in the subject line when exercising a data-protection right.
2. What we process and why
| Activity | Data | Purpose and legal basis |
|---|---|---|
| Reading the blog | Technical request and security data, including truncated or operational server logs | Delivering and securing the website; our legitimate interest in reliable and secure operation. |
| Contact form | Name, email, subject, message and submission time; the form record does not retain the originating IP | Answering your request and keeping an appropriate correspondence record; steps requested by you and our legitimate interest in handling enquiries. |
| Newsletter | Email address, consent time/source and confirmation status; confirmation request metadata may be processed for security | Sending the newsletter only after double opt-in; your consent. You may unsubscribe at any time. |
| Analytics | Consent state, pseudonymous device/browser information and allowlisted interaction events; no form text, email, name or raw search query | Understanding aggregate content use and improving the blog; your consent. |
Required security/session storage and necessary request processing do not depend on analytics consent. We do not use the blog analytics data for automated decisions with legal or similarly significant effects.
3. Analytics and your choice
Google Analytics 4 is deployed through Google Tag Manager in Basic Consent Mode. Neither service is requested until you affirmatively accept Analytics. We use a restricted, versioned event list for page and article views, content lists, itinerary/outbound actions, privacy-safe search-length buckets, and newsletter/contact outcomes.
You can refuse analytics and continue using the blog. Reopen at any time. Withdrawing consent stops future optional measurement on the next clean page state; it does not make prior lawful processing disappear.
See the Cookie Policy for the current storage inventory.
4. Service providers, disclosures and transfers
We use providers only as needed to operate the blog: DigitalOcean and Laravel Forge for hosting/deployment where configured, Bunny.net for delivered media/CDN services, Postmark for transactional and newsletter email, and Google Tag Manager/Google Analytics only after analytics consent. Providers may process limited data under their contractual terms and our instructions.
Some providers are based outside the European Economic Area or use global infrastructure. Where personal data is transferred internationally, we rely on an applicable adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate.
We may disclose data when required by law, to protect legal rights or in connection with a legitimate business reorganisation. We do not sell personal data.
5. How long we keep data
- Contact enquiries: normally up to 120 days after submission, unless longer retention is needed to resolve the matter or meet a legal obligation.
- Newsletter: while the subscription is active and for a limited suppression/evidence period after unsubscribe where needed to honour your choice and establish compliance.
- Analytics: according to the retention configured in the Rovefold GA4 property; consent storage on this blog lasts up to 182 days before a new choice is requested.
- Security logs: only for the operational period reasonably necessary to detect incidents, troubleshoot and protect the service.
Legal, fraud-prevention or dispute requirements may justify a longer period for specific records. Data is then restricted to that purpose.
6. Your data-protection rights
Subject to the GDPR and applicable law, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
Contact support@rovefold.com. We may need proportionate information to verify your identity. You may also complain to the Czech supervisory authority, the Office for Personal Data Protection (ÚOOÚ), or your local EEA supervisory authority.
7. Third-party links, children and changes
Articles may link to independent websites. Their operators control their own privacy practices, so please review their notices. The blog is intended for a general audience and is not knowingly directed to children under 16.
We may update this policy when services, legal requirements or processing change. The effective date and version above identify the current text. Material changes affecting consent will be presented before optional processing resumes.