Privacy notice
Version 0.3, published 30 September 2026 (the site moved to hexalpha.eu and we now count visits with self-hosted Umami). Questions and data requests: matic@hexenkraft.cz.
1. Controller and contact
The data controller is HEXENKRAFT s.r.o., V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic, IČO 29665931, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 450419. We have not appointed a data protection officer; the responsible contact is matic@hexenkraft.cz. We process personal data under the GDPR (Regulation (EU) 2016/679) and Czech data-protection law.
2. What we collect and why
| Data | What exactly | Purpose | Lawful basis |
|---|---|---|---|
| Account | username, password (stored as a salted hash, never in clear), email address and whether you confirmed it, time of registration | create and run your account, let you log in, send you the welcome, email-confirmation and password-reset mails | Art. 6(1)(b) contract |
| Progress | lessons watched, modules completed, quiz and exam results | deliver the course, enforce the 85 percent mastery gate | Art. 6(1)(b) contract |
| Certificate | the holder name you type when you claim a certificate, the credential, its issue date, an unguessable certificate id | issue the certificate PDF, mail it to you, and let anyone who has the id verify it at /verify.html. The verification page and PDF show the holder name and issue date to whoever has the id; keep the id private if you do not want that | Art. 6(1)(b) contract |
| Waitlist | email address, which level you asked about, confirmation time | tell you when a paid level opens | Art. 6(1)(a) consent, withdrawable any time |
| Marketing | opt-in state of the "email me about new free lessons" box | send updates only if you ticked it | Art. 6(1)(a) consent, box un-ticked by default |
| Email log | recipient address, which mail template we sent and when, and whether our mail server accepted it | debug mail problems, show what we sent you | Art. 6(1)(f) legitimate interest |
| Server logs | web server: IP address, requested URL, browser type, time; account service: IP address, method and path of each request | keep the site running and secure, block abuse | Art. 6(1)(f) legitimate interest |
| Visit statistics | page address and title, referring site, browser, operating system, device type, screen size, language, and the country, region and city derived from your IP address. The IP address is used briefly for that and to derive an anonymous visit id, then discarded; it is not stored | see which pages are read and where visitors come from | Art. 6(1)(f) legitimate interest |
| Support | emails you send us | answer you | Art. 6(1)(b) and (f) |
A username, an email address and a password are required to open an account; without them there is no account. The email address lets you log in, resets your password and receives your certificate. Accounts opened before 29 September 2026 may have no email address on file. We do not collect special-category data (Art. 9). Please do not send us any. Quiz results are used to grade you and to improve the course in aggregate; the mastery gate is an automated score check, but it has no legal or similarly significant effect on you: you can retake it without limit.
3. Marketing consent
We send marketing email only if you actively opt in. The checkbox is not pre-ticked and is separate from account creation; you can use the Academy without it. Withdraw at any time through the unsubscribe link in any email or by writing to matic@hexenkraft.cz. Withdrawal does not affect processing that happened before it.
4. Who processes data on our behalf
| Processor | Role | Data location |
|---|---|---|
| Hetzner Online GmbH | hosting of the website, the account service, and its database | Germany (EEA) |
| Google (Google Workspace) | sends our mail from hexalpha@hexenkraft.cz: welcome, email confirmation, waitlist confirmation, password reset, certificate PDF, and an invitation when we open a level to you | EU/US under the EU-US Data Privacy Framework and Google's standard contractual clauses |
| Cloudflare (Turnstile) | bot check on the sign-up and waitlist forms; the widget sends browser signals to Cloudflare, and our server sends the widget's token plus your IP address to Cloudflare to verify it | EU/US under the EU-US Data Privacy Framework |
| Have I Been Pwned | password breach check at sign-up and reset: your password reaches our server over TLS, the server sends only the first five characters of its SHA-1 hash to Have I Been Pwned, and the password itself never leaves our server. If that service is unreachable the check is skipped | US, no personal data transferred |
The accessibility badge in the footer is an image loaded from inkluso.eu, another HEXENKRAFT s.r.o. service; it sets no cookie and carries no data about you. We do not sell personal data and we run no advertising or third-party analytics. We count visits with Umami, an open-source statistics tool that we run ourselves on our own server; it sets no cookie and the figures stay with us.
5. Retention
- Account, progress and certificate data: while your account exists. Write to us to delete the account; we delete it, its certificates and its email-log rows within 30 days.
- Waitlist entries: until the level opens and you are told, or until you ask to be removed. A waitlist entry is separate from your account: deleting the account does not remove it, so say so in your request if you want both gone.
- Password reset tokens: one hour (seven days for an invitation link). Login sessions: 30 days.
- Email log: 12 months, pruned automatically.
- Server logs: rotated by size (web server five files of 50 MB, account service three files of 10 MB), so a few weeks at current traffic.
- Backups: a nightly copy of the database is kept for 14 days on the server, and an offsite copy is pulled over SSH to company equipment in the Czech Republic, where it is not pruned automatically. Deleting your account removes you from the live database at once; copies in backups are removed when we rotate them, which we do on request.
- Payment and tax records (once paid levels exist): for the period Czech accounting and tax law requires.
6. Your rights
You have the right to access, rectify, and erase your data, to restrict processing, to data portability, and to withdraw consent at any time. Right to object: where we process data on the basis of legitimate interest (the email log, the server logs and the visit statistics) you may object at any time on grounds relating to your particular situation, and we then stop unless we can show compelling legitimate grounds. You also have the right not to be subject to solely automated decisions with legal or similarly significant effect; we make none. To exercise a right, email matic@hexenkraft.cz from the address on your account or tell us your username; we answer within one month.
You may complain to the Czech supervisory authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz, Pplk. Sochora 27, 170 00 Praha 7), or to the data-protection authority of the EU country where you live.
7. Cookies and local storage
We set one strictly necessary cookie, hxa_session, when you log in; it keeps you signed in for up to 30 days, is HttpOnly, Secure and SameSite=Lax, and is sent only to our /api paths. There are no analytics, advertising, or third-party cookies, so there is no cookie banner. Your browser's local storage holds your lesson progress and a first-party event buffer that is never sent anywhere, and session storage holds a random id for that buffer that disappears when you close the tab; clearing site data removes all of it. Cloudflare may set its own cookie inside the Turnstile widget while you complete the bot check.
8. Children
The Academy is for adults (18 and over). We do not knowingly process children's data; if you believe a child has registered, write to us and we will delete the account.
9. Changes
We may update this notice. Material changes are announced on this page and by email to account holders. Earlier versions are available on request.