Privacy Policy

1. Who processes your data

The data controller is:

This is a sole proprietorship. We have not appointed a Data Protection Officer (DPO), because we are not required to do so. For any privacy question, write to hi@alestrcek.com.

2. In short

The website alestrcek.com offers one single service: a paid intro conversation over a video call.

• We use no advertising pixels and no trackers. Visit analytics (Google Analytics) is loaded only if you explicitly allow it in the banner.
• Without your consent our pages set no cookies at all.
• We serve our typography from our own server. Everything our pages need as they load comes from this address — until you allow analytics, nothing goes to a third party when you visit.
• We do not sell or pass on your data for marketing.
• We process data only for: payment, invoicing, booking a time, letters (if you subscribe) and preparation for the call.

What is actually collected is described below, step by step.

3. Visiting the website

3.1 Server logs

The site is hosted with Neoserv in Slovenia (EU). On every visit the server records standard technical data: IP address, time of the request, the requested address, browser type (user agent) and the response code.

• Why: operation and security of the site, detection of abuse, fixing errors.
• Legal basis: legitimate interest (Article 6(1)(f) of the General Data Protection Regulation) — the interest being a secure and functioning website.
• Retention: 14 days.

3.2 Application logs

We also keep our own logs of events (for example: a payment session was created, an invoice was issued). These logs are stored outside the publicly reachable part of the server and are readable only by the account owner.

The entries are designed to contain as little personal data as possible: quiz results are logged without the email address, and email addresses do not appear in the quiz log entries. In the invoice log the recipient's email address is masked — only the first character and the domain are written, for example a***@gmail.com. No log anywhere holds a full email address.

• Legal basis: legitimate interest (Article 6(1)(f)) — traceability of payments and fixing errors.
• Retention: 12 months. Older lines are cleared automatically by a nightly script.

3.3 Rate limiting

To prevent abuse of the forms, we count requests per visitor. Your IP address is not stored: we compute an irreversible salted hash from it and store only that.

• Legal basis: legitimate interest (Article 6(1)(f)) — protection against abuse.
• Retention: until the counting window ends (a few hours at most).

3.4 Contact form

You can write to us directly from /en/contact/. The form collects your email address, your message and — if you fill it in — your name. The name is optional.

• Purpose: to answer your message. Nothing else.
• Legal basis: legitimate interest (Article 6(1)(f)) — answering your enquiry.
• Who it goes to: nobody. The message arrives by email in our mailbox and stays there.
• Retention: 24 months in the mailbox, the same as any other email correspondence.
• Log: we record only the time, the language and the outcome (sent or refused). The content of the message and your email address are never written to a log.

4. Cookies and similar technologies

Without your consent our pages set no cookies at all. We have no advertising pixels (no Meta/Facebook, no LinkedIn, no TikTok) and we use no tracking images in email. We use visit analytics only if you explicitly allow it in the banner — it is described in 4.3 below.

This is why the site carries a consent banner. Until you choose "Accept" in it, no tracker is loaded and nothing is sent to Google.

We do use the following technologies, which you should know about:

4.1 Browser local storage (localStorage)

On the quiz page your browser stores one single value locally — so that we do not show you the same invitation twice. This stays in your browser, is never sent to us, and does not allow anyone to identify a person. You can delete it by clearing the site data in your browser.

4.2 Third-party cookies on their own pages

When you move to payment, or when you pick a time, Stripe and Google set their own cookies on their own pages (for security, fraud prevention and the operation of their services). We do not control those cookies and have no access to them. Their own privacy policies apply.

The embedded booking calendar loads directly from a Google server inside our page. This means Google receives your IP address as soon as the booking page is displayed, even if you do not pick a time. The page says so, on the page itself. The calendar appears only after payment, as part of delivering a contract already concluded.

Typography does not load from Google servers. We serve the font from our own server. Until you allow analytics, nobody outside receives your IP address when you visit our pages.

4.3 Visit measurement — Google Analytics 4 (only with explicit consent)

We may measure visits to the site with Google Analytics 4. The provider for users in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Before your consent, nothing is sent to Google. The measurement code is not in the page source, it is not preloaded and it is not fetched. It loads only at the moment you choose "Accept" in the banner. If you choose "Decline", or leave the banner alone, no contact with a Google server takes place at all.

• Purpose: to understand how many people visit, how they arrive and which pages they read. Nothing else.
• Legal basis: your consent (Article 6(1)(a) of the General Data Protection Regulation, and Article 157 of the Slovenian Electronic Communications Act).
• Cookies: _ga (retention 2 years) and _ga_<container ID> (retention 2 years). They are set only after consent.
• Settings: the IP address is truncated (anonymize_ip). Advertising signals are permanently switched off — we do not advertise, so nothing is passed to Google for advertising purposes.
• Retention at Google: event data is kept for 14 months.
• Transfer outside the EU: Google may also process the data in the United States of America, on the basis of standard contractual clauses or a European Commission adequacy decision.

You can withdraw your consent at any time — without giving a reason and with no consequence for using the site. Press the button below and choose "Decline". You can change the choice again whenever you like; it is stored only in your browser, and clearing the site data deletes it too.

Change your analytics choice

5. Buying the intro conversation

5.1 Payment — Stripe

Payment happens on a page hosted and operated by Stripe (stripe.com). We never see and never store your card details — the card field is Stripe's, not ours.

On the Stripe page you enter:

What that checkbox means and why it exists is set out in the Terms and Conditions, section 5.3. The record of it is created at Stripe and is the proof that you expressly asked for delivery inside the 14-day period.

After a successful payment, Stripe sends this data back to us through a secure, digitally signed notification (webhook). We also receive the amount, the currency and the payment identifiers.

For its own processing, Stripe is an independent controller (fraud prevention, meeting its own legal obligations, payment services). For that part of the processing, Stripe's privacy policy applies.

• Legal basis (our processing): performance of a contract (Article 6(1)(b)).

5.2 Invoice — Space Invoices

The invoice is issued automatically through Space Invoices (eu.spaceinvoices.com), which operates in the EU and acts as our processor.

We pass on: name or company name, email address, address, postal code, city, country, VAT ID (if you entered one), the invoice line item, the amount and the payment reference. Space Invoices creates the invoice and sends it to you by email as a PDF.

• Legal basis: performance of a contract (Article 6(1)(b)) and compliance with the legal obligation to issue and keep invoices (Article 6(1)(c)).
• Retention: invoices and accounting documents are kept for 10 years under Slovenian tax and accounting law (ZDDV-1, ZGD-1). We cannot shorten this period at your request.

5.3 Booking a time — Google

You pick a time through a Google booking page (Google Calendar appointment schedule). The conversation itself takes place over Google Meet.

Google processes your name, email address, the chosen time and any message you add when booking, as well as connection data during the call. For booking and running the call, Google is our processor.

• Legal basis: performance of a contract (Article 6(1)(b)).
• Recording: we do not record conversations. If we ever wanted to record one, we would ask you first and you could decline.

5.4 Notes about the conversation

During or after the conversation we may take notes for our own preparation and follow-up work. These notes are confidential.

• Legal basis: performance of a contract (Article 6(1)(b)).
• Retention: 24 months.

6. Letters (newsletter)

If you subscribe to the letters, we process your email address.

Free guides: if you request a free guide, we store — besides your email address — the gender you chose (male or female; used only so that future editions address the reader appropriately) and which guide you requested. The promise is unchanged: one letter per month and at most one event e-mail per month, nothing else. Every message carries an unsubscribe link. Download links are personal and expire after 30 days.

How subscribing works: we use double opt-in. After you subscribe you receive an email with a link. Until you click that link, we send you no letters. The confirmation and unsubscribe links are cryptographically signed so they cannot be forged, and each link can do only the one thing it is meant for.

What we keep in the list:

Tags and track — important, please read: if you arrived at the subscription through the quiz, up to five tags derived from your answers are stored alongside your email address (result type, stage, level of readiness, suggested route, originating theme), plus a track tag that determines which sequence of letters you receive.

The more sensitive tags from the quiz (those touching on physical or mental wellbeing, relationship patterns or level of distress) are never written into the letters list — this is prevented in code, not merely by a rule on paper. If such a tag were to appear, the entire record is rejected.

If you do not subscribe to the letters, nothing at all is stored in the list. No email address, no tags, not even a pending record.

• Legal basis: consent (Article 6(1)(a)).
• Unsubscribing: every letter contains an unsubscribe link, and we additionally support one-click unsubscribe directly from your mail client. You can also unsubscribe by writing to hi@alestrcek.com. After you unsubscribe we keep your email address in the “unsubscribed” state so that we do not write to you again by mistake.
• Measurement: the letters contain no tracking images. We do not measure opens or clicks.
• Where it is stored: in a database file on our server in Slovenia (EU). We do not transfer the list to a foreign marketing tool.
• Retention: until you withdraw consent, then the unsubscribe record for a further 3 years in order to demonstrate compliance. After that the record is deleted automatically.

6.1 Colombia waiting list

The Colombia journey waiting list is a separate purpose from the monthly letters. If you join, we keep your email address, language, subscription source, status, subscription and confirmation times, consent version, and any unsubscribe time.

Registration uses double opt-in. Unsubscribing from Colombia updates does not unsubscribe the monthly letters, and unsubscribing from the monthly letters does not remove you from Colombia updates. We do not combine these into one general marketing consent.

• Legal basis: your consent (Article 6(1)(a)).
• Purpose: updates about the programme, date, terms and publication of the Colombia journey.
• Measurement: messages contain no tracking images and we do not measure opens or clicks.
• Retention: until you unsubscribe, then the unsubscribe record for a further 3 years to demonstrate compliance.

7. The quiz “Kje si zdaj?” (“Where are you now?”)

The quiz is optional. You can answer it without entering a name or an email address.

7.1 What is stored

Your answers are scored on the server. Up to two records may be stored, and neither of them contains your name or email address:

• A completion record — your answers and the tags derived from them, marked with a random record reference. That reference is not derived from your email address.
• A call-preparation record — created only if you decide to buy a conversation through the quiz. It contains the result, the answers, a few key answers in the form of labels, and any free-text note you added. It is marked with a random reference.

A record with your email address (if you entered one in order to receive the result by email) is kept separately and deliberately does not contain the record reference from the first point. These two sets are designed so that they cannot easily be joined.

7.2 Data touching on wellbeing

Some questions touch on physical and mental wellbeing, relationships and distress. We treat such data with the greatest care, as a special category of personal data.

• Legal basis: your explicit consent (Article 9(2)(a) in conjunction with Article 6(1)(a)). You do not have to complete the quiz. You can stop at any point, and until you finish, nothing is stored.
• Never for marketing. These answers are not used for advertising, for sales segmentation, or to decide on pricing.
• No automated decision-making with legal effect. The score is an aid for the conversation, not a diagnosis and not a decision about you.

7.3 Safety rule

If the answers show signs of greater distress, the quiz does not offer you a purchase. Instead it shows a quiet page with support, a mental health crisis phone number, and a way to write to a human being. This rule is enforced on the server, not only in the browser.

Mental health crisis line (Slovenia): 01 520 99 00. In an emergency, call 112.

7.4 The link to the purchase

If you decide to buy through the quiz, the random reference of the call-preparation record is attached to the payment at Stripe as metadata. The reference by itself says nothing about you.

The reference is not on the invoice. An invoice is a document the law binds us to keep for ten years, and it carries your name and address. So it holds nothing that leads to your answers: the invoice note contains the two payment identifiers and nothing else. The reference stays in Stripe's metadata and in our internal call-preparation file, and the link between them is made by hand, when we prepare for your conversation — and only then.

If you do not want even that, complete the quiz and make the purchase separately through the main page, or write to us at hi@alestrcek.com and we will delete the reference.

7.5 Retention

• Completion record: 12 months.
• Call-preparation record: 6 months.

Both periods are enforced by a nightly script that deletes older rows.

8. Who we pass data to

We do not sell data. We pass it on only to the following, and only to the extent necessary for each purpose:

Google is no longer listed for typography on this table: we serve the font ourselves. It is listed for analytics conditionally — without your consent it receives nothing from us.

9. Transfers outside the EU

The letters data, the logs and the quiz records stay on the server in Slovenia.

Stripe and Google may also process data outside the European Economic Area, including in the United States of America. For analytics this happens only after your consent. For those transfers they rely on the mechanisms provided by the General Data Protection Regulation, in particular standard contractual clauses or a European Commission adequacy decision.

10. How long we keep data

These periods are not only written down. A nightly script on the server deletes log lines and quiz records older than the period stated, and removes the records of unsubscribed contacts after three years. It never touches invoices — those the law keeps.

11. Your rights

In relation to your personal data you have the right:

• of access — to learn which data about you we process, and to receive a copy of it;
• to rectification — to have inaccurate data corrected;
• to erasure — to have data deleted where there is no longer a basis for keeping it;
• to restriction of processing — to have processing temporarily stopped;
• to data portability — to receive, in a machine-readable format, the data you gave us on the basis of consent or a contract;
• to object — to processing based on legitimate interest;
• to withdraw consent — at any time, without giving a reason and without consequences. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to exercise a right: write to hi@alestrcek.com. We reply within one month of receiving the request at the latest. If the request is complex, this period may be extended, and we will tell you.

A limit that is fair to state up front: we cannot delete invoices and accounting documents before the statutory period expires, even if you ask us to. We can, however, delete everything else.

Complaint: if you believe we process your data unlawfully, you may complain to the supervisory authority:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana
gp.ip@ip-rs.si · www.ip-rs.si

12. Security

• The site runs exclusively over an encrypted connection (HTTPS).
• Keys and passwords are kept outside the publicly reachable part of the server, in a file with restricted access permissions.
• Logs and quiz records are stored outside the publicly reachable part of the server and have restricted access permissions.
• Payment notifications are verified by digital signature, and we reject any that is not genuine or is too old.
• We never process card details.

Complete security in transmitting data over the internet cannot be guaranteed. We do our best.

13. Children

The service is intended for adults. We do not knowingly collect data of persons under 18. If you learn that a child has given us their data, write to us and we will delete it.

14. Changes to this policy

We may change this policy when the way we work or the applicable rules change. The version in force at any time is published on this page together with the date of the last change. In the event of a significant change concerning the letters, we will also notify you by email.

The Terms and Conditions are at /en/terms/. For any privacy question: hi@alestrcek.com.