YOUR PRIVACY.
PLAIN AND SIMPLE.

01 / WHO IS RESPONSIBLE

The controller of personal data on xlr8prg is iNFINITE Production s.r.o., company ID (IČO) 17676347, registered at Klánovická 12, 198 00 Praha 9, Czech Republic. The site runs on our own server.

For questions, corrections, access requests or deletion, email info@infinite.cz. Company contact details are available on infinite.cz.

02 / WHAT WE USE AND WHY

When you create an account, we use your username, real name, email and a securely hashed password. Your phone number is optional. A profile may also contain a bio or details you previously supplied for site activities. We use these details to provide the features you request, identify your profile and avoid creating duplicate records.

When you sign up for an event, we use your name and email to find or create your profile, record your signup status and remember it in this browser. You may optionally add an X handle or LinkedIn link to your profile during event signup; neither is required. For events requiring approval, organizers also receive your introduction and reason for attending. These introductions are stored with that event signup and are not published. An existing profile may be matched by email or phone when you register for an account, or by email when you sign up for an event. An acceptance email contains a private link valid for 30 days that sets your profile cookie and shows your accepted event details. Do not forward this link; resending an invitation replaces the previous link, and deleting the signup invalidates it. A profile cookie alone does not authenticate a user or grant access to an account. We use subscribed profiles to send our newsletter with community news and event announcements. We do not use your data for advertising profiles, behavioral profiling or automated decisions with legal or similarly significant effects.

For newsletter requests, we use your real name and email to find or create a profile. We keep a newsletter subscription flag and a confirmation record containing the profile ID, linked account ID if any, purpose, email address, a hashed token and creation and expiry times. New subscriptions remain disabled until you confirm using the email link and confirmation button. The optional event signup checkbox is selected by default, but does not activate a new subscription without email confirmation. Leaving it unchecked makes no new newsletter request and does not cancel an existing subscription. If you do not confirm, we send no newsletter or reminders in response to that request. Event and account messages you separately request are independent.

Our server necessarily receives connection information, such as your IP address, browser information and requested page, to deliver and protect the site. For signed-in sessions we store the browser's user-agent, a hashed session identifier and its expiry. These are used for site operation and security, not cross-site tracking.

03 / COOKIES THAT SERVE A PURPOSE

We use first-party cookies for the account, profile and form features you request. We do not place analytics or advertising cookies, use tracking pixels, or load fonts from third-party servers. Visiting public pages without using these features does not create a person or user session.

The cookie notice is provided here rather than through a tracking-consent banner because these cookies are limited to the stated functional purposes. We do not treat agreeing to this policy as permission to add other tracking. If we introduce an optional purpose that requires consent, we will request that consent before enabling it.

You can delete cookies or block them in your browser. Clearing them stops recognition in that browser, but does not delete your profile or account. Blocking necessary cookies may prevent registration or sign-in features from working. Pages with the login form use the form-security cookie even before you sign in. Some browsers can restore session cookies when restoring a previous browsing session.

04 / YOUR CHOICE AND THE LEGAL BASIS

The account registration and event signup checkboxes confirm that you have read and agreed to this notice and are requesting the relevant service. Processing needed to provide your requested account and services is based on performance of that service (Article 6(1)(b) GDPR). Protecting the site and preventing misuse is based on our legitimate interests in secure operation (Article 6(1)(f)). Any processing required by law relies on Article 6(1)(c).

For new newsletter subscriptions, we rely on your consent given through the email confirmation step (Article 6(1)(a) GDPR). Every newsletter email includes an unsubscribe link. You can use it to withdraw your consent at any time, without affecting your account or event signups. Existing profiles are marked as subscribed when the newsletter feature is introduced; that migration flag is not itself evidence of consent.

We do not rely on a compulsory privacy-policy checkbox as blanket consent for unrelated processing. You can leave the optional phone field empty and browse public pages without creating an account. If we separately ask for consent for an optional feature, you can withdraw it by contacting us, without affecting processing already lawfully carried out.

05 / WHO CAN ACCESS YOUR DATA

Site records are stored on our own server and are accessible only to authorized people operating the site where needed. We use Fastmail to deliver newsletter confirmation messages and newsletters, including your name, email and confirmation link where relevant. We also use it to deliver event acceptance emails, including your name, email address, event details, attendee instructions and a personal access link. Fastmail and the receiving email provider process that message for delivery. We do not sell or rent personal data, share it with advertisers or analytics services. We may disclose only the information legally required if a competent authority lawfully requires it.

External links open other websites with their own privacy practices. If you email us, delivery also involves the email services used by you and us; we do not send passwords or account session cookies in these messages.

06 / HOW LONG WE KEEP IT

We retain account and profile data while needed to provide the requested services, until you request deletion, or until it is no longer needed for those purposes. We may retain limited data where a legal obligation or a specific, documented need to establish or defend a legal claim requires it. Operational records are retained only as long as necessary for secure operation and resolving incidents.

Newsletter confirmation links expire after 24 hours and can be used once. Token digests are removed after confirmation or replaced on a later eligible request. Expired records may remain until cleanup; they cannot activate a subscription. An unconfirmed request may leave a disabled profile so we can recognize later requests. You can ask us to delete that profile. We retain your subscription preference while needed to operate the newsletter and honor withdrawal.

Session tokens stop working at their expiry. Expired session rows are removed when the relevant session functionality is next used; replacing a cookie or logging out revokes the previous token. Deleting browser cookies alone does not immediately remove the associated server record. Passwords are stored as hashes, never as readable passwords.

07 / YOUR RIGHTS

You may request access to your personal data, correction, deletion, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests and withdraw any separately given consent. Email info@infinite.cz; we may need to verify your identity before acting on a request. We normally respond within one month, subject to the extensions allowed by the GDPR.

You can also lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů, or your local supervisory authority.

08 / CHANGES TO THIS POLICY

We will update this page if our data practices change and show the date above. Material changes will be brought to your attention where appropriate. An updated notice does not by itself authorize new uses that require your consent.