Controller
The operator of the Procura application at procura.cz is Tomáš Vedej (vedej.tomas@gmail.com). On a customer deployment, the controller is the operator of that instance.
The public demo at /vstup does not use registration — roles are chosen in the browser and are not a personal account. After sign-in (email and password / invitation) we process the user’s identity and their organization’s purchasing data to the extent needed to provide the service.
Cookies and browser data we use
- Strictly necessary — localStorage for the demo role, cookie consent and helper session data; after sign-in also Supabase authentication session cookies (without them we cannot keep you signed in). Without these the site cannot work as intended.
- Marketing cookies — we do not use them (no remarketing or advertising cookies from Google Ads / Meta, etc.).
- Third-party analytics cookies — Google Analytics 4 (Google Ireland Limited) only after you click “Got it” on the cookie banner. Until then Consent Mode keeps analytics_storage denied and the gtag script is not loaded. After consent we measure anonymised IP, page views and selected events (e.g. demo role selection). We do not use ad personalisation or ad_storage.
Google Search Console
We use Google Search Console to verify site ownership and monitor indexing in Google Search. Verification uses an HTML meta tag (google-site-verification). Search Console does not set cookies in the visitor’s browser or run visitor analytics — it works with Google’s crawl and index data for public pages.
Legal basis
We process strictly necessary cookies and localStorage on the basis of legitimate interest and necessity to provide the service (Art. 6(1)(f) GDPR). Google Analytics starts only after consent via “Got it” (Art. 6(1)(a) GDPR). Consent is stored in localStorage. Processing by Google may involve transfers outside the EEA (e.g. the US) under Google’s contractual safeguards (standard contractual clauses). Details: policies.google.com/privacy.
Account and purchasing data
After sign-in we process email, name, organization role and purchasing data (order requests, orders, suppliers, attachments) within your organization. The purpose is running the purchasing process, not marketing.
Hosting, database and Google
Hosting (Vercel) and database / authentication (Supabase) may process technical logs (IP address, request time) for security and operations. Scope and retention are set by those providers. Google Analytics data is retained according to the GA4 property settings in the Google account; Search Console retains indexing operational data under Google’s terms.
Your rights
You have the right of access, rectification, erasure, restriction, objection and to lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz). You can withdraw analytics cookie consent anytime by clearing localStorage in your browser (the consent key) — the cookie banner will show again and GA will not run until you click “Got it” again.
Contact
Privacy questions should go to vedej.tomas@gmail.com.