Controller

The operator of the Procura application at procura.cz is Tomáš Vedej (vedej.tomas@gmail.com). On a customer deployment, the controller is the operator of that instance.

The public demo at /vstup does not use registration — roles are chosen in the browser and are not a personal account. After sign-in (email and password / invitation) we process the user’s identity and their organization’s purchasing data to the extent needed to provide the service.

Cookies and browser data we use

Strictly necessary — localStorage for the demo role, cookie consent and helper session data; after sign-in also Supabase authentication session cookies (without them we cannot keep you signed in). Without these the site cannot work as intended.
Marketing cookies — we do not use them (no remarketing or advertising cookies from Google Ads / Meta, etc.).
Third-party analytics cookies — Google Analytics 4 (Google Ireland Limited) only after you consent in the cookie banner (“Accept all” or by enabling analytics cookies in settings). Until then Consent Mode keeps analytics_storage denied and the gtag script is not loaded. After consent we measure anonymised IP, page views and selected events (e.g. demo role selection). We do not use ad personalisation or ad_storage.

Google Search Console

We use Google Search Console to verify site ownership and monitor indexing in Google Search. Verification uses an HTML meta tag (google-site-verification). Search Console does not set cookies in the visitor’s browser or run visitor analytics — it works with Google’s crawl and index data for public pages.

Legal basis

We process strictly necessary cookies and localStorage on the basis of legitimate interest and necessity to provide the service (Art. 6(1)(f) GDPR). Google Analytics starts only after consent in the cookie banner (Art. 6(1)(a) GDPR). Consent is stored in localStorage. Processing by Google may involve transfers outside the EEA (e.g. the US) under Google’s contractual safeguards (standard contractual clauses). Details: policies.google.com/privacy.

Account and purchasing data

After sign-in we process email, name, organization role and purchasing data (order requests, orders, suppliers, attachments) within your organization. The purpose is running the purchasing process, not marketing.

Hosting, database and Google

Hosting (Vercel) and database / authentication (Supabase) may process technical logs (IP address, request time) for security and operations. Scope and retention are set by those providers. Google Analytics data is retained according to the GA4 property settings in the Google account; Search Console retains indexing operational data under Google’s terms.

Your rights

You have the right of access, rectification, erasure, restriction, objection and to lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz). You can change or withdraw analytics cookie consent anytime via the “Cookie settings” link in the site footer. After withdrawal Google Analytics is switched off and its cookies are deleted.

Contact

Privacy questions should go to vedej.tomas@gmail.com.