Privacy Policy

Last updated: 19 August 2026

1. Who is the controller

BLAST software, s.r.o., a company registered in the Czech Republic under registration number (IČO) 26383250 and EU VAT number (DIČ) CZ26383250, with its registered office at K Jezu 279, Sedlec, 332 02 Starý Plzenec, Czech Republic, is the controller of personal data collected through blastsoftwaresro.com.

Data protection contact: privacy@blastsoftwaresro.com. Telephone +420 602 211 291, Monday to Friday, 09:00–17:00 Central European Time (CET/CEST). We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; the address above reaches the person responsible.

You can verify our identity independently in ARES and in EU VIES.

2. What we collect, why, and on what legal basis

We collect only what a form asks for. There is no tracking pixel, no advertising network, no data broker and no profiling on this site.

2.1 Project enquiry form (/quote)

• Data: company or organisation name, your name, business email address, optional telephone number, optional country, type of work, indicative budget band, timeline, software scope, technology preferences, and the free-text requirements you write. If you used the Solution Estimator, the answers you gave it and the resulting profile are attached.
• Purpose: to assess the request, prepare a proposal and reply.
• Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and, where you write on behalf of an organisation, Article 6(1)(f) (legitimate interest in responding to business enquiries).
• Retention: 24 months from our last contact about the enquiry, then deleted.

2.2 Contact form (/contact)

• Data: your name, email address, optional telephone number, optional company, subject and the content of your message.
• Purpose: to read your message and reply to it.
• Legal basis: Article 6(1)(b) and Article 6(1)(f) GDPR.
• Retention: 12 months from our last contact, then deleted.

2.3 Optional commercial contact

The enquiry form contains one optional, unticked checkbox asking whether we may contact you later about related services and technical articles. If you tick it, the legal basis is your consent under Article 6(1)(a) GDPR and §7 of Czech Act No. 480/2004 Sb., and we record the fact and the time of that consent. You can withdraw it at any time by replying to any such message or writing to privacy@blastsoftwaresro.com; withdrawal does not affect the lawfulness of what was sent before. Leaving the box unticked has no effect on your enquiry.

2.4 Technical data

• Abuse prevention: when a form is submitted, our API stores a salted SHA-256 hash of the sending IP address, a truncated user-agent string and a timestamp, purely to rate-limit automated submissions. The raw IP address is not stored and the hash cannot be reversed to it. Legal basis: Article 6(1)(f) — securing our own systems. Retention: 24 hours for the rate-limit counter, 12 months for the stored hash alongside the message.
• Server logs: our web server keeps standard access logs. They are used to investigate faults and abuse, and are rotated within 30 days.
• Application logs: our API logs errors and warnings. It never writes the contents of a form, a message body or an email address to a log file.

3. Cookies and similar technologies

Strictly necessary storage only, unless you choose otherwise. Analytics and advertising measurement are off by default; no tag loads and nothing is measured until you turn them on in the consent banner. Every cookie and storage key is listed by name, purpose and lifetime in the Cookie Policy, where you can also change or withdraw your choice at any time.

Where advertising measurement is enabled by you, we use Microsoft Advertising's UET tag with Consent Mode v2: the tag is told your choice, and the default state before any choice is “denied”.

4. Who else sees your data

We do not sell, rent or trade personal data, and we do not share it with advertising networks.

Our website and API are hosted by Namecheap, Inc. on a server located in Atlanta, Georgia, United States. The provider acts as a processor under Article 28 GDPR and can technically access the systems on which your data is stored in the course of operating them.

Your data is stored outside the European Economic Area. Anything you send through a form on this site is stored on a server in Atlanta, Georgia, United States. We tell you this plainly because Article 13(1)(f) GDPR requires it, and because a policy that quietly implies EU storage while the server sits elsewhere is worse than no policy at all.

The transfer relies on the European Commission’s Standard Contractual Clauses under Article 46(2)(c) GDPR, which Namecheap states it applies to transfers to its United States based servers. Namecheap has also appointed the European Data Protection Office (EDPO) as its GDPR Article 27 representative in the EU, and publishes a data protection contact at dpo@namecheap.com. Their statement of this is in their own privacy policy; we last checked it on 2026-08-19. You may request a copy of the safeguards we rely on from privacy@blastsoftwaresro.com.

If storage inside the EEA is a requirement for your organisation, say so before sending anything through a form here and write to info@blastsoftwaresro.com instead — and tell us, because it is a reason for us to move the hosting.

Email notification: None engaged — form notifications are handed to the server’s own mail transfer agent (Postfix), and are disabled entirely while MAIL_ENABLED is false.

We disclose personal data to a public authority only where we are legally required to do so, and we will tell you if that happens unless we are prohibited from doing so.

5. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• ask what personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have data erased where there is no longer a lawful reason for us to keep it;
• ask us to restrict processing while a dispute about accuracy or lawfulness is resolved;
• receive data you gave us in a structured, machine-readable format, or have it sent to another controller;
• object to processing based on legitimate interest — including a general right to object to direct marketing at any time, which we always honour;
• withdraw consent, where consent is the basis, without affecting what was lawful before.

Write to privacy@blastsoftwaresro.com. We answer within one month as required by Article 12(3), and we do not charge for it. We may ask you to confirm your identity where we cannot otherwise be sure the request comes from you.

You also have the right to complain to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You may also complain to the authority in your own EU country of residence.

6. Security

The site is served over HTTPS only. Form submissions are validated and rate-limited server-side. Access to stored enquiries is restricted to the people who need it to answer you. Passwords and access credentials for our systems are not shared and are rotated when staff change. We do not store payment card details of any kind — invoicing is by bank transfer.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours under Article 33 and inform you directly where Article 34 requires it.

7. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to privacy@blastsoftwaresro.com and we will delete it.

8. Automated decision-making

None. The Solution Estimator is a calculator that runs in your browser and produces a description of engineering effort; it makes no decision about you, has no legal effect, and does not profile you. Whether we take on a project is decided by people.

9. Changes to this policy

When this policy changes materially we update the date at the top and, where the change affects how we use data you have already given us, we tell you directly. Previous versions are available on request.

10. Contact

BLAST software, s.r.o., K Jezu 279, Sedlec, 332 02 Starý Plzenec, Czech Republic. Email privacy@blastsoftwaresro.com, telephone +420 602 211 291. IČO 26383250, DIČ CZ26383250.