Privacy notice

Data processed and purposes

• Operation and security. The server may log IP address, request date and time, requested page, browser, and technical messages to deliver the site, prevent abuse, and handle incidents.
• Optional statistics. Only after consent, Google Analytics collects technical and usage data including viewed page, referrer, browser, device, navigation interactions, and approximate location. The association does not use Analytics for advertising, remarketing, or profiling.
• Consent evidence. When you choose statistics, the site creates a random receipt ID and stores in the A.R.Mi. register only that ID, the decision, notice version, origin, and recorded time. The register does not contain an IP address, browser, visited page, or Analytics data.
• Published material. The site presents sources, association roles, awards, and historical material. For information about living people, A.R.Mi. publishes only what it considers necessary for its cultural and commemorative work or what the person has authorised.

Legal bases

Operation, security, and publication necessary for cultural and commemorative work rely on the association's legitimate interests under Article 6(1)(f) GDPR. Google Analytics statistics rely on consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive. Consent can be withdrawn at any time.

Sources and recipients

Technical data comes from the browser and server. Memorial content comes from A.R.Mi. archives, historical and institutional sources, material submitted for verification, and, for the public awards register, a Google Sheets source published by the association.

Recipients are the hosting provider that delivers the site, including the Cloudflare D1 database that holds the pseudonymous consent register, Google Analytics when consent is given, and Google Sheets for the public register. When a record displays a scan hosted by an external archive, the browser may connect directly to that provider, which receives technical connection data.

For Google Analytics 4, the EEA recipient is Google Ireland Limited, named as the Google End Controller in the Google Measurement Controller-Controller Data Protection Terms. Google LLC and other Google entities may process data in the United States or other countries. For transfers from the EEA to the United States, Google says it relies on the EU-U.S. Data Privacy Framework where applicable and, in other cases, on Standard Contractual Clauses; see Google's international data-transfer information. You can request information or a copy of the relevant safeguards at web@milovice-memorial.org.

On the public hosted mirror at armi-milovice.mlovecchio.chatgpt.site, Cloudflare may set the technical __cf_bm cookie to protect the service from automated traffic; it is not used for marketing or profiling.

Retention

• Technical logs are available only for the time needed for security, diagnostics, and the hosting provider's retention cycle.
• The analytics choice is kept in the browser for six months.
• The pseudonymous consent register is retained for 36 months to demonstrate the choice and handle requests or complaints; older entries are deleted automatically.
• Analytics cookies are configured to last no more than six months, subject to any shorter browser limit.
• Google Analytics event- and user-level data is retained for two to fourteen months, depending on the property setting. Aggregate reports may remain available longer and are deleted or reviewed when no longer needed.
• Historical and commemorative material is retained while it serves research and remembrance, unless a correction, justified removal, or other obligation applies.

Your rights and complaints

You can request access, rectification, erasure, restriction, objection, and, where applicable, portability at web@milovice-memorial.org. You can withdraw analytics consent directly with the “Withdraw analytics consent” link in the footer: the site removes available Analytics cookies and reloads without Google Analytics. You can also complain to the Czech Office for Personal Data Protection.

Historical archive and changes

The memorial database mainly concerns people who died many decades ago; the GDPR generally does not apply to personal data of deceased people. A.R.Mi. will nevertheless review reports of errors, mistaken attribution, copyright issues, or personal data about living people. This notice will be updated before new purposes, forms, or non-essential technologies are introduced.