Data Collection Statement

Last updated: 2026-05-27 · cz-agents.dev

cz-agents (the service) provides due diligence and compliance reporting for Czech legal entities. This page explains where the underlying data comes from, how we collect it, and the principles we follow.

Data sources

All data processed by cz-agents is sourced from publicly accessible Czech and EU government registries:

• Obchodní rejstřík (Czech Commercial Register) — company registration, statutory bodies, share capital, NACE codes
• Sbírka listin (Collection of Documents) — annual financial statements published under § 21a of the Czech Accounting Act
• ARES (Administrative Register of Economic Entities) — Ministry of Finance public registry
• Evidence skutečných majitelů (UBO Register) — beneficial ownership data
• ISIR (Insolvency Register) — insolvency proceedings
• EU Financial Sanctions Files, OFAC SDN — sanctions screening
• ESEF iXBRL filings — structured financial reports from companies listed on Prague Stock Exchange
• Czech National Bank, Ministry of Finance datasets — supervisory and macroeconomic context

We do not collect data from private databases, leaked sources, or social media. We do not aggregate personal data beyond what is already published as a statutory transparency requirement (e.g., names of company directors as registered in the Commercial Register).

How we collect

Where source systems provide structured APIs or bulk feeds (ARES, GLEIF, ESEF iXBRL, BRIS), we use them as the preferred access method. Where the only available format is a public-facing web page, we retrieve documents through standard HTTP requests with the following principles:

• Source-friendly access patterns — we respect the operational capacity of source systems and minimize impact
• Preference for low-traffic windows — to avoid contention with regular users
• No circumvention — we do not bypass captchas, CDN bot mitigations, or technical access controls
• Standard infrastructure — requests originate from named datacenter IP addresses we own and manage
• Audit trail — every external fetch is logged internally for review

If a source operator at any point requests that we adjust our access pattern or stop entirely, we comply immediately. There is no commercial pressure from our customer-facing service that would push us to ignore such a request.

What we do not do

• We do not solve captchas or bypass anti-bot systems
• We do not use residential proxy pools or other evasion infrastructure
• We do not aggregate data from sources whose terms of use prohibit it where such prohibition is clear and substantive
• We do not resell raw datasets — our service provides analytical reports built on top of public data
• We do not enrich public-registry data with non-public personal data (private addresses, contact details, family information)

Legal basis

Personal data of statutory bodies (company directors, board members) processed by the service falls under GDPR Art. 6(1)(f) — legitimate interest, balanced against the limited privacy expectations of data subjects whose information has been published under a statutory transparency obligation.

Where applicable, the Art. 14(5)(c) exemption from individual notification obligations applies, because the data is sourced from public registries whose disclosure is "expressly laid down by Union or Member State law."

For the full GDPR data subject rights and operational privacy policy, see our Privacy Policy.

Contact