Legal information

1. Provider identification

This service is operated by:

• HEXENKRAFT s.r.o.
• Registered office: V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic
• Company registration number (IČO): 29665931
• VAT: Not registered for VAT (small-business exemption); no VAT is charged.
• Registered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 450419
• Represented by: Matic Jezeršek, managing director (jednatel)
• Contact: hello@cybiq.eu

2. Privacy policy

Controller

The controller of your personal data is HEXENKRAFT s.r.o. (details above). For any privacy request, contact hello@cybiq.eu.

What we process, and why

• Your wizard answers: processed entirely in your browser. They are stored only in the page URL (the permalink) and are never transmitted to us unless you choose to share that link or include them in an email to us. No account is created.
• Your email address, if you email us (early-access requests, support, orders): to reply and, after a purchase, to deliver your documents and identify your order. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Order metadata (once you have ordered): order reference, amount, timestamps, your questionnaire frozen so your pack can be re-generated, and your consent to immediate delivery. Legal basis: Art. 6(1)(b) and, for retention, our legal obligation under accounting/tax law (Art. 6(1)(c) GDPR).
• Watch-list address, if you subscribe to CRA change updates: to email you when the law or its published dates change. Legal basis: your consent (Art. 6(1)(a) GDPR). Used for nothing else, never shared or sold, every message carries an unsubscribe link.
• Purchase email & regulatory-watch service, if you buy the Notified-body readiness pack: we use your purchase email to deliver your documents and to send you the CRA change updates included in that tier. Legal basis for both: performance of the contract (Art. 6(1)(b) GDPR), no marketing consent is sought because these are contractual deliveries, not advertising. The watch service ends on 11 December 2027 as stated in the terms; you can stop the notifications at any time without affecting your document access. These mails contain change notices only, never marketing for other products.
• Aggregate analytics: none today. This site runs no web analytics, no advertising and no third-party trackers, so no cookie banner is needed. If we later add privacy-friendly, cookieless analytics, this policy will be updated before that happens.

Processors and where data sits

There is no online payment today. Orders are arranged by email while automated checkout is being built, so we never see or store card numbers at all. When checkout launches it will be handled entirely by Stripe (we would keep only a Stripe session reference; Stripe's own privacy policy would govern payment data), and this policy will be updated before that happens. We also use an EU hosting provider to run the service.

Free applicability check

The free CRA applicability check runs on the answers you submit and returns a result in your browser. No account is created and no answers are stored by us. The downloadable determination memo and draft pack are generated locally in your browser.

Retention

Email correspondence is kept only as long as needed to handle your request. Order records (including the frozen questionnaire) are kept as long as needed to provide re-downloads and to satisfy statutory accounting and tax retention periods, then deleted.

Your rights

Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, and to data portability. Contact hello@cybiq.eu to exercise them. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or with the supervisory authority in your country of residence.

3. Terms of service

The product

Cybiq provides automatically generated compliance documents (digital content) based on the answers you provide, grounded in Regulation (EU) 2024/2847 (Cyber Resilience Act). The documents are not legal advice: they are a structured starting point. For a binding legal assessment, consult a qualified lawyer.

Price and delivery

The compliance packs are one-time purchases at the prices displayed on this site. The price is final; the seller is not registered for VAT (small-business exemption), so no VAT is added. Ordering currently works by email: you request a pack at hello@cybiq.eu, and once your payment is received we send the documents to your email address by hand, normally within one business day. Automated checkout with immediate delivery is planned but not live; until then there is no payment page and nothing is delivered automatically.

For the Notified-body readiness pack, the included regulatory-watch update service runs until 11 December 2027 (full application of the CRA) and then ends; you can ask us to stop the notifications at any time without losing access to your documents.

14-day right of withdrawal, and its waiver for digital content

As a consumer you normally have the right to withdraw from a distance contract within 14 days without giving a reason. However, for digital content not supplied on a tangible medium, this right expires once performance has begun with your prior express consent and your acknowledgement that you thereby lose the right of withdrawal (Art. 16(m) of Directive 2011/83/EU; Sec. 1837(l) of the Czech Civil Code).

When you order by email, we ask you to give this express consent before you pay: you agree that the pack is delivered as soon as your payment arrives and acknowledge that you thereby waive your 14-day right of withdrawal. We do not deliver until we hold that consent. If you do not give it, do not complete the purchase; your statutory withdrawal right is then preserved and you may use the model form below. If you purchase as a business rather than as a consumer, the 14-day withdrawal right does not apply.

Complaints and defective performance

Your statutory rights regarding defective digital content are unaffected by the withdrawal waiver. If your pack fails to generate, cannot be downloaded, or does not correspond to the answers you submitted, contact hello@cybiq.eu and we will remedy the defect or refund you. We resolve consumer complaints within 30 days.

Out-of-court dispute resolution

You may submit a consumer dispute to the Czech Trade Inspection Authority (ČOI, coi.gov.cz) for out-of-court resolution. Consumers resident elsewhere in the EU may use the consumer-protection body of their own country.

Governing law

These terms are governed by the law of the Czech Republic. Where you contract as a consumer, the mandatory consumer-protection provisions of your country of habitual residence remain unaffected (Art. 6 Rome I Regulation 593/2008).

4. Model withdrawal form

Complete and return this form only if you wish to withdraw from the contract and you did not consent to immediate delivery (see section 3).

To: HEXENKRAFT s.r.o., V zahradách 2462/31, Libeň, 180 00 Praha 8, Czech Republic, hello@cybiq.eu

I/We hereby give notice that I/We withdraw from my/our contract for the supply of the following digital content:

- Ordered on / received on: ____________
- Name of consumer(s): ____________
- Address of consumer(s): ____________
- Order reference: ____________
- Signature (only if on paper) and date: ____________

5. Accessibility statement

HEXENKRAFT s.r.o. is committed to making Cybiq usable by everyone. We apply the European Accessibility Act, Directive (EU) 2019/882, which has applied since 28 June 2025, and the harmonised European standard EN 301 549 that implements it for websites.

Conformance target

Cybiq targets the Web Content Accessibility Guidelines (WCAG) 2.1 at level AA, the level EN 301 549 requires. This is a self-assessment: it reports our own testing, and no external body has audited or certified this site.

How we tested it

• Automated testing with axe-core 4.12.1 over every public page, in both the light and the dark theme, at a 1280 pixel desktop width and a 390 pixel mobile width, including the applicability check after it has produced a verdict.
• A manual keyboard walk of the check: skip link, header, wizard questions, verdict and footer, confirming focus order and a visible focus indicator on every control.
• Colour contrast checked on every documented colour pair in both themes, re-asserted by the automated test suite on every build.

Date of this statement and of the most recent review: 3 September 2026.

Known limitations

• The applicability check needs JavaScript. Without it the page shows a short explanation and the static summary beneath it, but the check itself cannot run.
• The compliance documents are HTML files you print to PDF yourself. We have not tested the accessibility of the PDF your own printer or browser produces.
• Automated tools find only part of what can go wrong. Beyond the keyboard walk above, we have not tested with screen readers, screen magnification or voice control, and no testing with disabled users has taken place.
• Quoted legislative text is reproduced verbatim from the Official Journal, in its own wording and structure. We do not simplify it, because a paraphrase would stop being a citation.

Feedback and enforcement

If any part of this site blocks you, write to hello@cybiq.eu, naming the page and what went wrong. We aim to reply within 30 days, the same period we apply to consumer complaints. If our reply does not resolve it, you can contact the market surveillance authority responsible for accessibility in your country of residence.

6. Content sources

All legislative quotations on this site come from Regulation (EU) 2024/2847, OJ L, 12.12.2024 (CELEX 32024R2847). EU publications are reusable under the reuse policy of EU data.