Privacy Policy

1. Introduction

This Privacy Policy describes how the data controller processes personal data when you visit the website ondrej-ditrt.cz and when you use the contact form. Processing is carried out primarily in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Czech Act No. 110/2019 Coll., on personal data processing, and — for cookies — also with Czech Act No. 127/2005 Coll., on Electronic Communications.

2. Data controller

Ondřej Ditrt
Company ID: 06243703
Registered address: Češkova 1124, 530 02 Pardubice, Czech Republic
E-mail: ditrt.ondrej@gmail.com

Use the e-mail address above for all communication regarding personal data processing, including exercising your rights.

3. What data we process

3.1. Contact form data

When you submit the contact form, we process your name, e-mail address, and the content of the message you send us.

Providing this information is voluntary. However, without your e-mail address we cannot reply to you.

3.2. Cookies and analytics

With your consent, the website may store analytics cookies of the Google Analytics 4 service. No analytics cookies are stored without your consent. A detailed list of cookies is provided in section 8.

3.3. Visit logs (server logs)

The hosting provider (WEDOS Internet, a.s.) automatically records your IP address, timestamp, browser type, and the requested URL. These records are used for security and operational diagnostics.

4. Purposes and legal bases of processing

4.1. Handling enquiries from the contact form

Purpose: to respond to your enquiry and, where applicable, prepare an individual service offer.
Legal basis: Article 6(1)(b) GDPR — steps taken at the request of the data subject prior to entering into a contract.

4.2. Website traffic measurement

Purpose: identifying traffic sources and aggregated visitor behaviour for evaluation and improvement of the website content.
Legal basis: Article 6(1)(a) GDPR — consent given via the cookie banner. You may withdraw your consent at any time.

4.3. Website security and operation

Purpose: protection against attacks, error diagnostics, ensuring service availability.
Legal basis: Article 6(1)(f) GDPR — legitimate interest of the controller in securing the website.

5. Retention period

• Contact form data: 3 years from the last communication (corresponds to the general limitation period under Section 629 of the Czech Civil Code).
• Analytics cookies on the user's device: a maximum of 13 months from the last visit to the website (detailed cookie list in section 8).
• User and event data in Google Analytics 4: 14 months (data retention setting in the Google Analytics admin).
• Server logs: only for the time necessary for security and diagnostic purposes, according to the hosting configuration (typically several months).

After these periods, data is deleted or anonymised, unless a longer archiving period is required by law.

6. Recipients of personal data and processors

For the processing of personal data we use the following processors, who process personal data on behalf of the controller based on contractual terms (or data processing agreements pursuant to Article 28 GDPR):

• WEDOS Internet, a.s. — Company ID 28115708, Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic. Purpose: website hosting and related technical operation (data centres located in the Czech Republic).
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (or Google LLC and other companies of the Google group defined in the Google Analytics Terms of Service as "Google Affiliates"). Purpose: Google Analytics 4 service for traffic measurement and Gmail service for processing e-mail communication sent from the contact form.

Other than these processors, your personal data is not shared with third parties, except where required by law (e.g. requests from law enforcement authorities).

7. Transfer outside the EU

Within Google services (Google Analytics 4 and Gmail), some data may be transferred outside the European Economic Area, in particular to the United States. For Google Analytics 4 this includes technical data about the device and browser, and derived data about website usage. According to Google, full IP addresses of EU visitors are neither stored nor logged — they are used only to derive coarse geolocation and are then discarded.

The transfer is based on the European Commission's adequacy decision under the EU–US Data Privacy Framework dated 10 July 2023, to which Google LLC is certified. Google also states that, where necessary, additional transfer mechanisms are used (in particular Standard Contractual Clauses).

For more information on the data protection framework, please visit the European Commission website.

8. Cookies — detailed list

The website uses the following cookies and similar technologies for storing information on your device:

You give consent to analytics cookies expressly by clicking the corresponding button in the cookie banner. Without this consent, no analytics cookies are stored.

You can change your decision regarding analytics cookies at any time by clicking "Cookie settings" in the footer of the main website page.

9. Your rights

As a data subject, you have the following rights:

• Right of access (Article 15 GDPR) — to obtain information about what data we process about you.
• Right to rectification (Article 16 GDPR) — to correct inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR) — to request deletion of your data ("right to be forgotten").
• Right to restriction of processing (Article 18 GDPR) — to suspend processing in certain cases.
• Right to data portability (Article 20 GDPR) — to receive your data in a structured format.
• Right to object (Article 21 GDPR) — against processing based on legitimate interest.
• Right to withdraw consent (Article 7(3) GDPR) — withdrawal does not affect processing carried out before withdrawal.
• Right to lodge a complaint with a supervisory authority — Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.

10. How to exercise your rights

To exercise any of the rights listed above, send your request to ditrt.ondrej@gmail.com. We will respond within 1 month of receiving the request. In justified cases (in particular due to the complexity or number of requests), this period may be extended by up to two further months, of which we will inform you.

To verify your identity, we may request additional information to prevent the abuse of these rights by a third party.

11. Automated decision-making

Your personal data is not subject to automated individual decision-making within the meaning of Article 22 GDPR, nor to profiling with legal or similarly significant effects on you.

12. Security of personal data

We have implemented appropriate technical and organisational measures to safeguard your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage.

13. Changes to this policy

This policy may be updated in the future due to changes in legislation, technological changes, or modifications to the website content. The current version is always available on this page. The date of the last update is indicated at the bottom of this document.