CZ EN DE
Write an enquiry
CZ EN DE
Enquiry

PRIVACY POLICY

Plain English, GDPR-grade.

Your data is yours.

What I collect, why I collect it, and how I protect it. No legalese.

Effective from 23 September 2026

This website is run by me, Ondřej Kriška — Dunajovská 116, 691 81 Březí, Czech Republic, company ID 19231407. I have no team and no sales department, which also means I am the only person who ever sees your data. You can write to me any time at ok@ondraweb.cz.

Below you will find what I know about you, where I got it, why I keep it, and how you can stop it at any time.

What I know about you

What you send me yourself

When you fill in one of the forms on this site, or simply email me, all I have is what you filled in yourself:

  • name and email — without them I have no way to reply,
  • phone, company and rough budget — optional; fill in your phone only if you want me to call,
  • subject and message — that is, whatever you write to me,
  • attachments, if you add any — up to 5 files, each under 10 MB and 20 MB in total.

I do not look up anything else about you and I do not buy data about you anywhere. I only ask for billing details once we agree to work together and I need to invoice you.

What gets stored automatically

Your IP address and a note about which browser you use are attached to every message sent. I do not read it and I do not build profiles from it — it is only a trace in case someone abuses the form to send spam.

Every message is also stored in my database, not just sent by email. That is so your inquiry does not get lost if mail delivery plays up.

What analytics measure

Until you click “Accept all” in the bar at the bottom, nothing is measured. Once you do consent, two tools switch on:

  • Google Analytics 4 — anonymous traffic statistics: how many people come to the site, where from, and which pages interest them.
  • Microsoft Clarity — heatmaps and session recordings: an anonymised recording of cursor movement and clicks that shows me where people get lost on the site. Page content is masked in the recording, so I cannot see what you type into a form.

I do not use advertising cookies. In Google Analytics the advertising consents ad_storage, ad_user_data and ad_personalization stay permanently set to denied — it is not a switch I could flip by accident. If you click “Decline” in the bar, the measurement scripts are never loaded at all. The exact list of cookies and how long they last is on the Cookies and analytics page.

Why I keep it

  • To reply to you. That is the whole reason the form is on the site.
  • To invoice you, if we agree to work together.
  • To protect the form from spam — that is what the IP address is for.
  • To know what works on the site — that is what analytics are for, and only if you allow them.

I do not use your data for anything else. I do not pass it on for marketing, I do not sell it, and I do not add you to any newsletter — I do not have one.

And now the formal side of it

  • I process your message so that I can take steps towards the cooperation you asked me about (Art. 6(1)(b) GDPR) and on the basis of the consent you tick next to the form (Art. 6(1)(a)).
  • I keep invoices and contracts because the law requires me to (Art. 6(1)(c)).
  • I hold the IP address attached to a message on the basis of my legitimate interest in protecting the form from abuse (Art. 6(1)(f)).
  • I switch analytics on only with your consent (Art. 6(1)(a)), and you can withdraw it at any time.

How long it stays with me

  • An inquiry that came to nothing — I keep it for as long as either of us might still come back to it. Once it is clear nothing will come of it, I delete it. And if you write to me, I delete it straight away.
  • An inquiry that turned into a project — it stays with the project for as long as the project runs, and then for as long as either of us might need to go back to what was agreed.
  • Invoices and accounting records — this one is not up to me, the period is set by Czech accounting law. Until it runs out, I cannot delete them even at your request.
  • Form attachments — they sit on the non-public part of the server, are not reachable through any link, and the same rules apply to them as to the inquiry they belong to.
  • Your measurement consent — your browser remembers “Accept all” for 365 days and “Decline” for 180 days. After that the bar asks again.
  • Analytics cookies — Google Analytics 2 years by default, Microsoft Clarity according to Microsoft's settings, typically a year.

Who else gets to your data

I do not sell it and I do not pass it to anyone for marketing. A handful of companies do have technical access to it, because the site and my mailbox run on their services:

  • Hetzner (Germany) — the server the site and the database run on.
  • Seznam.cz — runs the ok@ondraweb.cz mailbox that your inquiries arrive in.
  • Google — Google Analytics, and only if you allow measurement.
  • Microsoft — Clarity, and only if you allow measurement.

Google and Microsoft process some of the data outside the European Union. If you are not comfortable with that, click “Decline” in the bar — neither of them will reach you then.

What you can do about it

It is your data, so you decide. Write to me at ok@ondraweb.cz any time and ask me to:

  • tell you what I hold about you — I will write it up and send it,
  • correct anything that is wrong,
  • delete what I hold about you — except what I have to keep for accounting,
  • restrict the processing, or stop it if you object to it,
  • send you your data in a format you can take elsewhere.

I will get back to you within 30 days, usually much sooner. I will not ask you for a form or a certified signature — an email from the address you wrote to me from is enough.

You can withdraw your measurement consent with one click on the Cookies and analytics page, or by clearing cookies in your browser.

If you ever feel I am handling your data badly, please write to me first — it will usually be a misunderstanding I can fix right away. If I do not fix it, you can complain to the Czech Data Protection Authority (uoou.cz) or to the supervisory authority in your own country.

How I keep it safe

The site runs over HTTPS, attachments sit outside the public part of the server, and I am the only one with access to the database. Promising you that nothing will ever go wrong would be silly — nobody can honestly promise that. What I can promise is that if something did go wrong and it put you at risk, you would hear it from me and not from the news.

Children

I build websites for companies and sole traders. This site is not aimed at children and I do not knowingly collect data from anyone under 18. If a child did send me their data anyway, write to me and I will delete it.

When I change this text

I will update these terms from time to time — for instance when a new tool is added to the site. The new version appears here and the effective date at the top changes. If it is a change that genuinely affects you, I will ask for your consent again.

Contact

Ondřej Kriška, Dunajovská 116, 691 81 Březí, Czech Republic, company ID 19231407
Email: ok@ondraweb.cz

I do not have a data protection officer — my business is far too small for that. You are writing directly to me.