Privacy Policy
Effective from 30 August 2026
1. Who processes your data (controller)
The controller of personal data is:
- Individual Entrepreneur Hynek Kraus
- Identification code: 300417831 (National Agency of Public Registry of Georgia)
- Address: Internati Lane 10a, 0180 Tbilisi, Georgia
- Email: ahoj@hynekkraus.cz
The controller is established outside the European Union (in Georgia). The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) nevertheless applies to this processing, because I offer services to people in the European Union (Article 3(2) GDPR). This policy describes what data I process about you, why, who I share it with and what rights you have.
I have not appointed a Data Protection Officer (DPO) – I am not legally required to do so (Article 37 GDPR).
2. What data I process, why and on what legal basis
2.1. Contact (enquiry) form
When you send me an enquiry, I process the data you fill in: your name, email address, optionally your company name / website, the message text and details of the enquiry (project type, indicative timeline, source).
- Purpose: to answer your enquiry, communicate with you and, where relevant, take steps towards entering into a contract.
- Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) and my legitimate interest in responding to a business enquiry (Article 6(1)(f) GDPR).
- Voluntary: filling in the form is voluntary; without your name and email I cannot reply to you.
2.2. IP address and security
When the form is submitted, the server temporarily processes your IP address in order to prevent abuse of the form (limiting the number of submissions, protection against spam and bots).
- Purpose: security and protection of the site against abuse.
- Legal basis: my legitimate interest in securing the service (Article 6(1)(f) GDPR).
2.3. Traffic statistics (without cookies)
I use Vercel Web Analytics and Vercel Speed Insights to measure traffic and site performance. These tools are cookieless – they store no cookies on your device, create no persistent identifier and do not profile you. They work with aggregated, anonymised data.
- Purpose: basic statistics on traffic and site speed.
- Legal basis: my legitimate interest in measuring and improving the site (Article 6(1)(f) GDPR).
The site uses no advertising or tracking cookies (no cookie-based Google Analytics, no Meta Pixel). For details see the Cookie Policy.
3. Who I share data with (processors)
I do not share your data with third parties for commercial purposes. To run the site I use established providers who process data for me as processors under a contract pursuant to Article 28 GDPR:
| Processor | Purpose | Where |
|---|---|---|
| Vercel Inc. | website hosting and traffic measurement | USA / EU |
| Resend | delivery of the email containing your enquiry | USA / EU |
| Upstash | temporary storage protecting the form (rate limiting) | USA / EU |
| Cloudflare | bot protection for the form (Turnstile) | USA / EU |
4. Transfers outside the EU
The controller is established in Georgia and some processors process data in the USA – that is, outside the European Union. Neither Georgia nor the USA (absent participation in the EU-US Data Privacy Framework) is covered by a general EU adequacy decision, so transfers rely on appropriate safeguards under Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), or on the EU-US Data Privacy Framework for certified processors. A copy of the safeguards can be requested at ahoj@hynekkraus.cz.
5. How long I keep the data
- Enquiries: for as long as it takes to handle them plus reasonable follow-up communication, and no longer than 24 months from the last communication if no engagement follows. If a contractual relationship arises, retention is governed by the contract and statutory periods.
- IP address (rate limiting): short term, in the order of days.
- Traffic statistics: in aggregated, anonymous form.
6. Your rights
In relation to your personal data you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interests. You can exercise these rights by email at ahoj@hynekkraus.cz; I will normally respond within one month.
You may object at any time to processing based on legitimate interests (sections 2.1 to 2.3). Following an objection I will stop the processing unless I have compelling legitimate grounds to continue.
7. Complaint to a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work or the place of the alleged infringement (Article 77 GDPR). A list of national supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu.
Because this site is operated from the Czech Republic, you may also contact:
Office for Personal Data Protection (ÚOOÚ) Pplk. Sochora 27, 170 00 Prague 7, Czech Republic web: uoou.gov.cz
8. Automated decision-making
I do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
9. Changes to this policy
I may update this policy, in particular when the processing or the applicable law changes. The current version is always available on this page. This policy takes effect on 30 August 2026.