Personal Data Processing Information

In effect from 22 September 2026

As the data controller, I process the personal data of visitors to this site only to the extent needed to handle an enquiry. This page describes which data it is, why I process it and what rights you have.

1. Controller

Ing. Matěj Hrabálek
Registered address: Třešňová 916/16, 669 04 Znojmo, Czech Republic
Company ID (IČO): 24514616
E-mail: info@matejhrabalek.cz
Sole trader registered in the Trade Register kept by the Municipal Office of Znojmo.

2. What data is processed

I process only the data you enter into the contact form or send me yourself by e-mail:

first name and surname,
e-mail address,
the text of the message and any other data you write into it.

The site builds no visitor profiles, does not track behaviour across sites and passes no data to advertising networks.

Booking a consultation

If you book a consultation through the site, you go to the Microsoft Bookings scheduling system. There you enter your name, e-mail and possibly a note for the meeting. I process this data for the same purpose and for the same period as the data from the contact form. Going to the scheduling system is a deliberate step; nothing from Microsoft Bookings is loaded on this site.

Operational records

The hosting platform keeps technical access records that may contain an IP address and browser identification. They serve the operation and security of the site, are not linked to the content of the form and I do not use them for any other purpose.

Traffic measurement

The site measures traffic with its own script, without cookies and without any visitor identifier. For a page view it records the page address, the language, the domain of the site you came from (not the full address), campaign parameters in the link (utm), the device type (computer, tablet, phone) and whether you clicked the consultation booking or the LinkedIn link. For the contact form it records only whether it was sent, never its content. An approximate country and city are derived from the IP address; the IP address itself is not stored. The records therefore cannot be linked to a particular person.

If Global Privacy Control or Do Not Track is switched on in your browser, the site does not measure traffic at all.

3. Purpose and legal basis

Handling the enquiry: Answering your question, sending an offer and negotiating a possible contract. Legal basis: steps taken at your request prior to entering into a contract under Article 6(1)(b) GDPR, together with your consent under Article 6(1)(a) GDPR, which you give by ticking the box on the form.
Security and operation of the site: Protecting the site against abuse and resolving operational problems. Legal basis: legitimate interest under Article 6(1)(f) GDPR.
Traffic measurement: Finding out which pages and traffic sources work, and developing the content of the site. Legal basis: legitimate interest under Article 6(1)(f) GDPR. The simplest way to object is to switch on Global Privacy Control or Do Not Track in your browser.

Consent is voluntary and you can withdraw it at any time at info@matejhrabalek.cz. Withdrawal does not affect the lawfulness of processing before it. Without consent, however, the enquiry cannot be handled, because there would be nobody to reply to.

4. How long data is kept

If no cooperation follows, I delete the form data no later than 2 years after the last communication.
If cooperation does follow, the data moves into contractual and accounting records and is kept for the period required by tax and accounting law.
Hosting operational records are kept for the period set by the platform, a matter of weeks.
Traffic measurement records are kept for 2 years and then deleted automatically.

5. Who the data is shared with

I never sell data or pass it to anyone for marketing purposes. Only I have access to it. The following processors take part in running the site and the communication:

Microsoft — website hosting (Azure Static Web Apps), processing of the submitted form, traffic measurement (Azure Application Insights), the mailbox (Microsoft 365) and the Bookings scheduling system. Data is stored in the European Union.
Cloudflare — authoritative DNS for the matejhrabalek.cz domain.

In justified cases, for example during support, both processors may process data outside the European Union. Such a transfer is covered by the standard contractual clauses approved by the European Commission.

6. Cookies and third-party content

This site uses no cookies at all — not analytical, not marketing, not technical. That is why there is no consent banner: there would be nothing to ask about.

The site also loads nothing from other servers. The Inter typeface and all styles and scripts are stored here, so your browser does not connect to any other server while you browse. The only exception is booking a consultation, which takes you to Microsoft Bookings on your own click; Microsoft's terms apply from there on. The traffic measurement described in section 2 uses no cookies and stores nothing on your device, so it does not require consent.

7. Security

The site runs over HTTPS only, with an enforced redirect and a content security policy. Form data travels over a secure channel straight to my mailbox, is not stored in any database and produces no records containing personal data. The contact for reporting security vulnerabilities is in the security.txt file.

8. Your rights

the right of access to the data and to information on how it is processed,
the right to rectification of inaccurate data,
the right to erasure,
the right to restriction of processing,
the right to data portability,
the right to object to processing based on legitimate interest,
the right to withdraw consent at any time,
the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

It is enough to send the request to info@matejhrabalek.cz. I will handle it within one month at the latest.