Privacy information
This page describes which personal data the robinhrdlicka.cz website processes, why and for how long. It reflects how the website technically works.
Data controller
- Controller
- Robin Hrdlička
- Address
- Čs. armády 2188, 440 01 Louny
- Company ID (IČO)
- 23817313
- Privacy contact
- robinhrdlickadeveloper@gmail.com
Contact form
When you send the contact form, the following data is processed:
- name (required),
- e-mail address (required),
- subject (optional),
- message text (required).
- Purpose
- handling and answering your enquiry.
- Legal basis
- Art. 6(1)(f) GDPR – legitimate interest in handling your enquiry
The message is stored in the website database (name, e-mail, subject, message text, a “read” flag and the time it was received and last changed).
Only signed-in website administrators can access the messages in the administration. They can read them, mark them as read and delete them.
At the same time a notification containing all form data is sent to the operator’s mailbox; its reply-to address is your e-mail address.
- E-mail delivery service
- WEBGLOBE, a.s. (CZ)
Until it is sent, the notification waits in a job queue in the database. The job only contains the internal message number and the notification recipient’s address, not the message text. If sending still fails after repeated attempts, an error record is stored in the database of failed jobs.
To avoid storing the same message twice by accident, a fingerprint (keyed hash) of your e-mail address and message text is kept in the server cache for 10 minutes. The data itself cannot be read from the fingerprint.
If you send the form without JavaScript and it contains an error, the values you entered are kept in your session only until the next page load so the form can be filled in again.
Spam protection
The form contains a hidden field that people neither see nor fill in. If it is filled in (typically by a bot), the message is neither stored nor sent.
At most 5 messages per minute can be sent from one IP address. For this, the server keeps a counter in its cache for 1 minute under a key derived from your IP address.
The website uses no CAPTCHA and no third-party anti-spam service.
Cookies and session
Besides strictly necessary cookies, the website uses Google Analytics cookies, but only after you allow them in the cookie banner. Until then the Google Analytics script is not loaded at all. You can change your choice at any time via “Cookie settings” at the bottom of every page.
| Name | Purpose | Lifetime |
|---|---|---|
laravel-session |
Session – technical state of the visit, form protection and the selected language. | 120 minutes after the last activity |
XSRF-TOKEN |
Protection of forms against forged requests (CSRF). | 120 minutes after the last activity |
remember_web_… |
Persistent sign-in. Only set for administrators who choose “Remember me” when signing in to the administration. | up to 30 days or until sign-out |
cookie_consent |
Remembers whether you allowed or declined analytics cookies, so the banner is not shown again. | 180 days |
_ga |
Google Analytics – tells visitors apart with a random identifier. Only with your consent. | 2 years, renewed on every visit |
_ga_CETLLRW2SL |
Google Analytics – keeps the state of the current visit. Only with your consent. | 2 years, renewed on every visit |
Session data is stored in the database on the server together with your IP address, browser identification (user agent) and the time of your last activity. Records of expired sessions are deleted periodically.
The selected language is only stored in the session; the website uses no separate language cookie.
The contents of the session and CSRF cookies are encrypted; the consent cookie only holds “granted” or “denied”. The website stores nothing in browser storage (localStorage, sessionStorage).
Server and application logs
The hosting provider may record technical data for every request (IP address, time, page address and browser identification) in access logs.
The application writes errors and operational events to a log on the server. Contact form events are logged without the message content, at most with the internal message number.
- Log retention
- 14 days
Analytics, fonts and external links
With your consent the website uses Google Analytics 4 to measure visits: which pages are viewed and for how long, where visitors come from, the type of device and browser and the approximate location (country, city). Google Analytics 4 uses the IP address only to determine that location and does not store it. Advertising features are off: the website does not allow Google to use the data for ads or ad personalisation. The website uses no tracking pixels or advertising.
Legal basis: your consent (Art. 6(1)(a) GDPR). Without it nothing is measured.
Fonts and scripts are loaded directly from this website. The only exception is the Google Analytics script, which is loaded from Google (googletagmanager.com) once you allow it.
The GitHub and LinkedIn links are plain links. Nothing is shared with these services until you click a link; from then on their own policies apply.
Processors and transfers outside the EU
- Website and database hosting
- Contabo GmbH (DE)
- Delivery of e-mail notifications
- WEBGLOBE, a.s. (CZ)
- Website analytics (only with your consent)
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics)
- Transfers outside the EU/EEA
- Data is not transferred outside the EU/EEA.
Google may also process Google Analytics data in the USA. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognised as providing adequate protection on 10 July 2023.
How long data is kept
- Contact form messages
- deleted automatically 365 days after they are received
- Data in Google Analytics
- up to 14 months
- Notification copies in the operator’s mailbox are not deleted automatically by the website.
- Records of failed notification deliveries are not deleted automatically; an administrator removes them.
- Session and cookies: see the lifetimes in the table above.
- Anti-spam data in the cache: 1 minute (per-IP counter) and 10 minutes (message fingerprint).
Your rights
Under the General Data Protection Regulation (GDPR) you have the right:
- to access your personal data (Art. 15),
- to rectification (Art. 16),
- to erasure (Art. 17),
- to restriction of processing (Art. 18),
- to data portability (Art. 20),
- to object to processing (Art. 21),
- not to be subject to automated decision-making (Art. 22) – the website performs no automated decision-making or profiling.
You may withdraw your consent at any time; this does not affect processing carried out before the withdrawal.
You can withdraw your consent to analytics cookies at any time via “Cookie settings” at the bottom of the page.
You can exercise your rights via robinhrdlickadeveloper@gmail.com.
You also have the right to lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.