Privacy
Privacy information
This page describes which personal data the robinhrdlicka.cz website processes, why and for how long. It reflects how the website technically works.
This text has not been legally reviewed yet. Details marked “To be completed by the operator” have not been confirmed.
Data controller
- Controller
- [To be completed by the operator – requires confirmation]
- Address
- [To be completed by the operator – requires confirmation]
- Company ID (IČO)
- [To be completed by the operator – requires confirmation]
- Privacy contact
- [To be completed by the operator – requires confirmation]
Contact form
When you send the contact form, the following data is processed:
- name (required),
- e-mail address (required),
- subject (optional),
- message text (required).
- Purpose
- handling and answering your enquiry.
- Legal basis
- [To be completed by the operator – requires confirmation]
The message is stored in the website database (name, e-mail, subject, message text, a “read” flag and the time it was received and last changed).
Only signed-in website administrators can access the messages in the administration. They can read them, mark them as read and delete them.
At the same time a notification containing all form data is sent to the operator’s mailbox; its reply-to address is your e-mail address.
- E-mail delivery service
- [To be completed by the operator – requires confirmation]
Until it is sent, the notification waits in a job queue in the database. The job only contains the internal message number and the notification recipient’s address, not the message text. If sending still fails after repeated attempts, an error record is stored in the database of failed jobs.
To avoid storing the same message twice by accident, a fingerprint (keyed hash) of your e-mail address and message text is kept in the server cache for 10 minutes. The data itself cannot be read from the fingerprint.
If you send the form without JavaScript and it contains an error, the values you entered are kept in your session only until the next page load so the form can be filled in again.
Spam protection
The form contains a hidden field that people neither see nor fill in. If it is filled in (typically by a bot), the message is neither stored nor sent.
At most 5 messages per minute can be sent from one IP address. For this, the server keeps a counter in its cache for 1 minute under a key derived from your IP address.
The website uses no CAPTCHA and no third-party anti-spam service.
Cookies and session
The website only uses strictly necessary cookies. It uses no analytics, advertising or tracking cookies and therefore does not ask for cookie consent.
| Name | Purpose | Lifetime |
|---|---|---|
laravel-session |
Session – technical state of the visit, form protection and the selected language. | 120 minutes after the last activity |
XSRF-TOKEN |
Protection of forms against forged requests (CSRF). | 120 minutes after the last activity |
remember_web_… |
Persistent sign-in. Only set for administrators who choose “Remember me” when signing in to the administration. | up to 30 days or until sign-out |
Session data is stored in the database on the server together with your IP address, browser identification (user agent) and the time of your last activity. Records of expired sessions are deleted periodically.
The selected language is only stored in the session; the website uses no separate language cookie.
Cookie contents are encrypted. The website stores nothing in browser storage (localStorage, sessionStorage).
Server and application logs
The hosting provider may record technical data for every request (IP address, time, page address and browser identification) in access logs.
The application writes errors and operational events to a log on the server. Contact form events are logged without the message content, at most with the internal message number.
- Log retention
- [To be completed by the operator – requires confirmation]
Analytics, fonts and external links
The website uses no analytics tools, tracking pixels or advertising.
Fonts and scripts are loaded directly from this website, not from third-party services.
The GitHub and LinkedIn links are plain links. Nothing is shared with these services until you click a link; from then on their own policies apply.
Processors and transfers outside the EU
- Website and database hosting
- [To be completed by the operator – requires confirmation]
- Delivery of e-mail notifications
- [To be completed by the operator – requires confirmation]
- Transfers outside the EU/EEA
- [To be completed by the operator – requires confirmation]
How long data is kept
- Contact form messages
- [To be completed by the operator – requires confirmation]
- Backups containing messages
- [To be completed by the operator – requires confirmation]
- Notification copies in the operator’s mailbox are not deleted automatically by the website.
- Records of failed notification deliveries are not deleted automatically; an administrator removes them.
- Session and cookies: see the lifetimes in the table above.
- Anti-spam data in the cache: 1 minute (per-IP counter) and 10 minutes (message fingerprint).
Your rights
Under the General Data Protection Regulation (GDPR) you have the right:
- to access your personal data (Art. 15),
- to rectification (Art. 16),
- to erasure (Art. 17),
- to restriction of processing (Art. 18),
- to data portability (Art. 20),
- to object to processing (Art. 21),
- not to be subject to automated decision-making (Art. 22) – the website performs no automated decision-making or profiling.
You can exercise your rights via [To be completed by the operator – requires confirmation].
You also have the right to lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.