Effective from: [website launch date] · Last updated: [date]
1. Who processes your data (controller)
Yevgeny Karas
Company ID (IČO): 88596834
Address: Pernerova 293/11, Prague 8 — Karlín, office 501
E-mail: info@design-online.cz
Phone: +420 776 207 152
Not a VAT payer
Operates the web studio Design Online Studio (hereinafter “we”). We process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
We have not appointed a Data Protection Officer (DPO) — the law does not require us to. For all data protection matters, please use the contacts above.
2. What data we process and why
2.1. Enquiry form and contact
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name | Addressing you and communication | Legitimate interest / contract performance | 3 years from last contact |
| Sending a reply and quote | Legitimate interest / contract performance | 3 years from last contact | |
| Phone (optional) | Faster contact | Consent | 3 years from last contact |
| Message content | Preparing a quote | Legitimate interest | 3 years from last contact |
2.2. Client data (established cooperation)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Billing details (name/company, ID, address) | Invoicing, accounting | Legal obligation | 10 years (Accounting Act) |
| Contact details | Project delivery, communication | Contract performance | Duration of cooperation + 3 years |
| Access credentials to client systems | Project delivery (development, maintenance) | Contract performance | Duration of cooperation, then deleted |
2.3. Website visits (cookies and analytics)
Visit data (IP address, browser type, pages visited) is processed only with your consent given in the cookie banner. Details are in our [Cookie Policy](/en/cookies/).
3. Who we share data with (recipients)
We do not pass your data to third parties for their own purposes. However, we use the following processors:
- Hosting and e-mail provider — technical data storage
- Google Ireland Ltd. — Google Analytics, Google Ads, Google Maps (with consent only)
- Meta Platforms Ireland Ltd. — Meta Pixel (with consent only)
- Microsoft Corp. — Clarity (planned, with consent only)
- Seznam.cz, a.s. — Sklik (with consent only)
- Accountant — processing tax documents
- CRM provider (if implemented) — enquiry records
Some providers may process data outside the EU (typically the USA). Transfers are covered by the EU–U.S. Data Privacy Framework and standard contractual clauses.
4. How long we keep data
We keep it only for as long as necessary for the purpose it was obtained — specific periods are in the tables above. After that we delete or anonymise the data. Data processed on the basis of consent is also deleted at any time after consent is withdrawn.
5. Your rights
In relation to the processing of your personal data you have the following rights:
- Right of access — to find out what data we hold about you and obtain a copy
- Right to rectification — to correct inaccurate or complete incomplete data
- Right to erasure (“right to be forgotten”) — to have data deleted when the reason for processing no longer applies
- Right to restriction of processing — to temporarily restrict processing, e.g. in a dispute over accuracy
- Right to object — to processing based on legitimate interest
- Right to data portability — to receive data in a machine-readable format
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
- Right to lodge a complaint — with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz
How to exercise your rights: write to info@design-online.cz. We will respond within 30 days at the latest. We may request additional information to verify your identity.
6. Data security
We have adopted technical and organisational measures to protect your data: encrypted transmission (HTTPS/SSL), access limited to those who need it for their work, regular system updates and backups.
7. Automated decision-making
We do not carry out automated decision-making or profiling with legal effects concerning you.
8. Changes to this policy
We may update this policy, for example when introducing new tools or when legislation changes. The current version is always available on this page with the date of the last update.
9. Supervisory authority and consumer disputes
The supervisory authority for personal data protection is the Office for Personal Data Protection (www.uoou.cz).
For out-of-court resolution of consumer disputes, the competent body is the Czech Trade Inspection Authority (www.coi.cz), Štěpánská 796/44, 110 00 Prague 1.