Privacy policy.

Who the controller is

Kryštof Francl, Šumavská 794, 341 01 Horažďovice, Czech Republic. Business ID (IČO) 08946043, registered in the Czech Trade Licensing Register. Contact: krystof@francl.digital.

There is no data protection officer — the scale of processing here does not require one.

When you write through the form

The form on the Contact page sends your message to my server, which forwards it straight into my working channel on Discord so that I see the enquiry immediately. The preview above the button is exactly what gets sent, and nothing is sent until you click. I keep no database of enquiries — the message lives in that channel, and in my e-mail correspondence if we carry on from there.

If you would rather not use that route, there is a plain e-mail link under the form. It opens your own mail client and goes directly to me, with neither my server nor Discord involved.

I process what you put in the form — typically a name or company, a contact and a description of the project:

• Purpose: replying to you and discussing the work.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); performance of the contract once there is one.
• Recipient: Discord Netherlands B.V. / Discord Inc. as a processor, on whose service the message remains stored in the channel. This involves a transfer to the USA, covered by standard contractual clauses.
• Retention: correspondence about enquiries that led nowhere is deleted within three years at the latest. Data on accounting documents is kept for the period required by Czech Act No. 563/1991 Coll. on accounting.

Spam protection on the form

The form is protected by Cloudflare Turnstile, which checks that there is a person on the other end rather than a script, and evaluates the IP address and technical browser signals to do it. The check itself runs on Cloudflare’s infrastructure — a processor that already handles the running of this site.

• Purpose: stopping the form being used to send spam.
• Legal basis: legitimate interest in securing the service (Art. 6(1)(f) GDPR).
• Retention: the check is one-off and I do not store its result.

Traffic measurement

I measure traffic with PostHog, in cookieless mode:

• Nothing is written to your device — no cookies, no localStorage, no sessionStorage.
• No identifier is created that could recognise you on a return visit or on another site. Visitor numbers are estimated from a hash computed on the provider’s servers.
• Data stays in the EU (PostHog Cloud EU).
• Legal basis: legitimate interest in knowing which pages are useful to people (Art. 6(1)(f) GDPR).

Because the measurement stores nothing on your device and reads nothing from it, the consent duty under Section 89(3) of Czech Act No. 127/2005 Coll. does not arise for it. That is why there is no cookie banner here — not because I forgot one.

Session replay and site-wide click autocapture are both switched off.

What the site stores on your device

Three things. All are required for a function you asked for yourself, none is sent anywhere, and none of them needs consent:

What	Where	Why
light or dark theme choice	localStorage	so the site stays in the theme you picked
dismissal of the bottom enquiry bar	sessionStorage	so it does not come back for the rest of your visit
your position on the page when switching language	sessionStorage	so you stay at the same point of the page after switching to the other language

Running the site

The site runs on Cloudflare, which provides hosting and content delivery as my processor. Every request leaves an IP address and technical browser details in their operational logs. That is necessary to deliver the page and protect it from attacks — legitimate interest under Art. 6(1)(f) GDPR.

Who the data goes to

I do not sell it and I do not pass it on for anyone else’s marketing. The only processors involved are:

• Cloudflare, Inc. — hosting, content delivery and spam protection on the form.
• Discord Netherlands B.V. / Discord Inc. — the channel enquiries from the form arrive in.
• PostHog — traffic measurement, European instance.
• My e-mail provider — for messages you send me by e-mail.

Your rights

You have the right of access to your data, to have it corrected or erased, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Write to krystof@francl.digital and you will hear back as fast as on an enquiry.

If you believe I am handling your data badly, you can complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

Automated decision-making

There is none. No machine evaluates you and no profiling takes place.