Privacy & cookies
Last updated: 10 November 2026
Who is responsible
The controller of personal data processed through hlousek.me, and in my work with clients, is:
Michal Hloušek, a natural person doing business under the Czech Trade Licensing Act (sole trader).
- Business ID (IČO): 30158109
- Registered office: Mezi vodami 2390/41, Modřany, 143 00 Prague 4, Czech Republic
- Registered in the Czech Trade Licensing Register (živnostenský rejstřík)
- Email: cz.michalhlousek@gmail.com
Write to the email above with any privacy question or request.
What is processed, why, and on what legal basis
| What | Why | Legal basis (GDPR) | Kept |
|---|---|---|---|
| Visit statistics via Vercel Web Analytics: page address, referring site, country, browser, operating system and device type | To see which pages are read and how people find the site | Legitimate interest, Art. 6(1)(f) | Aggregated statistics only |
| Server logs kept by the host: IP address, browser, time and page requested | To run the site securely and stop abuse | Legitimate interest, Art. 6(1)(f) | Short-term, per the host's log retention |
| Private case studies: access cookies and, when a share link is created or opened, a log entry with the link's ID, the page and the browser type | To give access only to invited people and to know which shared links are used | Legitimate interest, Art. 6(1)(f); the cookies are strictly necessary | Cookies 30 days; log entries short-term, per the host's log retention |
| Enquiries: your name, email address, organisation and whatever you write to me | To reply, discuss possible work and prepare a proposal | Steps before a contract at your request, Art. 6(1)(b); otherwise legitimate interest in answering business messages, Art. 6(1)(f) | As long as the conversation is relevant; then deleted unless a contract follows |
| Client work: contact and identification details, the contract, correspondence and invoicing details | To deliver the agreed work and get paid | Performance of a contract, Art. 6(1)(b) | For the contract and the limitation period for claims arising from it |
| Invoices and tax records | To meet accounting and tax duties | Legal obligation, Art. 6(1)(c) | For the periods required by Czech tax and accounting law |
According to Vercel's documentation, the visit statistics use no cookies: visitors are counted with a hash derived from the incoming request that is discarded after a day, and the analytics do not store IP addresses or follow you across sites. The host's server logs are separate and do contain IP addresses, as listed above.
No advertising, profiling, newsletter or cross-site tracking is used, nothing is sold or shared for marketing, and no decisions are made about you by automated means. Nothing here relies on your consent, so there is no consent to withdraw. You are not obliged to give me any data; without contact details I simply cannot reply.
Getting in touch
This site has no form that sends data to it. The contact panel only opens a draft in your own email (Gmail, Outlook or your mail app), with anything you typed carried over. The message travels through your email provider and reaches me by email; what you typed is not stored or logged by this site.
Cookies and local storage
hlousek.me stores only what a page needs to do what you asked of it. Such storage is exempt from consent under the ePrivacy rules, so there is no cookie banner. Public pages set no cookies at all.
| Name | Purpose | Duration |
|---|---|---|
Cookies cs_unlock, cs_unlock_* | Remember that you entered the passcode, or opened a valid share link, for a private case study, a single shared page or a shared deck. Signed, HttpOnly, Secure, SameSite=Lax | 30 days |
Cookies cs_deep_*, cs_team_* | Remember a second key for a case study's deep dives or team pages; same protection | 30 days |
Cookie cs_deep_*_ui | A flag readable by the page that only hides lock icons; it grants no access | 30 days |
Local storage: theme and its equivalents on private pages | Remembers light or dark mode | Until you clear it |
| Local and session storage on private pages | Remembers your own choices in a case study: ticked checklist items, language or platform toggles, dismissed notices | Until you clear it |
You can delete cookies and site data in your browser at any time; private pages will then ask for the passcode again.
Who else receives data
- Vercel Inc. (USA) hosts the site, keeps the server logs and provides the visit statistics, as my processor.
- Google LLC provides my email (Gmail). Web fonts are served from this site itself, so loading a page does not contact Google.
- A few private or archived pages load open-source code libraries from cdnjs (Cloudflare) and jsDelivr, and one private page loads map tiles from Mapy.com; your browser connects to those servers when you open such a page.
- Public authorities, or an accountant or legal adviser, where the law requires it or a claim has to be handled.
Vercel and Google may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework, under which both companies are certified, and on Standard Contractual Clauses in their data processing terms.
Your rights
You can ask for access to your personal data, for its correction or deletion, for restriction of processing and for data portability, and you can object to processing based on legitimate interest. Write to the email above; I reply within one month. You can also complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, or to the authority in your EU country.
Changes
If this policy changes, the date at the top changes with it.