Your data. Plainly Explained.

Who is responsible

The controller of personal data on this website is the operator of DECO CODE:

Operator

Martin Hyršal

Company ID (IČO)

06633200

Registered address

Pospíšilova 698/17, 500 03 Hradec Králové

What we collect and why

We collect only what you send us and what the site needs to work safely.

Contact enquiry

Your name, e-mail, company or brand, the type of project, your message and when you would like to begin.

Discovery brief

Your name, e-mail, company, existing website, what you need help with, the problem you are solving, the timeline and your agreement to be contacted.

Scope builder

The choices you make in the planner, your name, e-mail and your note.

Protecting the forms

Your IP address and browser signals, used to tell a person from an automated sender and to limit repeated attempts.

Improving the site

How the pages are used, recorded by Microsoft Clarity, only if you allow it in the cookie bar.

On what legal basis

Each purpose has its own legal basis under the GDPR:

Enquiry, brief and scope

Steps taken at your request before a contract (Art. 6(1)(b) GDPR); where you write on behalf of a company, our legitimate interest in answering a business enquiry (Art. 6(1)(f)).

A project that follows

Performance of the contract (Art. 6(1)(b)); accounting and tax records are kept under a legal obligation (Art. 6(1)(c)).

Protecting the forms

Our legitimate interest in the security of the site (Art. 6(1)(f)).

Microsoft Clarity

Your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR; Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications).

Enquiries are not marketing

Sending an enquiry, a brief or a scope never subscribes you to anything.

We use your details to answer you and, if we work together, to run the project. We do not sell personal data, pass it on for advertising or use it for automated decisions.

Analytics only with consent

Microsoft Clarity starts only if you allow it in the cookie bar or in the cookie settings.

Clarity records which pages you view and where you came from, where you click, how you scroll and move the pointer, your device, browser and screen size, your IP address and the approximate location derived from it. What you type into a form is masked. Clarity never runs on the page that confirms a form you have sent.

Clarity is operated by Microsoft Ireland Operations Limited. Microsoft is not our processor but an independent controller: it may use the data for its own purposes, such as improving its services and advertising, and may transfer it to Microsoft Corporation in the USA. We send Microsoft a consent signal for analytics only, never for advertising storage.

Cookie policy and settings

Where data is stored and who receives it

A copy of every accepted form is stored so that we can follow it up, and a notification is sent to the studio by e-mail.

These suppliers process data for us, each only as far as its service needs:

Cloudflare, Inc.

Hosting of the website and its form handlers, the database that holds the form records, and the check that a form is sent by a person (Turnstile).

Resend, Inc.

Sending the e-mails the site produces (the confirmation to you and the notification to the studio) from its EU region in Ireland.

Microsoft Ireland Operations Limited

Microsoft Clarity, only after your consent, as an independent controller and not as our processor.

How long we keep it

Each kind of record has its own period:

Enquiry, brief and scope

One year from the last message. If a project follows: for the project, and then for as long as accounting and tax rules require.

Records that protect the forms

Kept only as long as needed to limit repeated attempts, and at most 30 days.

Your cookie choice

12 months in your browser; then you are asked again.

Microsoft Clarity

As the cookie policy states.

Transfers outside the EU

Some suppliers may process data in the USA, and only with the safeguards the GDPR requires.

Cloudflare, Resend and Microsoft may process data in the USA, under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Your rights

Under the GDPR you may ask for access to your data, its correction or erasure, the restriction of processing and data portability. You may object to processing based on legitimate interest, and withdraw a consent you have given.

If you believe the processing breaks the rules, you may lodge a complaint with the supervisory authority. In Czechia, that is the Office for Personal Data Protection.

Office for Personal Data Protection (opens in a new tab)

Changes to this notice

When the site or the way it handles data changes, this notice changes with it. The new version is published here with the date from which it applies.

Questions

For anything about your personal data, write to the address in “Who is responsible”, or use the contact form.

Contact the studio