Who the controller is
I, Eric Barkai, am the controller of your personal data (contact details are in the box above). Processing is governed by Regulation (EU) 2016/679 (the GDPR) and the Czech Act No. 110/2019 Coll. on the Processing of Personal Data. I have not appointed a data protection officer, as I am not required to. You can contact me directly about anything.
What I process and why
When you write to me
When you send me a message through the contact form, by email, by phone or on WhatsApp, I process your name, your email address or phone number, the content of your message and, for the form, the language of the page you wrote from.
- Purpose: to reply to you and, where relevant, prepare a quote.
- Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for general questions, my legitimate interest in answering a message you sent me (Art. 6(1)(f) GDPR).
- Retention: while your enquiry is being handled and for no longer than 12 months after our last exchange, unless it leads to a project.
The form contains a hidden anti-spam field. Please do not include sensitive data (for example about health) in your message; it is not needed to handle an enquiry.
When we work together
For clients, I process identification and contact details, billing details, project correspondence and the materials you give me for building the website.
- Purpose: entering into and performing the contract, invoicing and meeting legal obligations.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations, in particular tax and accounting (Art. 6(1)(c) GDPR), and my legitimate interest in defending legal claims (Art. 6(1)(f) GDPR).
- Retention: for the duration of the contract; afterwards, accounting and tax records for the period required by law (usually 5 to 10 years) and project correspondence for the limitation period, generally 3 years after our work ends.
Testimonials and case studies
If you agree to publishing a testimonial, your logo or a case study (for example as part of the first-clients programme), I only publish what we have agreed on together.
- Legal basis: your consent (Art. 6(1)(a) GDPR).
- Retention: until you withdraw your consent. You can withdraw it by email at any time and I will take the testimonial down without undue delay. Withdrawal does not affect the lawfulness of processing before it.
Server logs
On every visit, the hosting provider processes technical data your browser sends automatically: IP address, date and time of the request, the requested address and the browser type.
- Purpose: keeping the website running, secure and protected against abuse.
- Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
- Retention: only as long as needed for operation and security, under the hosting provider’s rules. I do not analyse these logs or use them to identify visitors.
Cookies and browser storage
This website does not use analytics, marketing or tracking cookies, which is why it does not ask for cookie consent. It stores only two technical values in your browser, and never sends them anywhere:
| Name | Storage | Purpose | Duration |
|---|---|---|---|
eric-theme |
localStorage | remembers whether you chose light or dark mode | until you delete it |
eric-entrance-seen |
sessionStorage | stops the intro animation from replaying during one visit | until you close the tab |
Both are necessary for features you use yourself, and you can delete them at any time in your browser settings.
Who receives your data
I do not sell your data or share it with anyone for marketing. Only these processors and recipients work with it:
- Netlify, Inc. (USA): website hosting and receiving contact form messages.
- Google Ireland Limited / Google LLC: the Gmail inbox that receives messages and form notifications.
- WhatsApp Ireland Limited: only if you contact me on WhatsApp. WhatsApp processes data as an independent controller under its own terms.
- Accountants and authorities: only clients’ billing details, where the law requires it.
The live preview of the Webly demo on the Web design page loads directly from mojewebly.online, a website I also run. Loading it shares your IP address with that website’s hosting provider and the font providers it uses.
Transfers outside the EU
Some processors (Netlify, Google) may also process data in the United States. Such transfers rely on the European Commission’s adequacy decision (the EU-U.S. Data Privacy Framework) for certified companies, or on standard contractual clauses approved by the European Commission.
Your rights
You have the right to:
- access your personal data (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16 GDPR),
- have your data erased (Art. 17 GDPR) where I am not legally required to keep it,
- restrict processing (Art. 18 GDPR),
- data portability for data you provided under a contract or consent (Art. 20 GDPR),
- object to processing based on legitimate interest (Art. 21 GDPR),
- withdraw your consent at any time (Art. 7(3) GDPR),
- lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority where you live.
I handle requests without undue delay and within one month at the latest. An email is enough. If it is unclear that the request comes from you, I may ask you to verify your identity.
Automated decision-making
I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Security
The website is served exclusively over encrypted HTTPS with security headers. Only I have access to your data, and I protect it with appropriate technical and organisational measures.
Changes to this policy
I may update this policy, for example when I add a new service. The current version is always on this page, with its effective date shown at the top.