Privacy policy
Privacy Notice
Here you can find what data I process about you, why, for how long, and what rights you have. I only process what I actually need.
Effective from: 2 October 2026
1. Who processes your data
Controller:
- Adam Bruno Rafaj, sole trader operating under the brand Bruno Rafaj,
- place of business: Na Honech III 4924, 760 05 Zlín, Czech Republic,
- not VAT-registered,
- e-mail: hello@brunorafaj.com,
- phone: +420 735 124 545.
I have not appointed a Data Protection Officer, as the law does not require it. For any question about your data, write to the e-mail above.
2. Why and on what legal basis I process your data
| Situation | What data | Why | Legal basis (GDPR) | For how long |
|---|---|---|---|---|
| You contact me via the form, e-mail or LinkedIn | name, e-mail, message text, optionally company, phone, and anything else you provide | to reply and prepare a proposal | Art. 6(1)(b) – steps prior to entering into a contract at your request; for general inquiries Art. 6(1)(f) – legitimate interest in responding | 12 months from the last contact, unless cooperation follows |
| We work together (you are a client or a client's contact person) | name, work e-mail and phone, billing details, project communication | contract performance, invoicing | Art. 6(1)(b) – contract; for company contact persons Art. 6(1)(f); for accounting Art. 6(1)(c) – legal obligation | for the duration of the cooperation; accounting records typically 5–10 years under accounting and tax law |
| Website operation and security | IP address, browser type, access time, technical logs | to keep the site running, fast and protected against attacks and spam | Art. 6(1)(f) – legitimate interest in a secure website | per Cloudflare's standard settings for my plan (typically a matter of days to weeks, not retained permanently) |
| Analytics – only with your consent | pseudonymous identifiers (cookies), pages visited, referral source, device, approximate location | to see which pages help visitors and which don't (Google Analytics 4) | Art. 6(1)(a) – consent via the cookie banner | data in GA4 14 months; cookies per the cookie-consent settings (see section 6) |
| Cookie-free traffic measurement and site version test | when a page loads, your IP address and User-Agent are processed only momentarily and are not stored; only an aggregate count of page views is stored, by day, page, language, page version, source (referring site's domain or utm_source) and device type (mobile/desktop); when you click an e-mail, phone or button link, open a project, switch language or use the form, only a count of that action is stored (by day, place on the page, version, language and device type) | to see which pages, versions and buttons help, so I can improve the site | Art. 6(1)(f) – legitimate interest in improving my own website | IP address and User-Agent are not stored; aggregate counts for 25 months at most |
| Advertising and ad measurement – only with your consent and only once a campaign is live | pseudonymous identifiers (cookies _fbp/_fbc, _gcl_*), IP address, browser type (user agent), information that you visited the site, submitted the form, or clicked to call/e-mail | measuring ad performance, showing ads to relevant people, and matching the browser-side event with its server-side copy (Google Ads, Meta Pixel + Meta Conversions API via Cloudflare Zaraz, possibly Sklik) | Art. 6(1)(a) – consent (marketing) via the cookie banner | cookies per the cookie-consent settings (see section 6); on the platforms per their own rules |
| Protecting my legal rights | data needed to establish a claim | in case of a dispute | Art. 6(1)(f) | for the statute-of-limitations period |
Meta Conversions API (CAPI). Alongside the Meta Pixel (browser code), I send the same events – Lead (form submitted) and Contact (click to call or e-mail) – server-side as well, via Cloudflare Zaraz, and only if you consented to marketing cookies. Both events share the same event_id so Meta counts them once (deduplication). CAPI is not just an "empty" event without personal data – with the standard setup I use, it also includes your IP address, browser type (user agent), and the _fbp/_fbc identifiers. Your name, e-mail and phone number are not sent via CAPI (if I later enable sending a hashed e-mail/phone for better matching, I will update this sentence). Source on CAPI content: Meta for Developers, Conversions API – Parameters, https://developers.facebook.com/docs/marketing-api/conversions-api/parameters (verified 26 Sep 2026).
Cookie-free measurement. I count basic figures (page views, clicks on e-mail, phone and buttons, form submissions) and run a test of two homepage versions without cookies, without localStorage and without browser fingerprinting. I do not assign you any identifier; the counts cannot tell who you are or link your visits together. The page version is assigned at random each time a page loads. When you click an e-mail, phone or button link, your browser sends my server only the name of that action, the place on the page where it happened (e.g. which button), the page version and the language; from the request headers the server adds only whether the device is mobile or desktop. Cloudflare routinely processes your IP address to deliver the page and protect against attacks (see the "Website operation and security" row), but it does not enter my statistics. If you do not want to be counted, turn on the Global Privacy Control (or Do Not Track) signal in your browser – I will then not count your visit. Because the aggregate counts cannot show who you are, I cannot link them to you or erase them (Art. 11 GDPR); you can rely on this signal instead of an erasure request.
Protecting the form against bots. The contact form is protected by Cloudflare Turnstile. The legal basis is legitimate interest under Art. 6(1)(f) GDPR – website security and spam protection. When the form loads and when you submit it, Turnstile processes technical data about your browser and device (IP address, User-Agent header, TLS fingerprint, information about the browser environment and the result of a short computational test) to verify that a human is submitting it. For the check itself Cloudflare acts as my processor; it also uses this data to improve its bot detection, and for that purpose it is an independent controller (legitimate interest under its Turnstile addendum). Turnstile does not use cookies for tracking or advertising; it may store in your browser only a technical item needed to protect the form, so I do not ask for consent for it. Only the result of the check (a one-time code) is passed to my server, and I do not store it. You can object to this processing (section 4). I also check the time since the form loaded (a signed value, no cookies) and assess the message content with simple automatic rules for recognising spam (same legal basis). A suspicious message reaches me marked "possible spam" and I always decide on it personally; this is not a decision with legal or similarly significant effects (Art. 22 GDPR). A message that fails the Turnstile check or the timing check does not reach me; if you do not hear from me within a few working days, please write to me directly at hello@brunorafaj.com. Data-processing rules: Turnstile Privacy Addendum and Cloudflare Privacy Policy.
Providing your data is voluntary. Without an e-mail address, however, I cannot reply.
I do not carry out automated decision-making with legal effect. Analytics and marketing cookies do not load until you give consent.
3. Who I share your data with
I do not sell your data. I share it only with those who help me run the website and my business, and only to the extent necessary:
| Recipient | Role | Where |
|---|---|---|
| Cloudflare, Inc. | website hosting (Workers, KV, R2), storage of contact-form messages in Cloudflare KV (backup, 12 months), Cloudflare Email Routing (receiving and forwarding e-mail), processing of the aggregate counters for cookie-free measurement (Workers, D1 – storage of aggregate counts), bot protection and verification of the contact form (Cloudflare Turnstile; for Turnstile partly also an independent controller; __cf_bm, cf_clearance), technical relay of Meta Conversions API events via Cloudflare Zaraz (processor – Cloudflare only forwards the event to Meta, it does not use it itself) | EU and USA – EU-US Data Privacy Framework |
| Google Ireland Ltd. / Google LLC | mailbox and sending (Gmail, personal account – I do not use Google Workspace); Google Analytics 4, Google Tag Manager, Google Search Console, Google Business Profile, Looker Studio (admin use only) – analytics only with consent | EU and USA – EU-US Data Privacy Framework |
| Google Ireland Ltd. | Google Ads – ad conversion measurement, only with consent, once a campaign launches (no campaign is live yet; in preparation) | EU and USA |
| Meta Platforms Ireland Ltd. | Meta Pixel and Meta Conversions API (via Cloudflare Zaraz) – measuring and showing ads on Facebook and Instagram, only with consent, once Meta Ads is approved. For data collected and sent via the Pixel and CAPI, Meta and I are joint controllers (CJEU case C-40/17, Fashion ID) | EU and USA – EU-US Data Privacy Framework |
| Seznam.cz, a.s. | Sklik cookies – conversion measurement and retargeting, only with consent, only if Sklik is approved | Czech Republic |
| vetted specialists | if they collaborate on a project, only to the extent necessary and under confidentiality | per project |
| authorities and courts | only where required by law | – |
Transfers outside the EU. Some recipients are based in the USA. Transfer is possible under the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified companies, or otherwise under Standard Contractual Clauses.
4. Your rights
You have the right to:
- access the data I hold about you (Art. 15 GDPR),
- rectify inaccurate data (Art. 16),
- erasure (Art. 17),
- restrict processing (Art. 18),
- data portability for data you gave me under a contract or consent (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw consent at any time – for cookies via the "Cookie Settings" link in the site footer. Withdrawal does not affect processing carried out before it.
How: write to hello@brunorafaj.com or call +420 735 124 545. I will respond without undue delay, and no later than within 1 month.
5. Complaints
You can lodge a complaint with a supervisory authority:
- the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz,
- or the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, Slovakia, www.dataprotection.gov.sk, if you live or work in Slovakia,
- or the supervisory authority of your own EU member state (Art. 77 GDPR).
6. Cookies
This website uses cookies in three categories: necessary (site security and functioning, always active), analytics (Google Analytics 4), and marketing (Google Ads, Meta Pixel/CAPI, and possibly Sklik) – the latter two only with your consent. You give consent via the cookie banner on your first visit, and you can change it at any time via the "Cookie Settings" button in the site footer. The test of homepage versions and the basic traffic measurement run without cookies and without storing anything on your device (see section 2), so they are not tied to the cookie banner. I no longer use the br_ab cookie I used earlier; if you have it in your browser, you can delete it in your browser settings. The website itself sets only one further, necessary cookie, br_lang (value sk, cs or en): it is stored only when you click the language switcher, lasts 1 year, and serves solely to keep the language you chose on your next visit to the home page instead of redirecting by your device language. It is stored only to carry out your explicit choice, so it needs no consent; you can delete it in your browser settings. Without a click on the switcher it is not set. Bot protection (Cloudflare, including Turnstile) may store technical security data in your browser (e.g. __cf_bm); it serves only to secure the site and the form, not for tracking or advertising.
7. Changes
I update this notice whenever I change tools or the way I work. The current version is always available on this page.