Privacy and cookie notice

Who is responsible

Cortey Agency runs the website cortey.agency from Ostrava in the Czech Republic and decides why and how the personal data described here gets processed. That makes Cortey Agency the controller under the General Data Protection Regulation.

Reach the controller by email at corteyict@gmail.com or by phone at +420 773 511 576. No data protection officer has been appointed, because the scale and nature of the processing described below does not require one.

What this notice covers

This notice describes every piece of personal data the website itself collects. It covers the contact form, the booking calendar, analytics, cookies and server logs. Work carried out for clients under a signed agreement runs on separate terms agreed in that contract.

Messages sent through the contact form

The form on the homepage asks for a name, an email address, an optional phone number and a message. Those fields travel to Cortey Agency so the enquiry can be answered.

An external form delivery service receives the submission and forwards it by email. That service acts as a processor and handles the data only to deliver the message. Its name is available on request at the email address above.

The legal basis is Article 6(1)(b) of the GDPR, since answering an enquiry about a possible project counts as a step taken at the request of the person before entering a contract. Where the message concerns something other than a future contract, the basis is the legitimate interest in Article 6(1)(f), namely replying to people who write in.

Enquiries that lead nowhere are deleted 24 months after the last message in the thread. Enquiries that turn into a project follow the retention rule for client records described further down.

Booking an intro call

The contact section offers an appointment calendar hosted by Google Calendar. The calendar loads only after explicit permission through the cookie bar, so nothing reaches Google until that click happens.

Booking a slot sends a name, an email address and the chosen time to Google, which delivers the appointment into the Cortey Agency calendar. Google acts as a processor for the appointment itself and as an independent controller for the technical data its own systems record.

The legal basis for loading the embed is consent under Article 6(1)(a). The legal basis for the booking is Article 6(1)(b), because the call is arranged at the request of the person booking it.

Analytics

Google Analytics 4 measures which pages get read and where visitors arrive from. The tag stays completely unloaded until analytics is switched on in the cookie bar, so a visit without consent sends nothing to Google at all.

Once allowed, Analytics records the pages viewed, the approximate location derived from a truncated IP address, the device and browser type, and the referring source. Google Ireland Limited provides the service inside the European Union and Google LLC may access the data from the United States.

The legal basis is consent under Article 6(1)(a). Withdrawing it takes one click on Cookie settings in the footer, after which the analytics cookies get deleted and the tag stops loading on the next page view.

Cookies and local storage

Nothing beyond the record of your own cookie choice is stored before you allow it. The table lists everything the site can place on a device.

The consent record is necessary storage. It carries no identifier, it holds only the categories you picked and the date you picked them, and it exists so the bar stops asking. After 6 months the record expires and the choice gets requested again.

Fonts load from Fontshare and set no cookies. The site uses no advertising, no remarketing and no social media tracking pixels.

Server logs

The web server that delivers this site keeps standard access logs. Each entry holds an IP address, the page requested, a timestamp and the browser identification. Logs exist to keep the site available and to investigate errors and attacks, which is a legitimate interest under Article 6(1)(f). They rotate on the hosting provider schedule and are never used to build profiles.

Transfers outside the European Union

Google is the only recipient that can process data outside the European Economic Area. Google LLC is certified under the EU and United States Data Privacy Framework, and Google Ireland Limited relies on the standard contractual clauses approved by the European Commission for anything the framework does not cover. Both mechanisms are recognised safeguards under Chapter V of the GDPR.

How long data is kept

• Contact form enquiries that do not become projects go 24 months after the last message.
• Client records, contracts and invoices stay for the period Czech accounting and tax law requires, which runs to 10 years for tax documents.
• Analytics data expires on the retention window configured in Google Analytics, which is 14 months.
• The cookie consent record expires after 6 months.

Your rights

The GDPR gives every person the following rights over their own data.

• Access. Ask what is held and receive a copy of it.
• Rectification. Have anything inaccurate corrected.
• Erasure. Have data deleted where no legal duty requires keeping it.
• Restriction. Have processing paused while a dispute about accuracy or legal basis is resolved.
• Portability. Receive data given under consent or contract in a machine readable format.
• Objection. Object to processing that rests on legitimate interest.
• Withdrawal of consent. Take back consent at any time, which leaves everything done before the withdrawal lawful.

Send any of these requests to corteyict@gmail.com. A reply arrives within one month. Cookie choices need no email, because the Cookie settings link in the footer changes them instantly.

Complaints

Anyone who believes their data is handled unlawfully can complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, at uoou.gov.cz. A complaint can also go to the authority in the country where the person lives.

Changes to this notice

Services change and this notice changes with them. The date at the top always shows the current version. Material changes to the purposes or the recipients trigger a fresh consent request through the cookie bar.

Open cookie settings