Privacy Policy

Last updated: 20 August 2026

This Privacy Policy explains how personal data is collected and used when you visit www.cmindustry.co (the “Website”) or contact us through it. We keep it short and specific: this site is a design-studio portfolio. It has no online shop, no user accounts, and no advertising.

1. Who is responsible for your data

The data controller is Stanislav Tarasov, a self-employed entrepreneur (OSVČ) registered in the Czech Trade Register, trading under the brand CM Industry.

• Business ID (IČO): 23724391
• Registered address: náměstí Přátelství 1518/3, 102 00 Praha 10 – Hostivař, Czech Republic
• Trade licence authority: Úřad městské části Praha 15
• Email: info@cmindustry.co

CM Industry is a brand name, not a separate legal entity. We have not appointed a Data Protection Officer, and we are not legally required to have one, because we do not carry out large-scale or high-risk processing. For any privacy question, write to contact@cmindustry.co.

2. What we collect, why, and on what legal basis

2.1 When you use the contact form

The contact form collects your name, email address and your project brief, and optionally your budget, the services you are interested in, your intended start date, whether you have a deadline, and how you heard about the studio.

Purpose: to read your enquiry, reply to you, and prepare a possible quote or proposal.

Legal basis: Article 6(1)(b) GDPR — taking steps at your request before entering into a possible contract. For messages that are not about a project, and for the anti-spam measures below, we also rely on Article 6(1)(f) GDPR — our legitimate interest in receiving and answering genuine enquiries and keeping the form free of abuse.

Only your name, email and message are needed to answer you. The other fields are optional. If you do not provide the required fields, we cannot reply.

Spam protection. The form includes a hidden field invisible to you and used only to detect bots, and a rate limit of five submissions per IP address in any ten-minute window. The counter is held temporarily in the server’s memory and is not stored permanently.

Delivery. Form submissions reach us by email through Resend. Your email address is set as the Reply-To so we can respond directly. Click tracking and open tracking are turned off.

2.2 When you simply browse the Website

Server logs. Our hosting provider automatically records technical request data, including your IP address. On our current plan these logs are retained for one hour and are then discarded. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in the security and stability of the Website.

Analytics. We use Vercel Web Analytics and Vercel Speed Insights to understand overall traffic and page performance. Both are cookieless: visitors are identified only by a hash generated from the incoming request, that identifier is automatically discarded after 24 hours, and there is no cross-site tracking and no profiling. We only ever see aggregated, anonymous statistics. The legal basis is Article 6(1)(f) GDPR. Because these tools set no cookies and do not read or store anything on your device, no consent banner is required.

Gallery images. The images in our portfolio are hosted on Cloudflare R2 and delivered directly to your browser. As with any image request, your IP address is visible to the provider so that the file can be delivered. The legal basis is Article 6(1)(f) GDPR.

2.3 What we do not do

To be clear, this Website:

• sets no cookies at all — no technical, no analytics, no advertising cookies — and uses no localStorage or sessionStorage; there is no cookie banner because there is nothing to consent to
• has no online shop, no payments, no accounts, no registration and no login
• runs no advertising pixels, no reCAPTCHA, no embedded videos and no chat widgets
• sends no newsletter and no marketing emails
• performs no profiling and no automated decision-making that produces legal or similarly significant effects

Links to our social media profiles are ordinary links. They contain no embedded widgets and no tracking pixels — nothing happens until you choose to click and leave our site, at which point that platform’s own privacy policy applies.

3. Who else processes your data

We do not sell your data and we do not share it for marketing. We use a small number of service providers who process data only on our instructions under a data processing agreement.

4. International data transfers

Vercel, Resend and Cloudflare are US-based companies, so using them involves transferring personal data to the United States. Each of them is certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Article 45 GDPR). As an additional safeguard, each provider also relies on the European Commission’s Standard Contractual Clauses under Article 46 GDPR, which apply if the Framework ceases to be available. Although Cloudflare R2 stores our images in an Eastern-Europe region, Cloudflare, Inc. is the processor, so we treat this as a transfer to the USA covered by the same safeguards.

You can request more information about these safeguards by writing to us.

5. How long we keep your data

• Contact-form enquiries: if your enquiry does not lead to a project, we delete it within 12 months of our last contact. If we start working together, we keep the correspondence for the duration of the project and for as long as we are afterwards legally required to, for example under Czech accounting and tax record-keeping rules.
• Server logs including IP addresses: retained for one hour on our current hosting plan, then discarded.
• Analytics data: no personal data survives beyond the 24-hour identifier described above; the resulting statistics are aggregated and anonymous.

6. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy
• rectify inaccurate or incomplete data
• erase your data (“right to be forgotten”)
• restrict processing
• object to processing based on our legitimate interests
• data portability, where applicable

Because we do not rely on consent for the processing described here, there is generally no consent for you to withdraw.

To exercise any of these rights, email contact@cmindustry.co. We will respond within one month of receiving your request. This period may be extended for complex requests, and we will tell you if that happens. We may need to confirm your identity first.

7. Right to complain

If you believe we have handled your personal data unlawfully, you can lodge a complaint with the Czech supervisory authority:

• Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 727/27, Holešovice, 170 00 Praha 7, Czech Republic
• Web: uoou.gov.cz · Email: posta@uoou.gov.cz
• Phone: +420 234 665 111 · GDPR helpline: +420 234 665 800 (Tuesdays and Thursdays, 13:00–15:30)

You may also complain to the supervisory authority in your own EU/EEA country of residence or workplace.

8. Children

This Website is intended for a professional, adult audience and is not directed at children. We do not knowingly collect personal data from children. Under Czech law (Section 7 of Act No. 110/2019 Coll.), the age of digital consent is 15 years. If you believe a child has sent us personal data, please contact us and we will delete it.

9. Changes to this Policy

We may update this Privacy Policy if our Website or the services we use change. The current version is always available on this page, with the date at the top.