Privacy policy.

ASCENT is a name shared by two independent sole traders. The joint data controllers are Filip Liška and Oliver Schmidt, company ID numbers (IČO) 23244101 and 19687508, in that order. We are equally responsible for your data, and you can exercise your rights with either of us. The easiest way is to email studio@ascent.cz. Contact details for each of us are on the Contact page.

This policy covers this website and anything you send us through it. For more about cookies, see the cookie policy.

From the forms. We process what you write to us yourself: your name, email and message and, depending on the form, your phone number, company name and a link to your materials. Phone, company and link are optional. The quote form adds your answers about the project, such as the address of your current website, timing or budget. The email we receive also shows the language of the page and, for messages from the contact form and the footer form, the topic you picked (if any) and the address of the page you sent it from. The website does not store messages anywhere; it only emails them to our mailbox. Providing your details is voluntary, but without a name, an email address and a message we cannot reply.

Spam protection. To stop bots flooding the forms, the site calculates a short fingerprint from your IP address and uses it to count how many times you have submitted a form in the last 15 minutes and in the last day. The fingerprint is a one-way calculation from your IP address and a secret key held only on the server (for IPv6 addresses, only the first half is used). Nobody can read your address from it directly, but we still treat it as personal data. All the server keeps alongside it is a counter and the time of the first submission. The form is also protected by a signed token derived from part of your IP address and your browser type. The server does not store the token; it simply recalculates it and compares the two when you submit.

Technical hosting logs. Like any server, the hosting the site runs on records technical data about requests, such as the IP address, the time and the page opened. These logs are used to run and secure the server.

The site uses no advertising systems or social plugins. Fonts, images and scripts all load from our own domain, with one exception: Google Analytics, which only starts if you agree to it.

We measure visits with Google Analytics 4, but only with your consent. On your first visit, a banner appears with Accept and Reject buttons. Until you click Accept, the site loads nothing from Google and sets no Google Analytics cookies. The site remembers a refusal too, so the banner does not keep coming back.

Analytics shows us things like which pages are opened, where visitors come from, how long they stay and what device and browser they use. Google derives an approximate location from the IP address but, according to its documentation, does not log or store the address itself. We work with aggregated reports and do not try to find out who you are. Nothing you type into the forms is sent to Google Analytics.

The data is kept for 14 months and then deleted automatically. Google signals and ad personalisation are switched off. Analytics uses the _ga and _ga_<ID> cookies, which last up to 2 years and are described in the cookie policy.

The processor is Google Ireland Limited. Data may also be transferred to Google LLC in the USA. These transfers rely on the European Commission’s adequacy decision for companies certified under the EU-US Data Privacy Framework. For how Google itself handles data, see its privacy policy.

You can withdraw your consent at any time, just as easily as you gave it: click Cookie settings in the footer and choose Reject. The site then stops loading Google Analytics and deletes the _ga and _ga_<ID> cookies it set. Withdrawing consent does not affect any processing that took place before. Data already in Google Analytics stays there until the 14-month period runs out.

We process data only for these purposes:

• Replying to your message, preparing a quote and possibly entering into a contract. When you ask us for an offer or a quote, the legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). When you simply send us a question, it is our legitimate interest in replying to you (Art. 6(1)(f) GDPR).
• Keeping spam out of the forms and running the site securely. We process the IP fingerprint and the hosting logs on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
• Visitor analytics. We process analytics data on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not use your data to send advertising, we never sell it, and no automated decisions are made about you based on it.

• Messages from the forms. If an enquiry does not lead to us working together, we delete it no later than 12 months after our last contact. If it does, we keep the data for as long as we work together and then for as long as the law requires, mainly under tax and accounting rules.
• IP fingerprint. Used only to count submissions over the last 15 minutes and the last day. Once a day, the site automatically deletes records older than two days, so none stays on the server for longer than about three days.
• Google Analytics. The data is kept for 14 months and then deleted automatically.
• Cookies. For the periods listed in the cookie policy.
• Technical hosting logs. As set by the hosting provider.

We work with providers who process data for us and on our instructions:

• a web hosting provider with servers in the European Union, which run the site and record the technical access logs,
• an email service provider based in the European Union that hosts our mailboxes: messages from the forms arrive there and we reply to you from them,
• Google Ireland Limited, but only if you agree to analytics (see above).

We will tell you the names of the providers on request. We do not pass your data to anyone else unless the law requires it, and we never sell it. We do not send it outside the European Union ourselves. The exception is the possible transfer to the USA through Google Analytics, described above. If any of our providers also processes data outside the European Union, it is protected by standard contractual clauses approved by the European Commission.

You have the right to:

• know what data we process about you and get a copy of it,
• have inaccurate data corrected,
• ask for your data to be deleted or for its processing to be restricted,
• receive the data you gave us in a common, machine-readable format,
• object to processing based on legitimate interest,
• withdraw your consent to analytics at any time, using the Cookie settings link in the site footer.

Just write to either of us at studio@ascent.cz. We will reply within one month.

If you think we are mishandling your data, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) at uoou.gov.cz.

This policy is effective from 14 October 2026. If the site starts handling data differently, we will update the policy and its date.