This page explains how I process personal data when operating mareklecian.cz, how I use cookies and similar technologies, and the rules that apply to the use of this website and its content.
You can use the main content of the website without consenting to analytics or performance cookies. Without consent, only basic cookieless statistical measurement may take place, without a persistent visitor or user identifier. Optional storage and reading of analytics data on your device starts only according to the preferences selected in the cookie banner. You can change your preferences at any time using the Withdraw cookie consent link in the website footer.
Last updated: 24 July 2026
Who is the data controller
The controller of personal data is:
Marek Lecián
Company ID: 02848074
VAT ID: CZ8704184852
U Vysočanského pivovaru 459/17
190 00 Prague 9
Czech Republic
Email: contact@mareklecian.cz
Phone: +420 605 934 740
Email is the preferred way to contact me about privacy and personal data processing.
What data I process and why
The scope of processing depends on how you use the website and which cookie preferences you select.
Website operation, security and technical logs
When you visit the website, the server, hosting infrastructure and security tools may process information such as your IP address, the date and time of the request, the requested URL, referrer, browser and device type, technical identifiers, and information about errors or suspicious traffic.
The purposes are to deliver the website, maintain its availability, resolve technical problems and protect it against attacks, automated abuse and other harmful activity. The legal basis is my legitimate interest in operating a secure and reliable website under Article 6(1)(f) GDPR.
The website’s technical infrastructure is provided by Váš Hosting s.r.o., Company ID 24742252, based in the Czech Republic. Under its terms, the provider acts as a processor when processing data stored as part of the hosting service and uses it to provide, operate, maintain and secure the service. Its data processing agreement forms part of its general terms and conditions.
Access logs are maintained separately for each domain in the standard combined format. A record contains the domain name, client IP address, date and time of the request, method, requested URL and protocol version, HTTP status code, volume of transferred data, referrer and User-Agent. Váš Hosting retains both access and web server error logs for 70 days.
Váš Hosting processes security and firewall records as an independent controller on the basis of its own legitimate interest in securing its network and services, rather than as a processor acting on my instructions. It retains these records only for as long as necessary for security purposes. The provider does not disclose the detailed form of its security measures for security reasons.
As part of the hosting service, Váš Hosting retains backups of the website, databases and email for 14 days. Primary data and backups are stored on servers in the Czech Republic, in data centres meeting the TIER 3+ standard, and according to the provider do not leave the European Union. After termination of the service or a deletion request, the provider removes all data, including backups, within 30 days. Billing records are retained for the period required by law.
Contact communication
If you contact me by email or telephone, I process the information you provide, typically your name, contact details, the content of your message and information needed to handle your enquiry.
The website does not contain a contact form or any other form and does not automatically collect visitors’ email addresses. Contact details are processed only when someone chooses to use the published email address or telephone number. Email delivery and storage are provided by Váš Hosting and Google’s Gmail service.
Váš Hosting retains technical email service logs for 14 days.
I use this information to reply, continue the communication and, where relevant, discuss a possible engagement. The legal basis may be steps taken at your request before entering into a contract under Article 6(1)(b) GDPR, or my legitimate interest in handling professional communication under Article 6(1)(f) GDPR. If a contractual relationship or legal obligation arises, some information may be processed further to perform the contract, comply with accounting obligations and protect legal claims.
I retain ordinary email communication that does not lead to an engagement for no longer than three years after resolving the enquiry or the last substantive communication. I then delete it unless further retention is required by law or is necessary to establish, exercise or defend a specific legal claim. Accounting and tax documents are retained for the periods required by applicable law.
User accounts, comments and visitor-provided content
The public website is informational and read-only. Visitors cannot create user accounts or sign in, comments are disabled, and the website neither accepts nor publishes user-generated content. It also contains no forms that collect personal data.
Cookie and consent preferences
The website stores technically necessary information needed to remember consent preferences, the selected language, and to provide basic functionality or security. This information is not used for advertising profiles and does not require consent because it is necessary for a function explicitly requested by the visitor.
The cookie banner currently stores your preference for one year. The website may then ask you to choose again. A new choice may also be required after a material change to the tools used or the purposes of processing.
Basic statistical measurement without analytics cookies
The website uses Google Consent Mode v2 in advanced mode. Until a visitor gives consent, analytics and advertising storage are set to denied. No analytics or marketing cookies or other analytics identifiers are therefore stored on the device, and previously stored analytics identifiers are not read for this measurement.
When a page loads, a cookieless measurement request may be sent together with the consent state. In my configuration, it does not contain a custom user or visitor identifier. I therefore cannot attribute individual page loads to a particular person or connect them into a user or visit profile. I receive only basic statistical information that the server delivered a particular page.
According to Google’s documentation, the technical request may include information normally added by the browser or network layer during communication, such as the request time, User-Agent, referrer, consent state and the IP address needed to deliver the request. I do not use this information to identify a visitor or link their activity. To the extent that personal data is processed during the technical transmission, the legal basis is my legitimate interest in obtaining basic usage statistics and checking that the website works correctly under Article 6(1)(f) GDPR.
Google may use cookieless measurement for aggregated statistics and modelling where its own privacy thresholds are met. I do not have access to the identity of a particular visitor or their browsing history.
Analytics after consent
If you consent to analytics, I may process information about your visit, such as pages viewed, traffic source, approximate technical and geographical information, interactions with content, and identifiers stored in cookies.
The purposes are to understand how the website is used, verify measurement quality, evaluate content and improve the website. The legal basis for processing personal data is consent under Article 6(1)(a) GDPR.
I also use Microsoft Clarity to analyse usability and technical problems. The service is configured with Consent Mode using Consent API v2. Without consent, Clarity does not store the _clck or _clsk cookies and treats each page view as a separate session that cannot be linked to other pages through cookies. Clarity may still send limited cookieless measurement in this mode. After consent, it may use cookies, connect pages into a visit, and create interaction recordings and heatmaps.
The website contains no forms or user-generated content, so Clarity does not record information entered into form fields. For basic cookieless measurement, the legal basis is my legitimate interest in identifying technical problems and obtaining a basic understanding of website use. Consent is the legal basis for storing or reading cookies and for the full linked analytics functionality.
Performance and marketing measurement
If you consent to performance and marketing measurement, information about your visit may be connected with traffic-source or campaign information in Google Analytics and Google Ads. The purpose is to better understand where visitors come from and how content distribution performs.
The website contains no advertising placements. Google Ads is part of the confirmed configuration through its connection with Google Analytics 4 and the option to use GA4 audiences. A separate Google Ads tag therefore does not need to be active in Google Tag Manager. Activation and data sharing for these functions require consent to the relevant marketing storage and marketing use of data, in particular the ad_storage, ad_user_data and ad_personalization states. The legal basis is consent under Article 6(1)(a) GDPR. The LinkedIn Insight Tag and other LinkedIn tags are no longer present on the website or in Google Tag Manager.
What cookies are
Cookies are small text files stored in your browser by a website or connected service. They may provide basic functions, remember preferences or distinguish visits when website use is measured.
Other identifiers and techniques may perform a similar function, including browser local storage, measurement pixels and server requests. For simplicity, this page refers to all of them collectively as cookies unless the context indicates otherwise.
Cookie categories
Necessary cookies
These provide basic website functions, security, language selection and storage of consent preferences. They cannot be disabled through the cookie banner because some explicitly requested functions would not work correctly without them.
Necessary cookies may include:
| Name | Purpose | Lifespan |
|---|---|---|
cc_cookie | Stores consent preferences | 1 year |
pll_language | Remembers the selected website language | 1 year |
wordpress_test_cookie | Checks cookie support on the WordPress login page | Session |
_rbs | Technical security cookie containing a Google reCAPTCHA v3 score used to recognise an automated or malicious login attempt | Session; may be created during a login attempt |
Wordfence may set its own necessary authentication and security cookies when an administrator signs in or uses two-factor authentication. Public visitors cannot sign in to the website, so these administrator cookies do not normally apply to them.
Analytics cookies
These cookies help measure website traffic and use. They are stored only after consent to analytics.
| Cookie name | Purpose | Provider | Lifespan |
|---|---|---|---|
_ga, _ga_* | Distinguishes visitors and measures website use in Google Analytics | Google Ireland Limited | 1 year |
_gid | Distinguishes visitors in Google Analytics for a short period | Google Ireland Limited | 1 day |
FPID | Identifier for Google Analytics measurement through server-side Google Tag Manager | Google Ireland Limited | 1 year |
FPLC | Short-lived identifier for Google Analytics measurement through server-side Google Tag Manager | Google Ireland Limited | 1 day |
_clck | Distinguishes a visitor for Microsoft Clarity analytics and heatmaps | Microsoft Ireland Operations Limited | 1 year |
_clsk | Connects individual page views into one Microsoft Clarity analytics session | Microsoft Ireland Operations Limited | 30 minutes |
SM | Technical synchronisation of Microsoft Clarity analytics measurement | Microsoft Ireland Operations Limited | 1 year |
MR | Technical analytics measurement for Microsoft Clarity | Microsoft Ireland Operations Limited | 1 year |
Performance and marketing cookies
These cookies help evaluate traffic sources and connections with tools used to distribute content. They are stored only after the relevant consent.
| Cookie name | Purpose | Provider | Lifespan |
|---|---|---|---|
NID | Stores preferences and personalisation for Google services and advertising | Google Ireland Limited | 2 years |
1P_JAR | Information used to configure and measure Google services | Google Ireland Limited | 1 week |
CONSENT | Stores consent choices and personalisation preferences in Google services | Google Ireland Limited | 2 years |
IDE | Measures and evaluates advertising through Google DoubleClick | Google Ireland Limited | 2 years |
The current list of optional cookies, their providers, purposes and lifespans is available directly in the detailed settings of the cookie banner. These settings are the more practical source for the technical list because they may change together with the measurement configuration.
How to give, refuse or withdraw consent
On your first visit, you can accept or refuse optional cookies, or select preferences by category. Refusing must be as easy as accepting and must not restrict access to the website’s ordinary content.
Consent is voluntary and can be withdrawn at any time using the Withdraw cookie consent link in the footer. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
You can also delete or block cookies in your browser settings. Blocking all cookies may affect some basic website functions.
Who may receive the data
Technical service providers may process data to the extent necessary to operate, secure, deliver email for, or measure the website. Depending on the active configuration, the recipients or categories of recipients may include:
| Recipient or category | Role | Status |
|---|---|---|
| Váš Hosting s.r.o., Company ID 24742252, Czech Republic | Web hosting, domain email, server logs, security and backups | Processor when providing the hosting service; independent controller for security and firewall records processed under its own legitimate interest |
| Google Ireland Limited | Gmail, Google Analytics, Google Tag Manager, Google Consent Mode v2 and Google Ads | Google Ads is connected through GA4 audiences; the relevant functions activate only after consent to marketing storage and use of data |
| Google Cloud EMEA Limited | Google Cloud infrastructure for server-side Google Tag Manager at chleba.mareklecian.cz | The server is located in the Frankfurt region in Germany, within the EU |
| Defiant Inc. | Wordfence Security, firewall, malicious traffic assessment and security logs | Processor; may process the IP address, URL, referrer, User-Agent, approximate location and security event |
| Microsoft Ireland Operations Limited | Microsoft Clarity, Consent Mode using Consent API v2, heatmaps and interaction recordings | Active analytics service; uses no cookies without consent and enables full linked functionality only after consent |
Depending on the service and how it is used, providers may act as processors, independent controllers, or both. Current information about their own processing is available in each provider’s privacy terms.
I may also disclose data to public authorities where required by law or by a binding decision.
Transfers outside the European Economic Area
Váš Hosting has confirmed that the hosting service’s primary data and backups are stored on servers in the Czech Republic and do not leave the European Union. It may engage Czech data centre operators, payment service providers and domain name registries as additional processors to the extent needed for the relevant service. The server-side Google Tag Manager at chleba.mareklecian.cz is hosted in Google Cloud’s Frankfurt region in Germany. These confirmed European locations do not automatically apply to Gmail, Google Analytics, Google Ads, Wordfence or Microsoft Clarity.
Some other providers also use infrastructure outside the European Economic Area. Where this involves a transfer of personal data to a third country, an appropriate legal mechanism must be in place, such as a European Commission adequacy decision, the EU-U.S. Data Privacy Framework for participating organisations, or standard contractual clauses.
Under their respective terms, Google, Microsoft and Defiant may use infrastructure or additional processors outside the EEA. Depending on the service, they use mechanisms including adequacy decisions, the EU-U.S. Data Privacy Framework or standard contractual clauses. Defiant, the provider of Wordfence, makes standard contractual clauses available to customers in the EEA.
How long I retain data
I retain personal data only for as long as necessary for the relevant purpose or as required by law. Retention varies by type of information:
- Váš Hosting web server access and error logs: 70 days,
- Váš Hosting security and firewall records: only for as long as necessary for security purposes; the provider processes them as an independent controller,
- Váš Hosting technical email service logs: 14 days,
- Wordfence Live Traffic security records: according to the configuration, no longer than 30 days; the Wordfence default is 30 days,
- website, database and email backups at Váš Hosting: 14 days; after termination of the service or a deletion request, the provider removes all data, including backups, within 30 days,
- ordinary email communication that does not lead to an engagement: no longer than 3 years after resolving the enquiry or the last substantive communication; longer retention is possible only where required by law or necessary to establish, exercise or defend a specific legal claim,
- Microsoft Clarity data: generally no longer than 30 days; favourited recordings and a randomly selected sample may be retained for up to 9 months,
- accounting and tax documents: for the period required by law,
- cookie preference record: 1 year,
- optional cookies: for the lifespan stated in the detailed cookie banner settings,
- information needed to protect legal claims: for as long as the relevant claim may be brought or a dispute remains in progress.
Your rights
Subject to the conditions set out in the GDPR, you have the right to:
- obtain confirmation as to whether your personal data is being processed and request access to it,
- request the correction of inaccurate data or completion of incomplete data,
- request deletion of data,
- request restriction of processing,
- receive data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller,
- object to processing based on a legitimate interest,
- withdraw consent at any time where processing is based on consent.
You can send a request to contact@mareklecian.cz. Before responding, I may reasonably verify the requester’s identity to avoid disclosing data to an unauthorised person.
If you believe that personal data is processed unlawfully, you may lodge a complaint with the Czech Office for Personal Data Protection. I would nevertheless appreciate it if you contacted me first and gave me an opportunity to address the situation.
Automated decision-making
I do not use data from this website for automated individual decision-making that produces legal or similarly significant effects for a visitor.
Website security and protection
I use technical and organisational measures appropriate to the nature of a personal website and the information processed. No security measure can, however, be regarded as absolute.
The WordPress installation is protected by Wordfence Security from Defiant Inc. Wordfence operates at server level and may record the IP address, requested URL, time, User-Agent, referrer, approximate location, and information about blocking or another security event. These records are used to identify attacks, login attempts, automated abuse and other suspicious traffic. Ordinary public visitors cannot sign in or create an account.
I may restrict access to the website temporarily or permanently where necessary to protect the website, data or the rights of others. This applies in particular to attacks, attempted unauthorised access, excessive automated traffic, circumvention of security measures, and other unlawful or harmful behaviour.
External links and third-party content
The website contains links to other websites and services. When you follow an external link, the other operator’s privacy rules apply to the processing of personal data. I am not responsible for its privacy settings or content.
Where third-party content such as a video, post or other interactive feature is embedded in a page, loading it may require consent to the relevant cookie category.
Terms of use for website content
The website’s content is intended primarily for professional and informational use. Although I take care over its accuracy, I do not guarantee that it is complete, current or suitable for a particular situation. The content does not replace individual legal, tax, security or other professional advice. Decisions based on it remain the user’s responsibility.
The website does not provide public user accounts, comments, file uploads or any other visitor-generated content. Visitors therefore cannot publish their own content through the website or store it in its public area.
Unless stated otherwise for specific material, original text by Marek Lecián is licensed under the Creative Commons Attribution-ShareAlike 4.0 International licence. Reuse must credit the author and source, indicate any changes, and distribute adapted material under the same licence.
The licence does not automatically apply to logos, trade marks, photographs, illustrations, quotations, embedded content or other third-party material unless expressly stated otherwise.
Nothing in these terms excludes or limits liability that cannot be excluded or limited under applicable law.
Changes to this information
I may update this text when the website, the services used or legal requirements change. The current version will always be published on this page together with the date of the latest update. If a change materially affects consent previously given, the website will ask you to choose again.