Kristian Ulrych

Legal

Privacy Policy

Last updated: 2 May 2026

This page explains what personal data is collected when you use Kristian’s portfolio site, why it is processed, and what your rights are under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

Data controller

Kristian Ulrych, an independent designer based in Prague, Czechia. The simplest way to reach me is by email at kristian.ulrych@gmail.com.

What data is processed and why

Contact form

When you submit the form on /contact, the following is collected: your name, your email, the optional subject, the message you wrote, and request metadata that may be recorded by the hosting platform (IP address, timestamp, user agent). The purpose is to receive your message and reply to it.

The lawful basis is legitimate interest (Art. 6(1)(f) GDPR) — you actively initiated contact, and only the data necessary to reply is collected. If the conversation moves toward a possible engagement, processing for that conversation falls under Art. 6(1)(b) (steps prior to entering a contract).

Hosting

This site is hosted on Vercel (Vercel Inc., USA). Vercel receives standard request metadata (IP addresses, request paths, user agents) needed to deliver the site and protect it from abuse.

Email delivery

Submissions from the contact form are delivered to my Gmail inbox by Resend (operated by Plus Five Five, Inc., USA), acting as a data processor. Your name, email, and message pass through Resend’s servers and are retained in their delivery logs per Resend’s standard retention. The resulting message is stored in my Gmail inbox provided by Google LLC.

Analytics & performance

The site uses Vercel Web Analytics and Vercel Speed Insights. These tools do not use cookies and are designed to provide aggregated or anonymous insights rather than identify individual visitors. Vercel Web Analytics uses a daily-rotating hash of request metadata and does not track visitors across days. Speed Insights stores performance data such as route, device type, browser, country, and Core Web Vitals metrics (LCP, CLS, INP), but does not retain information that would allow a browsing session to be reconstructed or a specific user to be identified.

Third-party assets

Fonts are self-hosted and do not require requests to Google Fonts or other external font providers. The site loads a 3D background scene SDK from the jsDelivr CDN; that service may receive standard request metadata such as your IP address as part of normal request handling. No advertising or tracking cookies are used on this site.

International transfers

Some service providers used by this site or for communication purposes (Vercel, Resend, Google) are based in the United States. Where personal data is transferred outside the EEA, the relevant provider relies on appropriate safeguards such as the EU Standard Contractual Clauses and/or participation in the EU-U.S. Data Privacy Framework, where applicable.

Retention

Messages are kept as long as needed to handle our conversation and any reasonable follow-up, and no longer than 24 months from the last interaction — unless a contractual or legal obligation requires longer retention. You can ask for earlier deletion at any time.

Your rights

Under the GDPR you have the right to:

  • access the data I hold about you;
  • have inaccurate data corrected;
  • request deletion (“right to be forgotten”);
  • restrict or object to processing;
  • receive your data in a portable format;
  • lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů.

To exercise any of these rights, email kristian.ulrych@gmail.com.

Changes

This policy may be updated from time to time. The “Last updated” date at the top reflects the current version.