Privacy policy
Valid from 21. 10. 2026
This page explains what personal data we process when you use the website ibstudio.acko.studio, why we do so, how long we keep it and what your rights are. It is a translation; the version in the website's main language is binding.
Who processes your data
This website is a demo prepared for iBstudio by the agency ACKO. The operator's details as the controller of personal data will be added before the website goes live.
For anything about personal data, contact us: e-mail koreanocz@gmail.com.
Who helps us
The website and messages are run for us by Feedmetoo s.r.o., company ID (IČO) 06309798, registered office Pražská 6, 269 01 Rakovník (brand ACKO), as our processor under a data processing agreement. It may use the data only for us and on our instructions. It uses these providers:
- Cloudflare – delivering the website, protection against attacks and bots, file and backup storage.
- Supabase – database (in the EU).
- Railway – running the application in which we manage the website (in the EU).
- Resend – sending e-mails.
- Sentry – catching application errors, without anything you fill in on the website (in the EU).
Cloudflare and Resend are US companies. Transfers to the US are covered by the European Commission's adequacy decision (EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.
When you visit the website
When you open the website, your IP address, browser type, the time and the page address are processed. Without them the website cannot be delivered or protected against attacks. This data serves only operation and security (our legitimate interest, Art. 6(1)(f) GDPR). The website uses no traffic measurement or advertising tools that would track you. What the website stores in your browser is described on the Cookies page.
When you write to us through the form
What we process: your name, e-mail or phone and the text of your message.
Why: to answer you and handle your request. The legal basis is steps prior to or performance of a contract (Art. 6(1)(b) GDPR), for other questions our legitimate interest in answering you (point f).
How long: handled messages are deleted 12 months after they were handled, unhandled ones at the latest 24 months after they were sent. Photos: if you attach photos to your message we process them too, to understand what you ask for. We store them privately with our processor Feedmetoo s.r.o., never send them by e-mail, only the people who handle messages can see them, and we delete them together with the message. Do not attach a photo that shows more about you than you want to share.
We learn about a message by e-mail and read it in our application. We may send a confirmation that the message arrived to the e-mail address you give (at most one per 24 hours).
When you book an appointment
What we process: the chosen service and time, your name, phone and possibly e-mail and a note. By phone number we keep a client card: name, phone, an overview of your bookings and our own note on your visits. Our clients are listed in a list where we find you by name or phone number. For each booking we keep its history: what happened to it and when (for example received, confirmed, moved or cancelled), without the text of any message.
Why: to hold the time for you, confirm or decline it, and contact you if anything changes. The legal basis is steps prior to and performance of a contract (Art. 6(1)(b) GDPR); we keep the client card in our legitimate interest in knowing our clients and their visits (point f).
Who sees the data: we and our staff who handle bookings, and the processor ACKO. The person you are booked with sees your name, the booking's note and our note on the client card for their appointments, not your phone or e-mail. We send the confirmation by text message from our phone, and by e-mail too if you give one. Our phone receives only a notice with the day and time, never your name or contact.
Calendar on the phone: we, or the person you are booked with, may put a confirmed booking into the calendar on our phone to have appointments at hand. The event holds the service and your name; the phone number only if we set it so, and never for the person you are booked with. The phone's maker (Apple or Google) may store the calendar in its cloud, depending on the phone's settings.
Link to manage the booking: the confirmation contains a link to view or cancel your booking. Anyone with the link can cancel the booking, so do not forward it. The page behind the link does not show your name or contact.
How long: the name, phone, e-mail and note of a booking are deleted 12 months after its date; only an impersonal record of the service, price and date remains. The client card is deleted 24 months after your last booking.
Protection against abuse
Forms are protected against bots by Cloudflare Turnstile. During the check Cloudflare processes your IP address and technical data about the browser; it does not see the content of the form. For limits against abuse we create an irreversible fingerprint of your IP address; we do not store the IP address itself and delete the fingerprint after 24 hours. The legal basis is our legitimate interest in preventing abuse of the website (Art. 6(1)(f) GDPR).
Your rights
You have the right to:
- know what data about you we process and get a copy of it,
- have inaccurate data corrected,
- ask for erasure when we no longer need the data or process it unlawfully,
- ask for processing to be restricted,
- object to processing based on legitimate interest,
- receive the data you gave us in a machine-readable format.
Just contact us (e-mail koreanocz@gmail.com). We answer within one month at the latest. If you believe we handle your data in breach of the law, you can complain to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.
Do you have to give us your data?
Browsing the website requires no data. Without your contact details, however, we cannot answer you. We do not carry out automated decision-making or profiling.
Backups and changes
Data is backed up daily for security; deleted data disappears from the backups within 6 weeks at the latest. We update this page when the way the website works or the law changes.