What a business website must contain

6 min read · updated 27 July 2026

Most brochure websites in Czechia fail at least one of these duties. Inspections do not come often, but when they do it gets unpleasant. This is an overview, not legal advice — for anything contested, ask a lawyer.

1. Business identification

A website is a commercial document like any other, so it has to be clear who stands behind it. Specifically:

  • name (first and last name for a sole trader, company name for a company),
  • business ID (IČO),
  • registered address or place of business,
  • for companies, the commercial register entry (file number and court),
  • if you are VAT registered, the VAT number (DIČ).

This follows from the Czech Civil Code (§ 435) and, for services offered online, from Act No. 480/2004 Coll. The simplest fix is to put it in the footer, where it appears on every page.

2. A contact that works

A customer has to be able to reach you quickly. In practice that means an e-mail address or a phone number, not just a form. A form is a fine addition, but on its own it is not enough — it cannot prove the message arrived.

3. Information about personal data processing (GDPR)

As soon as you collect anything personal on the site — and a contact form does — EU Regulation 2016/679 requires you to tell the visitor:

  • who processes the data and how to contact them,
  • what data and why,
  • on what legal basis,
  • how long you keep it,
  • who you pass it to (hosting, analytics, mailing),
  • what rights the visitor has and how to exercise them.

In practice: a separate “Privacy policy” page linked from the footer and from the form. A link at the form is enough — a consent checkbox is not mandatory when you process the data to perform a contract or to take steps prior to one. It does no harm either.

4. A cookie banner with a real choice

This is where most sites go wrong. Since 2022 Czechia operates on opt-in — analytics and marketing cookies may only load after the visitor clicks consent.

What that means in practice:

  • A banner saying “we use cookies, by continuing you agree” is not enough.
  • Refusing must be as easy as agreeing — both buttons equally visible.
  • Google Analytics must not load before the visitor clicks. If the script downloads immediately and waits, that is a breach.
  • Essential cookies (storing that choice, for instance) need no consent.

It is easy to verify: open the site in a private window, hit F12 → Network, and before clicking anything look for requests to googletagmanager.com. If they are there, you have a problem.

5. Prices, if you show them

A stated price has to be the final one — including VAT and every mandatory charge. If you are not VAT registered, say so, to make it clear why nothing is added. Showing prices is not mandatory, but once you show them, this applies.

6. Terms and conditions — only when selling

If you sell goods or services through the site (an e-shop, an order form with payment), you need terms and conditions, information about the 14-day right of withdrawal, about complaints and about out-of-court dispute resolution through the Czech Trade Inspection Authority. For an ordinary brochure site where you simply respond to enquiries, none of this applies.

What is at stake

The trade licensing office can fine you for missing identification. For a GDPR breach the Office for Personal Data Protection has theoretically very high ceilings, though for small businesses the first step is usually a request to put it right. Cookies fall to the same office, which has been working on them consistently in recent years.

The real risk for a sole trader is fairly low. But all of this together is an afternoon's work, so there is not much reason not to have it.

Quick check

  • Are the name, business ID and address in the footer? On every page?
  • Is there an e-mail address or a phone number somewhere, not just a form?
  • Is there a privacy policy page, and does the form link to it?
  • Does the cookie banner have a refuse button, as visible as the accept one?
  • Do analytics really load only after the click?
  • Does the site run on HTTPS?

Six questions. If you hesitate on any of them, you know where to start.