Privacy policy (GDPR)
Last updated: July 2026
This policy describes what personal data RV-trade s.r.o. processes when you browse this site or send us an enquiry, why it processes it, how long it keeps it, who has access to it and what you can ask of us. It follows Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
In short: this site sets no cookies of its own, does not track you, and does not sell or pass on your data for marketing. The only personal data we ask for is what you type into the enquiry or contact form — and it serves solely to let us answer you and handle the job.
1. Data controller
- RV-trade s.r.o.
- Registered office: Česká Bělá 79, 582 61 Česká Bělá, Czech Republic
- Company number (IČO): 21008612
- VAT number: CZ21008612
- Czech data box ID: e7wumgt
- E-mail: [email protected]
- Phone: +420 604 234 271
We are not required to appoint a data protection officer under Article 37 GDPR and have not appointed one. Send any data protection question or request to exercise your rights to the e-mail address above or to the data box.
2. What we process, why and for how long
We obtain personal data directly from you — from the forms on the enquiry, custom production, roundwood, business and contact pages, or from an e-mail or a phone call. We buy none of it and collect none of it from public registers.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling the enquiry, the offer and the quotation | Name, e-mail, phone, company, the text of the enquiry, the basket contents, attached files (drawings, photographs, specifications) | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract | 3 years from the last contact (the limitation period), then erasure |
| Entering into and performing a sales contract or a bespoke order | Billing and delivery details, contact for the responsible person | Art. 6(1)(b) GDPR — performance of a contract | For the duration of performance and 3 years after it ends |
| Statutory accounting and tax duties | The details on tax documents | Art. 6(1)(c) GDPR — Czech Act No. 563/1991 Coll. on accounting and Act No. 235/2004 Coll. on VAT | 10 years, as the law requires |
| Protecting the site from spam and form abuse | IP address (held in the application's memory to count the limit), the contents of the hidden bot trap | Art. 6(1)(f) GDPR — legitimate interest in keeping the site operational | IP addresses only for the length of the limit window (24 hours at most); they are stored nowhere |
| Server operational logs | IP address, time, requested address, browser type, status code | Art. 6(1)(f) GDPR — legitimate interest in security and availability | 30 days at most |
| Aggregate traffic statistics | Page view counts, country, device type, referrer — without cookies and without a visitor identifier | Art. 6(1)(f) GDPR — legitimate interest in improving the site | Aggregate figures only; no record of an individual is created |
Filling in a form is voluntary. Without a name and a contact we simply have no way to send you an offer — that is the only consequence of not providing them. The phone and company fields are optional; fill them in only if you want us to be able to call you or to prepare an offer for a company.
Enquiry attachments
Up to 5 files (drawings, photographs, specifications) can be attached to an enquiry. They are stored in non-public storage on our own server, the storage path is chosen by the server rather than by your browser, and no link to them is publicly available. Attachments are deleted together with the enquiry. Please do not put data into them that the job does not require — in particular national identification numbers, copies of identity documents or health data.
3. What we do not do
- We do not sell, rent or trade personal data.
- We do not send marketing messages to people who did not ask for them, and we run no advertising or remarketing tools.
- We do not track you across sites and set no analytics or marketing cookies.
- We carry out no automated decision-making or profiling within the meaning of Article 22 GDPR — every enquiry is read and priced by a person.
- We process no special categories of data under Article 9 GDPR, and the site is not directed at children.
4. Who has access to the data
We read the enquiries ourselves. We use no external CRM and no e-mail marketing tool — the data stays in a database on our own server. We share it only with the recipients listed below, only for the stated purpose and under a processing agreement pursuant to Article 28 GDPR. We also pass it to public authorities where the law requires it (the tax administration, for example).
| Recipient | Role | Where the data sits | Transfer outside the EEA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the web application | Germany (EU) | None takes place |
| RV-trade's own server | Enquiry database and attachment storage (self-hosted Supabase / PostgreSQL) | Czech Republic | None takes place |
| Cloudflare, Inc. | DNS, CDN, attack protection (WAF) and traffic statistics computed from requests — no script and no cookie | European edge network; parent company in the USA | Standard contractual clauses and the EU-US Data Privacy Framework |
| Google Ireland Limited | Delivery of the web font (Google Fonts) — Google receives your IP address and browser details, nothing more | Ireland (EU), with support from the USA | Standard contractual clauses and the EU-US Data Privacy Framework |
| OpenStreetMap Foundation | The map on the contact page (an embedded frame) — it loads only when the page is shown and passes your IP address | United Kingdom | European Commission adequacy decision for the United Kingdom |
| Hauliers and contract manufacturers | Delivery of goods and production of a bespoke order — only the name, address and phone number needed to deliver | Czech Republic | None takes place |
5. Transfers outside the European Economic Area
The site and the enquiry database are operated in the European Union. Where a recipient listed above is established outside the EEA, the transfer relies on the European Commission's standard contractual clauses under Article 46(2)(c) GDPR, or on an adequacy decision. You can ask us for a copy of the safeguards for a specific transfer.
6. Cookies, analytics and language
This site sets no cookies of its own. Traffic statistics come from Cloudflare, through which every request to this site already passes: they are computed inside its network from those requests, no analytics script is loaded into your browser, and no identifier is created that could recognise you on other sites. The language of a page follows from its address; on a Czech address we read your browser's Accept-Language header once and store nothing about it. The basket contents are remembered by your browser in local storage and are sent to us only when you send the enquiry yourself. The details are in the cookie policy.
7. How we protect the data
- All traffic goes over HTTPS with a modern TLS configuration.
- The browser never talks to the database directly — everything goes through this site's own server endpoints, which re-validate the data and limit the number of requests from one address.
- Attachments sit in non-public storage; reading enquiries and attachments requires administrator access.
- Access keys live in server environment variables and never reach the browser or the source code.
No transmission over the internet is entirely secure, so absolute security cannot be guaranteed. Should a security breach nevertheless occur that poses a risk to your rights, we will report it to the Czech data protection authority within 72 hours and, where the risk is high, inform you as well.
8. Your rights
In relation to your personal data you have the right:
- of access (Art. 15) — to know whether and what data we process about you, and to receive a copy of it;
- to rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed;
- to erasure (Art. 17) — to have the data deleted, unless we must keep it for a legal duty or to defend legal claims;
- to restriction of processing (Art. 18) — to have processing suspended while the accuracy of the data or a legitimate interest is disputed;
- to portability (Art. 20) — to receive the data you provided to us in a machine-readable format;
- to object (Art. 21) — to object at any time to processing based on a legitimate interest;
- to withdraw consent (Art. 7(3)) where processing rests on consent, without affecting the lawfulness of processing before the withdrawal.
Exercise your rights by e-mail at [email protected] or through data box e7wumgt. So that we do not hand data to the wrong person, we may ask you to verify your identity. We reply within one month of receiving the request (Art. 12(3) GDPR); for exceptionally complex requests we may extend that by a further two months and will tell you why. Exercising your rights is free of charge.
9. Complaint to a supervisory authority
If you believe we are handling your data unlawfully, please come to us first — most things are resolved faster directly. You also have the right to lodge a complaint with a supervisory authority:
- Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
- www.uoou.gov.cz
10. Changes to this policy
We update this policy whenever what we do with the data changes — when a form is added, say, or a new service provider. The version in force is always published here, with the date it was last updated.
11. Contact
RV-trade s.r.o., Česká Bělá 79, 582 61 Česká Bělá, Czechia — [email protected] — +420 604 234 271. We are glad to answer through the contact page too.