Privacy policy

Contact form

The form is used only for a non-binding question, a quotation request or an enquiry about gardening services. Submitting it does not create an order, a contract or an obligation to pay.

We process the following data:

• your name, only if you choose to provide it,
• your email address,
• the content of your message,
• during technical transmission, also your IP address, request time and request data necessary to protect the form against abuse.

We do not use the data for newsletters, advertising or behavioural tracking. We do not require consent or a GDPR checkbox to send an enquiry.

Purposes and legal bases

We process an enquiry seeking a quotation or service in order to take steps at your request before entering into a contract under Article 6(1)(b) GDPR. The form itself does not conclude a contract.

We process general questions and routine communication under Article 6(1)(f) GDPR. Our legitimate interest is to answer and follow up on a message and to protect potential legal claims.

We process technical data necessary for secure website delivery, spam prevention and service protection under Article 6(1)(f) GDPR. Our legitimate interest is the secure and available operation of the website.

You have the right to object to processing based on legitimate interests.

Recipients and data flow

• authorised personnel of PLANT s.r.o.,
• Cloudflare, Inc. — hosting, CDN, security and cookie-free traffic analytics provider (Cloudflare Web Analytics). When you visit, it processes in particular your IP address and technical request metadata; the traffic analytics does not use cookies or any other browser storage and does not fingerprint visitors. After the form is activated, its server-side function will also process your name, email address and message on successful submission in order to pass them to the company mailbox.
• INTERNET CZ, a.s. (FORPSI) — technical provider of the company email mailbox. After the form is activated, it will process the email address, name, message content and email metadata on delivery.
• public authorities or other authorised persons where required by law or necessary to protect legal claims.

Domain registration with FORPSI is not in itself processing of visitor data. We do not load libraries, fonts, maps, videos or other embedded content from third-party servers; static files are hosted together with the website.

Transfers outside the European Economic Area

Cloudflare operates a global network. Technical data and, once the form is activated, its content may therefore be processed outside the EEA, including in the United States. This is not merely an unspecified possibility; it follows from the global manner in which the service is provided.

Cloudflare identifies its certification under the EU–U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses incorporated into its Data Processing Addendum as safeguards. Current terms are available in the Cloudflare DPA and the subprocessor list.

The form will not be activated until PLANT s.r.o. confirms the contractual terms for processing email data by FORPSI. This avoids making an unsupported claim about the location or safeguards of such processing.

Retention period

We retain an enquiry that did not lead to cooperation for no more than 12 months after the last related communication. We then delete it unless it is needed to establish, exercise or defend a legal claim.

If communication leads to a contract, project, invoice or complaint, we retain the relevant data for statutory periods and for the period necessary to protect legal claims. These later records are no longer a contact-form database.

The website does not store complete messages in its own database. Once activated, they are delivered to the company email mailbox. After activation, a form security token will be valid for no more than 30 minutes; short-lived pseudonymised limits will be used only to prevent abuse. Cloudflare operational and security logs are retained according to the configured service only for as long as needed to provide and secure the service and investigate incidents.

Your rights

Subject to the conditions of the GDPR, you have the right:

• to access your personal data,
• to have inaccurate or incomplete data rectified,
• to erasure and restriction of processing,
• to data portability where the statutory conditions are met,
• to object to processing based on legitimate interests,
• to lodge a complaint with the supervisory authority.

You may exercise your rights at [email protected] or by writing to the registered office. If you believe that processing infringes the GDPR, you may lodge a complaint with the Úrad na ochranu osobných údajov Slovenskej republiky.

Required and optional fields

Providing data is voluntary. Email and message are technically required because without them we cannot receive and answer the enquiry. Name is optional. Not providing a required field only means that the enquiry cannot be sent through the form; you are not ordering a service by using it.

Cookies, storage and technical data

The audited website build does not use marketing cookies, pixels, advertising systems, CAPTCHA, maps, social embeds or video embeds. The website itself does not write to document.cookie, localStorage, sessionStorage or IndexedDB. The chosen language is carried only in the page URL. The only traffic measurement is Cloudflare Web Analytics — it runs without cookies and without any browser storage, so it has no effect on the consent banner.

We therefore do not display a consent cookie banner. If a technology requiring consent is introduced later, it must remain blocked until consent is freely given and this notice must be updated.

Cloudflare technically processes the IP address and metadata necessary to deliver and protect the website with every HTTP request, and for cookie-free traffic analytics (Cloudflare Web Analytics). In response to a specific security incident, it may use an essential security mechanism; it must not be used for advertising or cross-site tracking.

Automated decision-making

We do not use automated individual decision-making or profiling for contact enquiries.

Security

The form applies data minimisation, origin checks, request-size limits, a time-limited token and duplicate-submission protection. Transmission is encrypted and credentials are stored outside public code.

Controller and contact