Privacy policy

Contact form and processed categories of data

The contact form on the website is used exclusively for submitting a non-binding question, a quotation request or an enquiry about gardening and landscaping services. Submitting the form does not create a purchase contract, contract for work, binding order or obligation to pay.

We process the following data through the form:

• Name and surname, but only if voluntarily provided (optional field),
• Email address, which is necessary to respond to your enquiry,
• The text of the message you send us,
• Technical transmission data during submission: the sender's IP address, precise request timestamp and network headers necessary to protect the form from abuse, bots and spam.

We do not use the collected personal data for sending unsolicited marketing messages (newsletters), we do not run remarketing campaigns, and we do not track your behavior on the website. Submitting the form does not require consent to the processing of personal data or checking any checkbox, as processing is covered by other statutory legal bases.

Purposes and legal bases

We carry out any processing of personal data on the basis of the relevant legal title under Article 6 GDPR:

Processing of an enquiry aimed at a quotation or service provision is carried out to take steps at your request prior to entering into a contract under Article 6(1)(b) GDPR. Submitting the form does not conclude a contract.

General enquiries, feedback and routine communication are processed under Article 6(1)(f) GDPR. The legitimate interest of the company is to answer your message, maintain communication continuity and protect potential legal claims.

Technical network data necessary for website delivery, spam mitigation and infrastructure protection are processed under Article 6(1)(f) GDPR. The legitimate interest is the stable, secure and continuously available operation of the website.

Please note that you have the right to object at any time free of charge to processing based on legitimate interest (Article 6(1)(f) GDPR).

Recipients of data and processors

Access to your data is granted exclusively to authorized personnel of PLANT s.r.o. and contractually vetted technical processors bound by strict confidentiality and data processing agreements under Article 28 GDPR:

• Authorized persons of PLANT s.r.o.
• Cloudflare, Inc. (USA) — security, CDN network and web hosting provider. Upon visiting, it processes the IP address and technical request metadata, from which server-side aggregate anonymous traffic statistics are generated without storing cookies. Upon successful submission, the form's serverless function securely transfers the entered data to the mail delivery service.
• Resend, Inc. (USA) — technical platform ensuring the dispatch of email messages from the contact form to our corporate mailbox. Sending servers and data routing operate within the European region in Ireland (European Union).
• INTERNET CZ, a.s. (FORPSI, Czech Republic) — provider of corporate email mailboxes and operator of mail servers in EU data centers. Upon message delivery, it processes the email address, name, message content and email metadata.
• Public authorities or supervisory bodies, if such an obligation is imposed on us by generally binding legal regulations of the Slovak Republic.

Domain registration with the registrar FORPSI does not in itself constitute processing of personal data of an ordinary visitor. We do not load any external libraries, Google Fonts, maps, videos or social widgets from third-party servers into your browser; all static files are hosted directly alongside the website.

Transfers outside the European Economic Area (EEA)

Due to the use of global technology providers, network data and form contents may be processed on servers in the United States:

Data transfers to the USA within Cloudflare, Inc. services rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework (DPF), under which Cloudflare is actively certified. For cases outside the scope of certification, the provider applies the European Commission's Standard Contractual Clauses (SCCs) included in the Cloudflare Data Processing Addendum.

Data transfers to the USA within Resend, Inc. services primarily rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework (DPF), under which Resend (Plus Five Five, Inc.) is duly certified. In addition, Standard Contractual Clauses (SCCs) are incorporated into the contractual relationship as a fallback mechanism in accordance with the Resend DPA.

The corporate email mailbox with INTERNET CZ, a.s. (FORPSI) is operated in data centers within the European Union, so cross-border transfer to third countries does not occur.

Retention period of personal data

An enquiry from the contact form that did not lead to concluding a contract and establishing cooperation is retained in the corporate mailbox for no more than 12 months from the conclusion of the last communication. After this period, the message is deleted unless needed to establish, exercise or defend legal claims.

If communication leads to concluding a contract, execution of gardening works and invoicing, relevant identification and accounting data are retained for 10 years as required by Act No. 431/2002 Coll. on Accounting and for the duration of statutory limitation periods under civil and commercial law.

The website itself does not store messages in its own database. Messages are delivered directly to the corporate mailbox. The Resend delivery service retains delivery logs for a maximum of 30 days pursuant to its security terms. The form security token expires within 30 minutes. Cloudflare network logs are kept only for the period necessary to ensure operational security.

Rights of data subjects

Under the GDPR and Act No. 18/2018 Coll., you have the following rights:

• Right of access to your personal data (Art. 15 GDPR),
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR),
• Right to erasure (right to be forgotten under Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability in a structured and readable format (Art. 20 GDPR),
• Right to object to processing based on legitimate interest (Art. 21 GDPR),
• Right to lodge a complaint with a supervisory authority.

You can exercise your rights by sending an email to info@zaryaplant.sk or in writing to the address of the company's registered office.

In case of doubts about the lawfulness of processing your data, you have the right to lodge a complaint or petition to initiate proceedings with the supervisory authority:

Required and optional fields

Providing personal data through the form is voluntary. The email address and message content are technically required fields, because without them the enquiry cannot be delivered or handled. Providing a name is optional. Failure to fill in required fields will only result in the form not being sent.

Cookies, storage and technical data

This website does not use any analytical, tracking or marketing cookies. The website does not write any data to document.cookie, localStorage, sessionStorage or IndexedDB. The interface language is governed exclusively by the URL. The website runs no tracking pixels or analytical trackers; aggregated traffic is evaluated solely from server logs upon page delivery.

For these reasons, no consent cookie banner is displayed on the website. There is no storage of information or access to information stored in the user's terminal equipment pursuant to Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications, therefore user consent is not required.

When processing HTTP requests, Cloudflare technically processes the IP address and network headers necessary for routing and traffic protection. These elements may not be and are not used for advertising or cross-site tracking of visitors.

Automated decision-making

When processing data from contact enquiries or operating the website, we do not carry out automated individual decision-making or profiling pursuant to Article 22 GDPR.

Data security

The contact form applies the principle of data minimization, request origin validation, strict data size limits, a time-limited CSRF token and rate limiting protection against repeated flooding. Data transmission is secured by strong TLS encryption (HTTPS) and API access keys are protected at the server level outside the public application code.

Controller and contact details