Privacy policy

1. Who processes your data

The data controller is ATAVA Group s.r.o., company ID 29016932, registered office at Meteorologická 792/29, 142 00 Praha 4 - Libuš, Česká republika. We decide why and how your data is processed and we are responsible for protecting it.

We have not appointed a data protection officer, as the law does not require us to. For any question about personal data, write to info@novostavby-manelovice.cz.

2. What data we process and why

We process only the data you give us yourself, plus the technical data needed to run the site. We do not buy databases and we do not sell your data to anyone.

• Contact form: name, e-mail address, phone number (optional), subject and the message text. The purpose is to handle your enquiry and agree the next steps. The legal basis is pre-contractual steps under Art. 6(1)(b) GDPR and, where your message is not aimed at a contract, our legitimate interest in answering it under Art. 6(1)(f) GDPR.
• Phone calls and e-mails: whatever you tell us in the conversation. The purpose and legal basis are the same as for the form.
• Traffic measurement: the data about your visit described in the Cookie policy. We process it only with your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time.
• Server logs: IP address, browser type and request time, recorded by our hosting provider for every request. The legal basis is our legitimate interest in the security and availability of the site under Art. 6(1)(f) GDPR.

3. Providing your data is voluntary

You do not have to use the form or the phone. Without a name, an e-mail address and a message we cannot reply, which is why those fields are required. There are no other consequences of not providing data.

The site is not aimed at children under 16 and we do not knowingly process their personal data.

4. How long we keep your data

• An enquiry that did not lead to a contract: 2 years from the last communication, after which we delete the message.
• An enquiry that led to a contract: for the duration of the contractual relationship and then for the statutory periods, in particular 10 years for accounting records and for the limitation period for any claims.
• Cookie consent: 6 months from the moment it is given, after which we ask again.
• Analytics data in Google Analytics: 14 months from the last activity, after which Google deletes it automatically.

5. Who we share data with

We do not publish your data and we do not pass it to anyone for their own marketing. We disclose it only to processors who handle it for us under a contract and on our instructions.

• The hosting and content delivery provider (Vercel Inc.), which runs the servers the site is served from.
• The mailbox and outgoing SMTP provider that delivers the form messages.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for traffic measurement (Google Analytics 4) and the embedded maps (Google Maps).
• Public authorities, where a legal provision requires it.

6. Transfers outside the European Union

Some processors may handle data outside the European Economic Area, in particular in the United States. Any such transfer relies on the standard contractual clauses approved by the European Commission, or on the processor's certification under the EU-US Data Privacy Framework.

In Google Analytics 4 we keep the features that would link data to advertising profiles switched off, and measurement only starts once you have given consent.

7. Cookies and traffic measurement

Until you give consent, no analytics files are written to your browser. A full list of every file we use, its purpose and its retention period is in the separate Cookie policy, linked from the footer of every page.

8. Your rights

You have the following rights in relation to your personal data. You can exercise any of them by writing to info@novostavby-manelovice.cz; we will reply within one month at the latest.

• Right of access: you may ask what data we hold about you and receive a copy of it.
• Right to rectification: if the data is inaccurate or incomplete, we will correct it.
• Right to erasure: in the cases listed in Art. 17 GDPR we will delete the data, unless the law requires us to keep it.
• Right to restriction of processing under Art. 18 GDPR.
• Right to data portability: data we process on the basis of consent or a contract will be provided in a machine readable format.
• Right to object to processing based on legitimate interest under Art. 21 GDPR.
• Right to withdraw consent: for analytics, simply open Cookie settings in the footer. Withdrawal does not affect the lawfulness of processing carried out beforehand.
• Right to lodge a complaint with the supervisory authority, which is the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

9. Automated decision making and profiling

We do not carry out automated decision making or profiling that would have legal effects for you or similarly significantly affect you.

10. Security

The site is served exclusively over an encrypted HTTPS connection. Access to form messages is limited to the people who need it to handle the enquiry. We have organisational and technical measures in place to keep the data away from anyone unauthorised.

11. Changes to this document

We may amend this text if the way we process data changes or if the law changes. The current version always lives at this address and its effective date is shown at the top.