Privacy policy

Data controller

The controller of personal data is OAZAPAP s.r.o., Vostrovská 792/35, 160 00 Prague 6, Company ID 09319620. You can send data protection requests by email to info@oazapap-servis.cz, through our contact form, by post to our registered office or to the company’s data box.

What data we process and why

From the request form we process your name, company, email, phone, building address and message — solely to handle your request and communicate with you. The legal basis is taking steps prior to entering into a contract, and your consent.

The form is sent via the Web3Forms service, which forwards the message to our email. We do not use the data for marketing, do not sell it and share it only with the processors listed below.

Recipients and processors

• Web3Forms (operated by Web3Creative): delivering form messages to our email. The operator works from India and uses Amazon Web Services, Cloudflare and Hetzner infrastructure; transfers outside the EEA rely on the Standard Contractual Clauses (SCC) in its data processing agreement.
• ACTIVE 24, s.r.o. (Prague): website hosting and its operating logs.
• Analytics and advertising tools (Google, Microsoft) only with your consent, see Cookies and analytics.

How long we keep the data

For the time needed to handle the request and for the duration of the contract. Unused requests are deleted within 12 months at the latest.

Your rights

• access to your data and a copy of it,
• correction and erasure,
• restriction of processing and objection,
• withdrawal of consent,
• lodging a complaint with the Office for Personal Data Protection.

Cookies and analytics

Without your consent, the website stores nothing on your device except the record of your choice in the cookie banner (localStorage, valid for 12 months) and contacts no analytics or advertising service. You give consent in the banner on your first visit and can change or withdraw it at any time with the Cookie settings button in the footer. When you withdraw consent, we delete these tools’ cookies stored on our domain (_ga, _ga_*, _clck, _clsk, _gcl_*); Google and Microsoft cookies on their own domains (google.com, doubleclick.net, clarity.ms, bing.com) can be deleted in your browser settings. The legal basis is your consent (Section 89(3) of Czech Act No. 127/2005 Coll. on Electronic Communications, and Art. 6(1)(a) GDPR).

Analytics

• Google Analytics 4 (Google Ireland Limited): website traffic and usage. Cookies _ga and _ga_*, valid for up to 2 years. We keep data in Google Analytics for 14 months.
• Microsoft Clarity (Microsoft Ireland Operations Limited): recordings of page interaction and heatmaps that show us what is unclear on the website. Clarity hides text typed into the form. Cookies _clck (1 year) and _clsk (1 day).
• Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore, i.e. outside the EU): aggregate website traffic and where visitors come from. It uses no cookies and stores nothing on your device. It is not run by Google Tag Manager but directly by the cookie banner, likewise only after you consent to analytics.

Marketing

• Google Ads (Google Ireland Limited): measuring which ads lead to an enquiry, and showing ads to people who have visited the website. Cookie _gcl_au (90 days) and Google cookies on the google.com and doubleclick.net domains.

These tools are run by Google Tag Manager (Google Ireland Limited), which loads only after you consent. Google and Microsoft may also process data in the USA; the transfer relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework), to which both companies have signed up.

On every visit, the hosting server records technical data (IP address, time, requested page) in its operating logs for security and troubleshooting. Data from the contact form is delivered by Web3Forms (see Recipients and processors).