Skip to content
Zapolu

Privacy Policy

Last updated: July 12, 2026

Who we are

The controller of your personal data is Zapolu s.r.o. (the “Company”), registered in the Czech Republic, IČO 24968757, with its seat at Chudenická 1059/30, Hostivař, 102 00 Praha. If you have any questions about this policy or want to exercise your rights, contact us at info@zapolu.com.

What data we collect

We collect only what we need:

  • Contact form submissions. When you send us a message, we receive your name and email address, and, if you choose to provide them, your website address, your platform, and the contents of your message. We process this to respond to your enquiry and pursue a possible business relationship, on the legal basis of our legitimate interest (GDPR Art. 6(1)(f)). Where your enquiry is a step toward entering a contract with us, we also rely on Art. 6(1)(b).
  • Technical data and IP address. When you submit the form, our server processes the IP address of your request to rate-limit submissions and prevent abuse, on the legal basis of our legitimate interest in the security of the service (GDPR Art. 6(1)(f)). The IP address appears in short-lived server logs and is shared with Cloudflare as part of the anti-bot check.
  • Anti-bot challenge. We use Cloudflare Turnstile to filter spam. It does not set tracking cookies and does not track you across sites.
  • Analytics. We use Cloudflare Web Analytics, which is cookieless and produces only aggregated statistics. It does not identify you individually. Because it sets no cookies and stores no personal data on your device, no consent banner is used.
  • Aggregate conversion counts. We keep a running count of two actions: submissions of the contact form and downloads of our sample documents. We record only the type of action, the page language, and the country. This involves no cookies, no IP address, and nothing that identifies you.

What we don’t do

  • We do not use Google Analytics, Meta pixels, or any other cross-site tracker.
  • We do not set advertising or marketing cookies.
  • We do not sell your data, and we do not share it with third parties for their own purposes.
  • We do not carry out automated decision-making or profiling that produces legal or similarly significant effects (GDPR Art. 22).

Cookies

This site does not use cookies for analytics or marketing. Our hosting provider (Cloudflare) may set strictly necessary cookies for security and network purposes; under the ePrivacy rules these do not require consent.

Where your data is processed

Some of our providers process data outside the European Economic Area or on global infrastructure. Formspree, which delivers contact form messages, hosts its service on Amazon Web Services in the United States and relies on the European Commission’s Standard Contractual Clauses as its transfer safeguard. Cloudflare, which provides hosting, anti-bot protection, and analytics, relies on the Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework. Both give effect to the safeguards required by Chapter V of the GDPR. You can ask us for more detail using the contact address above.

How long we keep your data

  • Contact form submissions are retained for 24 months from the date of receipt, then deleted, unless resolving your enquiry or an ongoing business relationship requires longer retention.
  • Server logs, including the IP address, are kept only as long as needed to detect and prevent abuse, and are then deleted.
  • Anti-bot challenge results are processed by Cloudflare in real time and not retained by us.

Your rights

Under the GDPR, you have the right to:

  • Access the data we hold about you
  • Request correction or erasure
  • Request restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing based on our legitimate interest (Art. 21)
  • Lodge a complaint with a supervisory authority: in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or the authority in your own country of residence

Because we do not rely on your consent for any of the processing described here, there is no consent for you to withdraw. To exercise any of these rights, email info@zapolu.com.

Service providers

We rely on the following third-party services. Each handles your data under its own privacy policy:

  • Cloudflare (hosting, Turnstile anti-bot, cookieless web analytics): Privacy Policy
  • Formspree (contact form delivery, United States): Privacy Policy

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page indicates when the most recent changes were made.