Skip to content
Zapolu

Privacy Policy

Last updated: August 4, 2026

Who we are

The controller of your personal data is Zapolu s.r.o. (the “Company”), registered in the Czech Republic, IČO 24968757, with its seat at Chudenická 1059/30, Hostivař, 102 00 Praha. If you have any questions about this policy or want to exercise your rights, contact us at info@zapolu.com.

What data we collect

We collect only what we need:

  • Contact form submissions. When you send us a message, we receive your name and email address, and, if you choose to provide them, your website address, your platform, and the contents of your message. We process this to respond to your enquiry and pursue a possible business relationship, on the legal basis of our legitimate interest (GDPR Art. 6(1)(f)). Where your enquiry is a step toward entering a contract with us, we also rely on Art. 6(1)(b).
  • Technical data and IP address. When you submit the form, our server processes the IP address of your request to rate-limit submissions and prevent abuse, on the legal basis of our legitimate interest in the security of the service (GDPR Art. 6(1)(f)). The IP address appears in short-lived server logs and is shared with Cloudflare as part of the anti-bot check.
  • Anti-bot challenge. We use Cloudflare Turnstile to filter spam. It does not set tracking cookies and does not track you across sites.
  • Analytics. We use Cloudflare Web Analytics, which is cookieless and produces only aggregated statistics. It does not identify you individually. Because it sets no cookies and stores no personal data on your device, no consent banner is used.
  • Aggregate conversion counts. We keep a running count of two actions: submissions of the contact form and downloads of our sample documents. We record only the type of action, the page language, the country, and, if you opened the site through a link we shared (for example on social media), which platform that link was posted on. This involves no cookies, no IP address, and nothing that identifies you.
  • Google advertising tag. We advertise on Google, and Google requires its advertising tag on the site it sends traffic to. We run it in the most restrictive configuration Google offers: every consent category is set to denied and ad-click identifiers are redacted, so the tag stores nothing on your device, reads no advertising identifier, and cannot recognize you on any other website. Google still receives a request carrying the address of the page you are on, your browser type, and your IP address, which every web request discloses. We process this on the legal basis of our legitimate interest in knowing whether our advertising reaches anyone (GDPR Art. 6(1)(f)).

What we do not do

  • We do not use Google Analytics or Meta pixels, and nothing on this site recognizes you when you visit another website.
  • We do not set advertising or marketing cookies.
  • We do not build advertising audiences, run remarketing, or let Google personalize advertising with anything this site sends.
  • We do not sell your data, and we do not share it with third parties for their own purposes.
  • We do not carry out automated decision-making or profiling that produces legal or similarly significant effects (GDPR Art. 22).

Cookies

This site does not use cookies for analytics or marketing. The Google advertising tag runs with storage denied, so it sets none either, and that is why you are not asked to accept anything. Our hosting provider (Cloudflare) may set strictly necessary cookies for security and network purposes; under the ePrivacy rules these do not require consent.

Where your data is processed

Some of our providers process data outside the European Economic Area or on global infrastructure. Formspree, which delivers contact form messages, hosts its service on Amazon Web Services in the United States and relies on the European Commission’s Standard Contractual Clauses as its transfer safeguard. Cloudflare, which provides hosting, anti-bot protection, and analytics, relies on the Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework. Google, which receives the advertising tag’s requests, relies on the Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework. All three give effect to the safeguards required by Chapter V of the GDPR. You can ask us for more detail using the contact address above.

How long we keep your data

  • Contact form submissions are retained for 24 months from the date of receipt, then deleted, unless resolving your enquiry or an ongoing business relationship requires longer retention.
  • Server logs, including the IP address, are kept only as long as needed to detect and prevent abuse, and are then deleted.
  • Anti-bot challenge results are processed by Cloudflare in real time and not retained by us.

Your rights

Under the GDPR, you have the right to:

  • Access the data we hold about you
  • Request correction or erasure
  • Request restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing based on our legitimate interest (Art. 21)
  • Lodge a complaint with a supervisory authority: in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or the authority in your own country of residence

Because we do not rely on your consent for any of the processing described here, there is no consent for you to withdraw. To exercise any of these rights, email info@zapolu.com.

Service providers

We rely on the following third-party services. Each handles your data under its own privacy policy:

  • Cloudflare (hosting, Turnstile anti-bot, cookieless web analytics): Privacy Policy
  • Formspree (contact form delivery, United States): Privacy Policy
  • Google (advertising tag, run without cookies or advertising identifiers): Privacy Policy

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page indicates when the most recent changes were made.