Privacy policy

Effective October 6, 2026

1. Data controller

The controller of your personal data, i.e., the party that determines the purposes and means of its processing and is responsible for it, is the operator of the truhlarna.com website:

Controller: Truhlárna, s.r.o.
Company ID: 03359841
VAT ID: CZ03359841
Registered office: Pod Horou 410, 252 45 Březová-Oleško, Czech Republic
Registration: Commercial Register, Municipal Court in Prague, Section C, Insert 229821
Email: petr.silhanek@truhlarna.com
Phone: 602 211 496
Website: www.truhlarna.com

Given the nature and scope of the processing, the controller is not required to appoint a data protection officer and has not appointed one. You can contact us at any time, using the contact details above, about any matter related to the processing of your personal data.

2. What personal data is

Personal data is any information that can be used to identify you directly or indirectly, such as your name, phone number, email address, home address or IP address. Processing means any operation performed on such data, for example collecting it, storing it, using it to handle an inquiry or erasing it.

On the truhlarna.com website we do not process any special categories of personal data (sensitive data, such as data about health or religion) and we do not knowingly process the data of anyone under the age of 16.

3. What personal data we process

We process only the data you provide to us yourself (mainly through the inquiry form, by phone or by email) and the technical data generated when you visit the website:

Data you provide to us

Identification and contact data: first and last name, phone number, email address.
Data about your planned project: a description of the space and your ideas, dimensions, photos or plans, the installation address, your preferred date and the content of your message.
Communication data: the content and history of your phone, email or other communication with us.
Contract and billing data (if you place an order): billing address, company ID and VAT ID for businesses, and the project and payment details required to issue a tax invoice.

Data collected automatically

Technical data: IP address, browser type and version, device and operating system, time and number of visits to the website, data about how you use the website, and cookies (see Article 8).

4. Purposes and legal bases of processing

We process your data only for clearly defined purposes and always on one of the legal bases set out in Article 6 of the GDPR:

Purpose	Legal basis	Retention period
Handling a non-binding inquirycontacting the prospective customer, consultation, design and quote	steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR)	until the inquiry is resolved; if no order is placed, no more than 12 months
Conclusion and performance of a contractmeasurement, design, production and installation of furniture, warranty and claims	performance of a contract (Art. 6(1)(b) GDPR)	for the duration of the contract and the warranty period
Compliance with legal obligationsaccounting, taxes, archiving of documents	compliance with a legal obligation (Art. 6(1)(c) GDPR)	for the period required by law (tax and accounting documents generally 10 years)
Protection of legitimate interestskeeping records of business dealings, protection of legal claims	legitimate interest of the controller (Art. 6(1)(f) GDPR)	for the duration of the legitimate interest, generally the limitation period for claims
Sending commercial communicationsadvice, tips and offers for related services	legitimate interest for existing customers, otherwise your consent (Art. 6(1)(a)/(f) GDPR)	until consent is withdrawn or an objection is raised
Operation and security of the websitenecessary (technical) cookies	legitimate interest of the controller (Art. 6(1)(f) GDPR)	for the lifetime of the cookie in question (generally until the end of the visit)
Analytics and marketinganalytics and marketing cookies, remarketing	your consent (Art. 6(1)(a) GDPR)	until consent is withdrawn, but no longer than the lifetime of the cookie in question

Providing your data is voluntary. However, without contact details and basic information about your ideas, we cannot prepare a design or a quote for you. We are required by law to process the data needed to comply with legal obligations (for example, on a tax invoice).

5. How long we keep your data

We keep personal data only for as long as is strictly necessary to fulfill the purposes set out above, or for the period required by law. The specific periods are listed in the table in Article 4. Once the relevant period has expired, we securely erase or anonymize the data so that it can no longer be used to identify anyone.

6. Recipients and processors of personal data

We do not sell your data. Our contracted processors and suppliers who help us provide our services may access some data to the extent necessary:

web hosting and server infrastructure provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA,
email and communication services provider,
marketing services and website administration provider,
advertising and analytics services providers: Google (Alphabet Inc.), Meta Platforms, Inc. and Seznam.cz, a.s., Company ID 26168685,
accountant or tax advisor,
partners and suppliers involved in carrying out the project (for example transport and installation), solely to the extent necessary for the task in question,
public authorities where required by law.

We have entered into a data processing agreement under Article 28 of the GDPR with every processor that processes personal data on our behalf, guaranteeing the same level of protection.

7. Transfers to third countries

We generally process your personal data within the European Union or the European Economic Area. Some of the tools we use (for example services provided by Vercel, Google and Meta) may also transfer data to the USA. Such transfers take place only under the conditions set out in the GDPR, on the basis of an adequacy decision (EU-U.S. Data Privacy Framework) or under standard contractual clauses approved by the European Commission.

8. Cookies and analytics tools

Cookies are small text files stored in your browser when you visit a website. They help the site work properly and help us understand how the site is used. We use the following categories:

Necessary (technical) cookies: needed for the basic functionality and security of the website and to store your cookie choice. They are stored on the basis of legitimate interest and cannot be turned off.
Analytics cookies: help us measure traffic and improve the website (Google Analytics). They are stored only with your consent.
Marketing cookies: enable targeting, remarketing and ad measurement (Google Ads, Meta Pixel, Sklik). They are stored only with your consent.

We run measurement tools through Google Tag Manager in Consent Mode: until you give consent, no analytics or advertising cookies are stored. Consent is voluntary and you can change or withdraw it at any time in the cookie settings (the link is also in the website footer). You can also manage or completely block cookies in your browser settings. Blocking cookies entirely may limit some features of the website.

9. Your rights

In connection with the processing of your personal data, you have the following rights under the GDPR:

Right of access: to know whether we process data about you and which data, and to obtain a copy of it.
Right to rectification: to have inaccurate data corrected or incomplete data completed.
Right to erasure (“right to be forgotten”): to have data erased where the reason for processing no longer applies and no legal obligation prevents it.
Right to restriction of processing: in the cases provided for by law.
Right to data portability: to receive your data in a machine-readable format or have it transferred to another controller.
Right to object: to processing based on legitimate interest, in particular to direct marketing.
Right to withdraw consent: where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making: see Article 12.
Right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.

10. How to exercise your rights

You can exercise any of the rights above by email at petr.silhanek@truhlarna.com or in writing to the controller’s registered office. We will handle your request without undue delay and no later than one month after receiving it. To protect your data, we may ask you to verify your identity if we have reasonable doubts about who is making the request.

11. Security of personal data

We have adopted appropriate technical and organizational measures to protect your data against unauthorized access, loss, misuse or destruction, such as secure data transfer (encrypted connection), restricting access to authorized persons only and contractual obligations of our processors. Only the controller and persons authorized by the controller, who are bound by confidentiality, have access to the data.

12. Automated decision-making and profiling

When processing your personal data, no automated decision-making or profiling takes place that would produce legal effects concerning you or similarly significantly affect you.

13. Changes to this policy

We may update this policy from time to time, for example when legislation or the scope of our services changes. The current version is always available on this page with the date of the last update. This version is effective as of October 6, 2026.