Privacy policy

Principles of personal data processing and data protection under the GDPR

This is an English translation for your convenience. The Slovak version is legally binding.

The controller of your personal data under Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) is TIMBER WOOD SK s.r.o., Podrečany 228, 985 54 Podrečany, Company ID (IČO): 45246980.

Controller contact details

Phone: +421 905 233 332

E-mail: info@timberwoodsk.com

(the “Controller”)

What is personal data?

Personal data is any information relating to an identified or identifiable natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

What is processing of personal data?

Processing means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure, whether or not by automated means.

The Controller is not required to appoint a data protection officer.

Sources and categories of personal data

The Controller processes personal data that you have provided directly, or that it obtained while fulfilling your order.

Your identification and contact details and data necessary for the performance of a contract.

Timber reservations on the website

When you send a reservation from your list on the website, we process:

• your name or company name,
• your phone number,
• your e-mail address, if you provide it (optional),
• the content of the reservation (product, dimensions, number of pieces, volume, price), whether you are interested in delivery, and the language of the page you sent it from.

Purpose: handling the reservation, confirming dimensions, price and pickup date by phone, preparing the goods and, on request, pricing delivery. Legal basis: steps taken at your request prior to entering into a contract, and performance of a contract, Article 6(1)(b) GDPR.

If you provide an e-mail address, we send you an automatic confirmation with a summary of the reservation. We will not send advertising to this address.

Contact form

When you send an enquiry through the contact form, we process your name or company name, phone number, e-mail (if provided), enquiry type and message. Purpose: replying to your enquiry and preparing an offer. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

Data stored in your browser and cookies

So that you don’t lose your list when moving between pages or closing the window, the website stores its content only in your browser (local storage). It also stores your cookie settings choice. This data is not sent to us until you send a reservation yourself, and you can delete it at any time in your browser settings. This storage is necessary for the website to work and does not require consent.

The website uses no advertising or analytics cookies and does not track your behaviour.

On the Contact page we can show a Google Maps map provided by Google Ireland Limited. We load the map only with your consent. When it loads, your IP address and technical browser data are sent to Google, which may set its own cookies. More information is available in Google’s privacy policy. You can change or withdraw your consent at any time via the “Cookie settings” link in the page footer.

Legal basis and purpose of processing

The legal basis for processing is:

• performance of a contract between you and the Controller, Article 6(1)(b) GDPR,
• the Controller’s legitimate interest in direct marketing, Article 6(1)(f) GDPR,
• your consent to processing for direct marketing, Article 6(1)(a) GDPR.

The purpose of processing is:

• Handling your order and exercising the rights and obligations arising from the contractual relationship between you and the Controller. An order requires the personal data necessary to handle it (name, phone, where applicable e-mail and address) under Article 6(1)(b) of the Regulation (including subsequent payment, delivery of goods or services, handling of complaints, etc.). Customer data is processed for the performance of a contract without the customer’s consent, as the legal basis is the specific contract between the customer and the Controller. Providing personal data is a requirement for concluding and performing the contract; without it the contract cannot be concluded or performed by the Controller.
• Sending marketing offers and other marketing activities.

The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

Retention period

The Controller keeps personal data:

• for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the Controller and to assert claims arising from it,
• until consent to processing for marketing purposes is withdrawn,
• reservations and enquiries from the website that do not result in an order are deleted no later than 12 months after receipt; data relating to completed orders is kept for the period required by accounting and archiving regulations,
• after the retention period under Act No. 395/2002 Coll. on archives and registries, the Controller deletes the personal data.

Recipients of personal data

Who is a recipient?

A recipient is anyone to whom personal data is disclosed, whether a third party or not. A public authority processing personal data under a specific law is not considered a recipient.

We disclose personal data only to the extent necessary:

• to persons involved in delivering goods and services and processing payments under the contract,
• to the website hosting provider (Railway Corporation), on whose servers the website runs and submitted reservations and enquiries are stored,
• to the e-mail service provider (Resend), which delivers confirmation e-mails and notifications of new reservations.

These providers process data as processors, only on our instructions and under a data processing agreement.

Transfers to third countries

Website data is stored on servers in the European Union. The hosting and e-mail providers are companies based in the USA. If your data were accessed from the USA, this would take place on the basis of standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework.

Security of personal data

The Controller declares that it has adopted appropriate personnel, technical and organisational measures to protect personal data.

The Controller has adopted technical measures to secure data storage and paper records containing personal data.

The Controller declares that only persons authorised by it have access to personal data.

Your rights

Under the conditions set out in the GDPR, you have:

• the right of access to your personal data, Article 15 GDPR,
• the right to rectification, Article 16 GDPR,
• the right to restriction of processing, Article 18 GDPR,
• the right to erasure, Article 17 GDPR,
• the right to object, Article 21 GDPR,
• the right to data portability, Article 20 GDPR,
• the right to withdraw consent (electronically or by post),
• the right to lodge a complaint with the data protection authority if you believe your data protection rights have been infringed.

How to exercise your rights

Right of access

You have the right to know whether we process your personal data. If we do, you can ask us for access to it. On request we will issue a confirmation with information about the processing of your personal data. You can send your request electronically to info@timberwoodsk.com or by post to: TIMBER WOOD SK s.r.o., Podrečany 228, 985 54 Podrečany, Slovakia.

Right to rectification

You have the right for the personal data we process to be accurate, complete and up to date. If your personal data is inaccurate or out of date, you can ask us to correct or complete it electronically at info@timberwoodsk.com or by post to: TIMBER WOOD SK s.r.o., Podrečany 228, 985 54 Podrečany, Slovakia.

Right to erasure

In certain circumstances you have the right to have your personal data erased. You can ask us to erase your data at any time. We will erase your personal data if:

• we no longer need it for the purpose for which you provided it,
• you withdraw your consent,
• you object to the processing of your personal data,
• we process your personal data unlawfully,
• the personal data must be erased to comply with a legal obligation,
• you are a child, or the parent of a child, who consented to the processing of personal data online.

Right to restriction of processing

You can ask us to restrict the processing of your personal data. If we grant your request, we will only store your personal data and not otherwise use it. Processing will be restricted if:

• you tell us your personal data is inaccurate, until we verify its accuracy,
• we process your personal data unlawfully, but you oppose erasure and ask us only to restrict processing instead,
• we no longer need your data, but you need it to establish, exercise or defend legal claims,
• you object to the processing of your personal data, until we verify whether our legitimate interests override your grounds.

Right to data portability

You have the right to ask us to provide your personal data in electronic form (e.g. an XML or CSV file) that allows you to transfer it easily to another company. You can also ask us to transfer your personal data directly to a company of your choice. We will comply if you provided the personal data to us yourself and consented to its processing.

Right to object

You have the right to object to our processing of your personal data. If we process your personal data:

• on the basis of our legitimate interest,
• for customer profiling,
• you can object to the processing on grounds relating to your particular situation.

How can you exercise these rights?

You can contact us with your request in any of these ways:

in writing by e-mail: info@timberwoodsk.com, or by post to: TIMBER WOOD SK s.r.o., Podrečany 228, 985 54 Podrečany, Slovakia.

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR):

Galvaniho Business Centrum II, Galvaniho 7/B

821 04 Bratislava

Slovak Republic

Identification:

Company ID (IČO): 36 064 220

Tax ID (DIČ): 2021685985

Secretariat and filing office:

+421 2 32 31 32 14, +421 2 32 31 32 49

E-mail: statny.dozor@pdp.gov.sk

Filing office: Monday – Thursday 8:00 – 15:00, Friday 8:00 – 12:00

Current contact details of the authority are available at dataprotection.gov.sk.

Last updated: 8 October 2026