Privacy and cookie policy

This is an English translation. In case of any discrepancy, the Slovak version prevails.

1. Controller

Flowcraft s.r.o. (Flowgarden brand), registered office Doležalova 3424/15C, 821 04 Bratislava – Ružinov, Slovakia, operations Kasárenská 5, 911 05 Trenčín, Slovakia, company ID: 52104184, registered in the Commercial Register, section: Sro, file no. 37469/R.

For any data protection matters, contact us at info@flowgarden.sk or by phone at +421 908 818 794.

Purchases in the flowgardenshop.sk online shop are governed by the privacy policy published there.

2. What data we process, why and for how long

Enquiry via the website form

The Request a quote and I need advice forms on the Price quotes page.

Data: name, e-mail, phone, project location, selected products, dimensions and quantities, type of space, expected timing, when we may call you, note, photos (up to 4), time of consent, website language.
Purpose: to reply to you, advise you and prepare a price quote.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). By ticking the box in the form you confirm that you agree to this processing; we store the time of this consent.
Retention: if no order follows, we delete the data and photos within 3 months of the last communication. If an order follows, the next point applies.

Enquiry by e-mail or phone

Data: name, e-mail, phone, project location, dimensions, message content, attachments.
Purpose and legal basis: the same as for the form.
Retention: if no order follows, 3 months from the last communication.

Performance of the contract

Measuring, production, installation, complaints.

Data: identification and contact details, installation address, order details.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention: for the duration of the contract and the warranty period, then as set out in the next point.

Accounting and taxes

Data: details on invoices and accounting documents.
Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Retention: 10 years under Act No. 431/2002 Coll. on Accounting.

Website operation and security

Data: IP address, browser and device information in the hosting provider's technical logs; when a form is submitted, also the data assessed by the Cloudflare Turnstile bot protection.
Purpose: secure operation of the website, protection of the forms against bots and abuse.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Retention: short-term, according to the settings of the hosting and bot protection providers.

Providing your data is voluntary. Without contact details and dimensions, however, we cannot prepare a price quote.

3. Who we share data with

Vercel Inc. (USA) — website hosting, technical logs,
Supabase (data centre in Frankfurt, EU) — storage of form enquiries and attached photos,
Cloudflare, Inc. (USA) — bot protection for the forms (Turnstile),
providers of e-mail and accounting services who process data for us under a contract,
installation partners and carriers to the extent necessary to deliver and install the order,
public authorities where required by law.

4. Transfers to third countries

When using the services of Vercel Inc. and Cloudflare, Inc., data may be transferred to the USA. The transfer is based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses under Art. 46(2)(c) GDPR.

5. Cookies

The website uses only one technical cookie, which is necessary for it to work and does not require consent:

NEXT_LOCALE — provider: this website; purpose: remembering the selected language; expiry: when the browser is closed.

We do not use analytics or marketing cookies, and we do not use advertising pixels. The Cloudflare Turnstile form protection runs only on the page with the form and serves solely to tell humans from bots.

You can delete or block cookies at any time in your browser settings.

6. Your rights

You have the right:

of access to your data (Art. 15 GDPR),
to rectification (Art. 16),
to erasure (Art. 17),
to restriction of processing (Art. 18),
to data portability (Art. 20),
to object to processing based on legitimate interest (Art. 21),
to withdraw consent where processing is based on consent; withdrawal does not affect the lawfulness of processing before it.

Send your request to info@flowgarden.sk or to the address of our registered office or operations. We will reply within one month.

7. Complaints

If you believe that we process your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk, or with the data protection authority in the EU country where you live.

8. Effective date

This policy is effective from 15. 10. 2026.