GDPR
Privacy Policy
The hobbyroof.co.uk website, enquiries and retailer finder
Effective 9 September 2026
In brief: hobbyroof.co.uk is an information catalogue, not an online shop. We process personal data mainly to operate the Website securely, deal with enquiries by email or telephone, refer users to a suitable retail partner and – only after consent – measure Website use.
1. Data Controller
The controller of personal data for the purposes of the GDPR is:
Hobby Roof CZ s.r.o.
Company identification number (VAT): CZ29287863
Registered office: Pod Rénou 1609/1, 664 91 Ivančice, Czech Republic
registered in the Commercial Register maintained by the Krajský soud v Brně (Regional Court in Brno), Section C, File No. 71095
Questions and requests concerning personal data may be sent to info@hobbyroof.cz or raised by telephone on +420 702 164 837. The Controller has not appointed a data protection officer.
2. Who this Notice covers and the data concerned
This Notice provides the information required by Articles 13 and 14 GDPR to Website visitors, people who contact the Controller, contacts at retail partners and people whose data may appear in photographs, drawings or other materials submitted with an enquiry.
- identity and contact data, particularly name, email address, telephone number, company and job title;
- the enquiry and related materials, such as measurements, project description, photographs, drawings and correspondence history;
- technical and usage data, particularly IP address, date and time, requested URL, referring page, browser and device type;
- cookie choices and, after consent, online identifiers and information about use of the Website;
- business contact details of retail partners and outlets published in the retailer finder.
Please do not send sensitive data unless it is necessary. The Controller does not require health data or other special categories of personal data for ordinary enquiries. Provide only the materials needed to deal with your enquiry and remove unnecessary third-party data before sending them.
3. Processing overview
The processing depends on how you use the Website. The Controller applies data minimisation and keeps personal data only for as long as needed for the purposes below.
| Activity | Purpose and personal data | Legal basis and retention |
|---|---|---|
| Website operation and security | Delivering pages, protecting infrastructure, diagnosing errors and preventing misuse. Mainly IP address, request time, requested URL, technical browser data and server logs. | Legitimate interests under Article 6(1)(f) GDPR. Logs are normally kept for no more than 30 days; longer only for a security incident, dispute or legal duty. |
| Email and telephone enquiries | Dealing with an enquiry, providing general technical information, documents or a retailer referral. Name, contact details, company, enquiry content, correspondence history and submitted materials. | Steps at your request before a contract under Article 6(1)(b) GDPR or legitimate interests under Article 6(1)(f). Normally 3 years after the enquiry is closed; longer for a subsequent contract, dispute or legal duty. |
| Referral to a partner | Connecting you with a suitable retailer. Only necessary contact details, enquiry content and project materials are disclosed, at your request or with your consent. | Article 6(1)(b) or (a) GDPR; legitimate interests may apply to business contacts. The record is retained with the enquiry. The partner then acts as an independent controller. |
| Retailer finder | Displaying and maintaining outlet information. Business contact details received from the partner or public professional sources. A routine location search does not in itself have to identify the user. | Legitimate interests under Article 6(1)(f) GDPR. For the period of the relationship or while the contact remains current; inaccurate data are corrected or removed without undue delay. |
| Analytics and cookie choice | Measuring visits and improving content. After consent, cookie identifiers, pages viewed, events, technical data and approximate location derived from the IP address may be processed. | Consent under Article 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll. Analytics cookies for up to 2 years and analytics data for up to 14 months, or until earlier withdrawal. |
| Rights requests and legal duties | Handling data subject requests, keeping proof of consent, defending rights and meeting duties to authorities. Requester identity, request, correspondence and necessary evidence. | Legal duty under Article 6(1)(c) and legitimate interests under Article 6(1)(f) GDPR. Normally 3 years after completion; longer for proceedings or statutory retention. |
4. Sources of data and whether you must provide it
We obtain data directly from you, automatically from your device when you use the Website and, for business contacts, from the retail partner or publicly available professional sources.
You do not need to provide your name or contact details merely to browse the Website. Technical data needed for transmission and security arise automatically. Analytics are optional. To deal with an enquiry, we need at least a way to contact you and enough information to understand the request; without it, we may be unable to reply or arrange a referral.
5. Cookies and similar technologies
Strictly necessary storage supports Website functions or remembers your consent choice. Analytics technologies may be activated only after prior, freely given and specific consent. Refusing analytics does not restrict the Website's basic functions.
| Technology | Provider | Purpose and maximum lifetime |
|---|---|---|
| Cookie preference record | HobbyRoof or the deployed consent management platform | Stores the selected preference and evidence of consent; normally no more than 12 months. |
| _ga | Google Analytics | Distinguishes the browser for statistical measurement; only after consent, up to 2 years. |
| _ga_* | Google Analytics | Maintains measurement and session state; only after consent, up to 2 years. |
You can withdraw consent at any time through the “Cookie settings” link in the Website footer. Withdrawal is not retrospective. You may also delete cookies in your browser; blocking strictly necessary technologies may affect how the Website works.
Google Analytics 4 and related analytics tags deployed through Google Tag Manager must load only after consent. The current names, purposes and lifetimes of individual cookies should also be shown in the cookie settings.
6. External services and maps
Google Analytics and Google Tag Manager. After consent, these services produce usage statistics. Google may process online identifiers, technical data and information about Website use. Further information is available in Google's Privacy Policy.
Google Fonts. The Website may load fonts from Google's servers. This sends standard connection data to Google, particularly the IP address and browser information. The legal basis is the legitimate interest in a consistent, readable presentation. To minimise transfers, the Controller should prefer serving fonts locally.
OpenStreetMap and Leaflet. The “Where to buy” page loads OpenStreetMap tiles and the Leaflet library through the external UNPKG CDN. These services receive standard connection data. The legal basis is the legitimate interest in displaying outlets. Further information is available in the OpenStreetMap Foundation Privacy Policy.
Google Maps and social networks. Navigation links and links to Facebook, Instagram or YouTube lead to separate services. Data are disclosed to the relevant provider only when you open the link; further processing is governed by that provider's own privacy information.
7. Recipients and processors
The following may receive access to personal data to the extent necessary:
- providers of hosting, Website administration, IT support, cyber security, email and telecommunications services;
- the selected retail partner where you request a referral or disclosure is needed to deal with your request;
- Google Ireland Limited and other Google group companies when analytics or externally loaded Google services are used;
- the OpenStreetMap Foundation, CDN operators and other providers of technical resources loaded by the Website;
- legal, accounting and other professional advisers and public authorities where required by law or to protect legal rights.
The Controller does not sell personal data. Processors may use data only on the Controller's instructions and under the relevant contract, unless they act as independent controllers.
8. Transfers outside the European Economic Area
Some providers, particularly Google group companies and operators of global infrastructure, may process data outside the European Economic Area. A transfer will be used only where an appropriate safeguard exists, such as a European Commission adequacy decision, the recipient's participation in a recognised data privacy framework or Standard Contractual Clauses.
The OpenStreetMap Foundation is established in the United Kingdom, for which the European Commission has adopted an adequacy decision. Details of transfers and safeguards are also governed by the relevant provider's documentation.
9. Your rights
Subject to the conditions in the GDPR, you have the right to:
- obtain confirmation whether we process your data and request access and a copy;
- ask us to correct inaccurate data or complete incomplete data;
- request erasure or restriction of processing where the legal conditions are met;
- receive data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;
- withdraw consent at any time without affecting the lawfulness of earlier processing;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- lodge a complaint with a data protection authority.
Objection to direct marketing: if the Controller uses personal data for direct marketing in the future, you may object at any time and that processing will stop.
We will respond without undue delay, normally within one month. For complex requests, this period may be extended by a further two months; we will inform you of the extension and reasons in time. If we have reasonable doubts about the requester's identity, we may ask for proportionate verification.
10. Data security
Taking account of the nature of the data and risks, the Controller uses appropriate technical and organisational measures, including access controls, protected transmission, system updates, backups and contractual oversight of suppliers.
No transmission or storage can be considered completely secure. If a personal data breach occurs, the Controller will assess the risks and comply with notification duties to the supervisory authority and affected people where required by the GDPR.
11. Automated decisions and marketing
The Controller does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Website statistics are not used for such decisions.
We do not use contact details from an enquiry for newsletters or other electronic marketing without a separate legal basis and compliance with the rules governing marketing communications.
12. Children's data and data about other people
The Website is not directed at children, and the Controller does not knowingly request children's data. Where appropriate having regard to age and the nature of the request, a minor should make an enquiry through a parent or guardian.
If you submit materials containing another person's data, you must be entitled to disclose them. Do not send third-party data that are not needed to deal with the enquiry.
13. Changes and language versions
We may reasonably update this Notice when the Website, services used or legal requirements change. The current version and its effective date will always be available on the Website.
The Czech, German and English versions are intended to convey the same information. If an interpretation differs, the Czech wording is the reference version; this does not limit rights granted by directly applicable or mandatory law.
14. Contact and supervisory authority
You may exercise your rights by emailing info@hobbyroof.cz or writing to the postal address above. You may lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic. Under Article 77 GDPR, you may also contact the authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
Legal framework: Regulation (EU) 2016/679 (GDPR)