Privacy policy

The controller responsible for the processing of personal data within the meaning of Regulation (EU) 2016/⁠679 (General Data Protection Regulation, “GDPR”) is:

AGRO Stefanos s.r.o.
Ledečská 2917
580 01 Havlíčkův Brod
Czech Republic
Company ID (IČO): 09611487
Managing director (jednatel): Stefanos Ntakoulas

Phone: +49 155 10516535
E-⁠mail: stefanosdakulas@gmail.com

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions about data protection, please contact us directly using the details above.

• We do not use cookies for analytics, advertising or tracking purposes, and we use no analytics or tracking tools, no social media plugins and no embedded third-party content.
• If you choose a language, your browser remembers this choice locally for your next visit; it is not transmitted to us.
• Fonts are part of our website (nothing is loaded from Google Fonts or other providers); the map is a static graphic.
• The inquiry form does not send any data to us or to any server. It merely prepares a message in your WhatsApp or e-⁠mail app – whether you send it is up to you.
• When you visit the website, our hosting provider Cloudflare processes technically necessary connection data (e.g. your IP address).
• If you contact us, we use your details solely to handle your inquiry and to prepare and carry out business transactions.

Our website is delivered via the Cloudflare Workers service. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare operates a global server network (content delivery network), usually delivers the website from the data centre closest to you and protects it against attacks and misuse. The website is transmitted in encrypted form via HTTPS (TLS).

Each time the website is accessed, Cloudflare automatically processes data transmitted by your browser, in particular:

• IP address,
• date and time of access,
• page or file requested (URL),
• the previously visited page (referrer), if transmitted by your browser,
• browser type and version, and operating system (user agent),
• technical connection data such as status code and amount of data transferred.

This data is technically necessary to display the website to you and to ensure its stability and security, in particular to defend against attacks (e.g. DDoS) and misuse. The legal basis is our legitimate interest in providing our website securely, reliably and quickly (Art. 6(1)⁠(f) GDPR). We do not combine this data with other data sources and do not create profiles.

Cloudflare processes this data as our processor on the basis of a data processing agreement (Data Processing Addendum) pursuant to Art. 28 GDPR. Cloudflare stores the log data only for a short period, as far as necessary for the purposes mentioned, and then deletes it. In our Cloudflare account, we ourselves only see aggregated statistics (e.g. number of requests, countries of origin) and, for a short time, individual security events (e.g. blocked requests). We use this information solely to ensure the security and proper functioning of the website, not to identify visitors.

Cloudflare may also process data outside the EU, in particular in the USA (see “Transfers to third countries”). Further information can be found in Cloudflare’s privacy policy: www.cloudflare.com/⁠privacypolicy.

Inquiry form: Our inquiry form works entirely within your browser. The website does not transmit your entries to us or to any server. When you click the corresponding button, your WhatsApp app or your e-⁠mail program opens with a pre-filled message. We only receive your details once you send this message yourself. If you choose WhatsApp, the prepared text is passed to WhatsApp as part of the link (wa.me) so that the message can be displayed in the app or in WhatsApp Web; from that point on, WhatsApp’s privacy policy applies (see below).

Contact by phone, e-⁠mail or WhatsApp: If you call us or write to us by e-⁠mail or WhatsApp, we process the information you provide in order to handle your inquiry and answer any follow-up questions. This includes, for example, your name, company, phone number, e-⁠mail address and the content of your inquiry (such as type and number of animals, location and timing; for drivers, e.g. information on driving experience and insurance).

The legal basis is Art. 6(1)⁠(b) GDPR where your inquiry is aimed at concluding or performing a contract with you (e.g. the purchase, sale or transport of animals, or working with us as a driver). We process inquiries that you send as a representative or employee of a company, as well as other inquiries, on the basis of our legitimate interest in responding to inquiries and maintaining our business relationships (Art. 6(1)⁠(f) GDPR).

We use the Gmail service for our e-⁠mail communication. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). E-⁠mails you send us and our replies, including the associated metadata (e.g. sender, recipient, time), are stored on Google’s servers, which may also be located outside the EU, in particular in the USA.

Our use of Gmail is based on our legitimate interest in reliable and efficient e-⁠mail communication (Art. 6(1)⁠(f) GDPR). E-⁠mails are usually transmitted with transport encryption (TLS), provided the sender’s provider also supports it; however, they are not end-to-end encrypted. Information on how Google processes data can be found in Google’s privacy policy: policies.google.com/⁠privacy.

If you contact us via WhatsApp (including via our inquiry form), the communication takes place via the WhatsApp messaging service. The provider in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“WhatsApp”), a Meta company.

Messages and calls via WhatsApp are end-to-end encrypted; WhatsApp cannot read their content. However, WhatsApp processes communication data (metadata) such as phone numbers, profile information and the time of communication, and transfers data to WhatsApp LLC and Meta Platforms, Inc. in the USA.

Insofar as WhatsApp processes data on our behalf within the scope of WhatsApp Business, it does so as our processor on the basis of the WhatsApp Business Data Processing Terms (Art. 28 GDPR); otherwise, WhatsApp processes data under its own responsibility in accordance with its privacy policy: www.whatsapp.com/⁠legal/⁠privacy-policy-eea.

Using WhatsApp is voluntary. The legal basis is Art. 6(1)⁠(b) or (f) GDPR (see above); our legitimate interest lies in offering you a fast and convenient means of communication. If you prefer not to use WhatsApp, you can reach us by phone or e-⁠mail at any time.

Our website itself does not set any cookies and does not use comparable technologies to recognise you or track your behaviour; at most, your browser stores the language you have chosen (see below). We use no web analytics or tracking services (e.g. Google Analytics), no advertising or remarketing services and no social media plugins. That is why you will not see a cookie banner on our website.

Your language choice: When you choose a language in the language selector, your browser stores this choice locally (Web Storage “localStorage”, entry “lang”, e.g. “en”), so that the home page agro-stefanos.com opens in this language on your next visit. This information is not transmitted to us and is not combined with any other data; you can delete it at any time in your browser settings (site data). Storing it is strictly necessary for this function, which you have requested (Art. 5(3) of Directive 2002/⁠58/⁠EC).

Only the protection systems of our hosting provider Cloudflare may set technically necessary security cookies, for example after a successfully completed security check (“cf_clearance”) or to detect automated access (“__cf_bm”). These cookies serve exclusively to protect the website and are not used for analytics or advertising; as they are strictly necessary for secure operation, no consent is required. The legal basis for the associated data processing is Art. 6(1)⁠(f) GDPR.

Fonts: The fonts used are part of our website and are delivered together with it. No connection is made to Google Fonts servers or to other font providers.

Map: The map on our website is a static graphic. No map services such as Google Maps are embedded.

No external embeds: We do not embed videos, social media posts or any other third-party content.

Links to other websites: Our website contains links to external services (e.g. WhatsApp). Data is only transmitted to the respective provider when you click on such a link; that provider is responsible for any processing on its side.

Within our company, only those persons who need your data to handle your request have access to it. Beyond that, data may be disclosed – in each case only to the extent necessary – to the following recipients:

• technical service providers we use to operate the website and for our communication (Cloudflare, Google, WhatsApp; see above);
• parties involved in carrying out a transaction, e.g. our contractual partners on the buyer or seller side, veterinarians, transport companies and drivers;
• banks for processing payments;
• competent authorities where we are legally obliged to do so (e.g. veterinary, customs or tax authorities);
• external advisers, e.g. tax advisers, accountants or lawyers.

We do not sell your data and do not pass it on to third parties for advertising purposes.

Some of the service providers mentioned also process data outside the European Union and the European Economic Area, in particular in the USA (Cloudflare, Google, WhatsApp/⁠Meta). For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-⁠U.S. Data Privacy Framework (Art. 45 GDPR). Cloudflare, Inc., Google LLC and WhatsApp LLC are certified under this framework (list: www.dataprivacyframework.gov/⁠list). Where a transfer is not covered by this framework, the providers base it on the European Commission’s standard contractual clauses (Art. 46(2)⁠(c) GDPR).

If a transaction involves a country outside the EU/⁠EEA (e.g. Turkey), we transfer data there only to the extent necessary for the conclusion or performance of the contract (Art. 49(1)⁠(b) and (c) GDPR).

We store personal data only for as long as necessary for the respective purpose:

• Server log data at Cloudflare: only for a short period (see above).
• Inquiries that do not lead to a transaction or cooperation: until they have been fully dealt with and no follow-up questions are to be expected; we then delete them.
• Contact details of business partners: for the duration of the business relationship and beyond, as long as there is a legitimate interest in maintaining the contact and you have not objected.
• Contracts and business records relevant for accounting or tax purposes: for the statutory retention periods, in particular under Czech accounting and tax law (usually 5 to 10 years); the legal basis in this respect is Art. 6(1)⁠(c) GDPR.
• In addition, we store data where necessary for the establishment, exercise or defence of legal claims, at the latest until the statutory limitation periods have expired.

Under the GDPR, you have the following rights:

• right of access to the data we process about you (Art. 15 GDPR),
• right to rectification of inaccurate data (Art. 16 GDPR),
• right to erasure (“right to be forgotten”, Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to be informed about the recipients to whom a rectification, erasure or restriction has been communicated (Art. 19 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR, see below),
• where processing is based on your consent, the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, an informal message or call using the contact details above is sufficient. We will respond without undue delay and in any event within one month (Art. 12(3) GDPR). To prevent misuse, we may ask you to verify your identity.

Where we process your data on the basis of legitimate interests (Art. 6(1)⁠(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons.

You can object informally, e.g. by e-⁠mail to stefanosdakulas@gmail.com.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is the Czech data protection authority:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
Pplk. Sochora 727/⁠27, Holešovice
170 00 Praha 7
Czech Republic
Website: uoou.gov.cz
E-⁠mail: posta@uoou.gov.cz

An overview of the supervisory authorities in the other EU and EEA countries is available on the website of the European Data Protection Board: edpb.europa.eu.

Providing your data is voluntary; you are not obliged to provide us with personal data. However, without your contact details we cannot respond to your inquiry, and to conclude a contract we need the information required for it. Processing of the technically necessary connection data (see the section on hosting) is a prerequisite for displaying the website.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We will update this privacy policy if our website, the services we use or the legal situation change. The version published on this page applies.