In effect from: 17 August 2026
The data controller is rewater s.r.o., Company ID 08666130, registered office at třída Kpt. Jaroše 1929/10, Černá Pole, 602 00 Brno, Czech Republic, entered in the Commercial Register kept by the Regional Court in Brno, file C 114750 (“rewater” or “we”).
Data protection contact: Jan Krásný · privacy@rewater.eu · +420 722 400 400
This policy covers the rewater.eu website and any communication arising from it.
No data protection officer has been appointed. Processing personal data is not our core activity, we do not process special categories of data on a large scale and we carry out no large-scale systematic monitoring — so the conditions in Art. 37(1) GDPR are not met.
rewater supplies services and technical solutions to companies, the public sector and other organisations. Neither the website nor our offer is directed at consumers. The personal data we work with here is therefore usually the contact details of people acting for an organisation — name, job title, work e-mail and phone.
Such data is personal data too, and we protect it just like any other.
| Purpose | Legal basis | Categories of data | Retention period |
|---|---|---|---|
| Handling an enquiry and negotiating a contract (including the website form) | If you are a sole trader: steps prior to entering a contract — Art. 6(1)(b). If you act for an organisation: legitimate interest — Art. 6(1)(f); the interest is to handle the enquiry and negotiate with the organisation you represent | Organisation, company ID, name, job title, e-mail, phone, content of the enquiry | 3 years from the last contact |
| Performing the contract and delivering the project | Performance of a contract — Art. 6(1)(b); after it ends, legitimate interest — Art. 6(1)(f) | Contact details of people on the client's side, data about the building | For the term of the contract, then 3 years |
| Tax documents | Legal obligation — Art. 6(1)(c) | Billing details | 10 years from the end of the tax period in which the supply took place (Czech VAT Act, s. 35(2) of Act No 235/2004 Coll.) |
| Other accounting records | Legal obligation — Art. 6(1)(c) | Accounting documents and books | 5 years from the end of the accounting period (Czech Accounting Act, s. 31(2)(b) of Act No 563/1991 Coll.) |
| Defence of legal claims | Legitimate interest — Art. 6(1)(f) | Contract and communication history | 3 years from the end of the cooperation, extended by the duration of any proceedings |
| Follow-up offers to existing clients | Legitimate interest — Art. 6(1)(f); for e-mail, additionally the rules on unsolicited commercial communications (Art. 13 of Directive 2002/58/EC as transposed) | Business contact details | Until you object or unsubscribe, and no longer than 3 years |
| Traffic measurement (Google Analytics 4) | Consent — Art. 6(1)(a) | Cookie identifiers, approximate location derived from the IP address, device type, behaviour on the site | 14 months in Google Analytics; for the _ga cookie in the browser see the Cookie policy |
| Advertising and measuring its effectiveness (LinkedIn Insight Tag; Sklik on the Czech version only) | Consent — Art. 6(1)(a) | Cookie identifiers, behaviour on the site, device data | For the lifetime of each cookie see the Cookie policy; once consent is withdrawn the scripts no longer load |
| Running and securing the website | Legitimate interest — Art. 6(1)(f) | IP address, technical logs | 6 months |
| Record of the cookie-banner choice — both acceptance and refusal | Legitimate interest — Art. 6(1)(f) (to evidence that we respected the choice); where consent was given, additionally Art. 6(1)(c) in conjunction with Art. 7(1) GDPR | Timestamp, which choice and which version of the document — we do not keep the IP address | 1 year from recording the choice |
On retention periods. Where we cite no specific statutory provision, the period is our own assessment. We start from the three-year general limitation period under s. 629(1) of the Czech Civil Code, which governs our contracts.
When you write or call, we process what you tell us so that we can reply, prepare a quotation and possibly agree on working together. Without it the enquiry cannot be handled.
An enquiry sent from the website is stored in our customer relationship management system. No consent is given in this case.
The legal basis depends on who is enquiring. If you are a sole trader, you are the contracting party yourself and the basis is preparation of a contract — Art. 6(1)(b) GDPR. If you act for an organisation, the contracting party is that organisation, not you; point (b) therefore does not cover your personal data and the basis is legitimate interest under point (f). That interest is to handle the enquiry and negotiate with the entity you represent. You may object to such processing at any time.
Data from an enquiry that does not lead to a contract we keep for 3 years from the last contact — the sales cycle in water and energy saving tends to be long and enquiries often come back.
During the audit and delivery we work with contacts for the people acting for the client — a technician, a building manager, an operations lead. We need this to arrange access to the building, hand over the report and deal with any warranty claim.
Measured water and energy consumption data relates to the building, not to a person, and is not usually personal data. If in a particular case the data could be attributed to a household, we process it only to the extent necessary to perform the contract.
Data we did not obtain from you directly. Contact details of people acting for a client are usually given to us by the client, not by those people. The source is therefore the organisation you act for. In that case we inform you about the processing at the first contact at the latest, and always within one month of obtaining the data (Art. 14(3) GDPR). The scope is limited to name, job title, work e-mail and phone.
We rely on legitimate interest for the defence of legal claims, for follow-up offers to existing clients and for running the website. For each we balanced our interest against your rights and concluded the processing is proportionate: it concerns business contact details of people who have already dealt with us, the scope is minimal and you may object at any time.
If we send a follow-up offer by e-mail, the rules on unsolicited commercial communications apply alongside the GDPR (Art. 13 of Directive 2002/58/EC, as transposed in the country concerned). We send such an offer only to our own customers, only to a contact obtained in connection with a delivery, only for similar services, and every message can be unsubscribed from in one click.
You may object to processing based on legitimate interest at any time at privacy@rewater.eu. For direct marketing we stop the processing without further examination.
The site uses Google Analytics 4 to measure traffic and the LinkedIn Insight Tag for advertising and measuring its effectiveness. The Czech version of the site (addresses beginning /cs/) additionally runs Seznam Sklik retargeting; on the other language versions it does not load. We have no Meta Pixel deployed.
These tools activate only after you give consent in the cookie banner. Until you do, their scripts do not load at all. Statistics and marketing are separate choices — you can allow analytics and refuse marketing. You can change or withdraw consent at any time via the Cookie settings link in the footer of every page.
For their own tools, LinkedIn and Seznam act as independent controllers — see sections 5 and 6. A detailed list of cookies and their lifetimes is in the Cookie policy.
We pass data to no one who does not need it. Besides our own staff and contractors bound by confidentiality, these are:
| Recipient | Role | What it processes |
|---|---|---|
| Cloudflare, Inc. | processor | Hosting and delivery of the website, protection against attacks |
| Google Ireland Limited | processor | Work e-mail (Google Workspace), Google Analytics 4 |
| Hetzner Online GmbH (Germany) | processor | The server our customer relationship management system runs on |
| LinkedIn Ireland Unlimited Company | independent controller | LinkedIn Insight Tag — advertising and measuring its effectiveness; only after you consent to marketing cookies |
| Seznam.cz, a.s. | independent controller | Sklik retargeting on the Czech version of the site; only after you consent to marketing cookies |
| External accounting firm | processor | Accounting and tax documents |
| Delivery partners and installation firms | processor; for independently organised installation, an independent controller | A contact for arranging a date at the site |
| Lawyer, auditor | independent controller | Only to the extent necessary |
| Public authorities | — | Only where the law requires |
With every processor we have a data processing agreement under Art. 28 GDPR. With independent controllers no such agreement is concluded — each is responsible for its own processing and follows its own policy; with LinkedIn and Seznam their processing occurs only if you allow marketing cookies.
We run the customer relationship management system ourselves on a server located in Germany. Data from enquiries therefore does not leave the European Union.
Google and Cloudflare may make data available to their parent companies in the United States. The transfer rests on the European Commission adequacy decision of 10 July 2023 (EU-US Data Privacy Framework); both companies appear on the list of certified entities. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 apply in addition.
We will provide a copy of the standard contractual clauses on request at privacy@rewater.eu; their full text is published in the Official Journal of the EU.
If you allow marketing cookies, LinkedIn may also transfer data to the United States. LinkedIn acts there as an independent controller, so the safeguards for that transfer are not set by us — LinkedIn describes them in its own privacy policy. ⚠ We have not verified that LinkedIn is on the list of entities certified under the EU-US Data Privacy Framework, and so we do not claim it. You can withdraw consent to marketing cookies at any time in Cookie settings.
Seznam.cz is a Czech controller and transfers no data outside the European Union.
The General Court of the European Union upheld the adequacy of the decision by judgment of 3 September 2025 in Case T-553/23; an appeal has been lodged against that judgment (C-703/25 P) and has not yet been decided. Should the decision cease to have effect, we will reconsider the use of the tools concerned and amend this policy.
Against us you may exercise:
It is enough to send a request to privacy@rewater.eu. We will deal with it within one month; in complex cases we may extend the period by two months, of which we will notify you within one month of receiving the request. Handling is free of charge — for manifestly unfounded or excessive requests, in particular repetitive ones, we reserve the right to charge a reasonable fee or to refuse the request.
We may ask you to prove your identity so that we do not release data to the wrong person.
A complaint may be lodged with our supervisory authority, the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. You may also lodge a complaint with the supervisory authority in your own country — under Art. 77 GDPR you can choose the authority of your habitual residence, place of work or the place of the alleged infringement.
We carry out no automated decision-making or profiling that would have legal effects for you or similarly significantly affect you. The saving calculator is an informative aid; we do not store the values you enter in our records and do not link them to you. ⚠ It launches in September 2026 — until then the page only shows what it will ask.
Providing contact details is not a legal obligation. Without them, however, we cannot negotiate with you or perform a contract. Billing details are required of us by law and without them no tax document can be issued. Anything else you tell us beyond that is voluntary.
If we wanted to use your data for a purpose other than the one it was obtained for, we will tell you in advance and explain why (Art. 13(3) GDPR).
Only people who need it for their work have access to the data, and they are bound by confidentiality. The site runs solely over an encrypted connection (HTTPS). Access to systems is protected by multi-factor authentication.
If a security breach occurred with a risk to your rights, we will report it to the Czech Office for Personal Data Protection within 72 hours and, where the risk is high, notify you as well.
We may amend this policy if the scope of processing or the law changes. The current wording is always on this page with its effective date. For a substantial change we will give advance notice in the usual way.
This policy takes effect on 17 August 2026 and replaces all previous versions.