Privacy policy
Most of the data we hold about you, you gave us yourself — when you asked about a particular villa. Below you will find what we process, on which legal basis, how long it stays with us and how to tell us, at any time, to delete it.
Exercise your rightsWho processes your data
The website samuiestate.sk is operated by FEDORS Group, s. r. o.. We are the controller within the meaning of the GDPR — that is, we determine why and how your personal data is processed, and we are responsible for it.
You can reach us with any question about the processing of personal data at the address above or by e-mail. We have not appointed a data protection officer, as the GDPR does not require one for the scope of our processing.
What data we hold about you
We do not collect anything just in case. Data about you comes about in two ways — either you tell us yourself, or it is recorded technically when you visit the site, and measurement data only if you have consented to it.
What you tell us
From the contact form, or from an e-mail or a phone call.
- first name and surname
- e-mail address
- telephone number
- the project, villa and type of interest you selected
- the content of your message and of our further correspondence
What the visit leaves behind
When you send the form, and measurement data only with your consent.
- the page from which you sent the form
- your IP address — held briefly in server memory to protect the form from abuse, never stored
- with your consent: cookie identifiers, pages viewed, the fact that a form was sent (not its content), and device and browser details
Purposes and legal bases
We process every piece of data for a specific purpose and on a specific legal basis. Once the purpose has been fulfilled, we erase or anonymise the data.
Handling your enquiry
Steps prior to entering into a contract
Art. 6(1)(b) GDPR
We reply to you, arrange a viewing or an online presentation and agree the next steps for the villa you are interested in. Without your contact details we cannot reply — providing them is voluntary.
3 years — from the last communication
Traffic measurement
Consent
Art. 6(1)(a) GDPR
With your consent to analytics cookies, Google Analytics tells us which pages are read and where visitors come from, so that we can improve the site. We only see the results in aggregate, not per person.
Until you withdraw consent — cookies for 2 years at most
Advertising measurement and targeting
Consent
Art. 6(1)(a) GDPR
With your consent to marketing cookies, Google Ads and the Meta Pixel tell us which ads led to enquiries, and we may show you ads for our projects on Google and Meta platforms (Facebook, Instagram). These companies may build profiles from the data to show ads.
Until you withdraw consent — cookies for 13 months at most
Operation and security
Legitimate interest
Art. 6(1)(f) GDPR
Server logs and a short-lived limit on submissions per IP address let us keep the site available and prevent abuse of the form. Our legitimate interest is a secure, working website.
12 months — at most, depending on the hosting configuration
Handling your requests
Legal obligation
Art. 6(1)(c) GDPR
If you exercise any of the rights listed below, we keep a record of the request and of how it was dealt with.
1 year — from the date the request was dealt with
The three-year period for enquiries corresponds to the general limitation period under Section 101 of the Slovak Civil Code. Once an enquiry has been dealt with, we keep the record solely to establish and defend any legal claims — on the basis of our legitimate interest under Art. 6(1)(f) GDPR.
Who we share data with
We do not sell your data. Our processors handle it solely on our behalf, under a data processing agreement and only to the extent necessary. Google and Meta receive data only with your cookie consent and, for their advertising services, also process it for their own purposes. We will name the specific processors on request.
Hosting provider
Processor
Runs the servers the site and our content management system are served from — your enquiry passes through the latter — and keeps technical access logs. Some servers are in the USA.
Database provider
Processor
Stores the enquiries you send in the database behind our content management system, so that we can process them and nothing gets lost. The database runs in the EU.
E-mail service provider
Processor
Delivers the alert about a new enquiry to us. The details you fill in on the form pass through this service.
Media storage provider
Processor
Stores and delivers the project's photographs, video and PDF documents. When they load, it processes only the technical data needed to deliver them, such as your IP address.
Google Ireland Limited
Only with consent
Google Tag Manager, Google Analytics and Google Ads load only with your consent. For Google Analytics, Google processes data on our behalf; for its advertising services it acts as an independent controller.
Meta Platforms Ireland Limited
Only with consent
The Meta Pixel loads only with your consent to marketing cookies. We are jointly responsible with Meta for collecting data on our site and passing it to Meta (Art. 26 GDPR); Meta is responsible for what happens to it afterwards. You can exercise your rights regarding Meta with us or directly with Meta.
The essence of the joint-controller arrangement with Meta is set out in its Controller Addendum. We may also disclose data to public authorities where the law requires us to.
Transfers outside the EU
Our hosting provider, Google and Meta also process data outside the European Economic Area, mainly in the United States.
Transfers rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework where the recipient participates in it, and otherwise on the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). We will provide a copy of these safeguards on request.
Your rights
In relation to the data we process about you, the GDPR gives you the following rights:
Right of access
We will tell you whether we process any data about you and give you a copy of it.
Right to rectification
We will correct inaccurate data and complete incomplete data.
Right to erasure
We will erase your data when it is no longer needed, when you withdraw consent or when you object successfully — unless the law or the defence of legal claims requires us to keep it.
Right to restriction
We will pause processing temporarily, for example while we verify that the data is accurate.
Right to data portability
We will hand over the data you gave us in a machine-readable format.
Right to object
You may object at any time to processing based on our legitimate interest.
Right to withdraw consent
You can withdraw your cookie consent at any time through Cookie settings in the footer, as easily as you gave it. This does not affect the lawfulness of processing before the withdrawal.
Just write to us — a request needs no particular form. We deal with it free of charge, within one month of receiving it at the latest. If we need more time or have to verify your identity, we will let you know.
Complaint to the supervisory authority
If you suspect that we process your data unlawfully, you can lodge a complaint with the supervisory authority — Úrad na ochranu osobných údajov Slovenskej republiky (the Slovak Data Protection Office), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk — or with the supervisory authority of the EU country where you live or work. We would, however, be glad if you got in touch with us first.
We update this policy whenever the way we process data changes, for example when we change a service provider. When a new kind of measurement tool is added, we ask for your cookie consent again. Effective from 27 October 2026 · Version 2.0