This policy explains how we handle personal data when you visit vrmodelfactory.cz and vrmodelfactory.com, send an enquiry or communicate with us about our services. Last updated: 14 October 2026.
1. Who is the controller?
The controller is VRModelFactory s.r.o., company registration number (IČO): 08932468, with its registered office at Podnikatelská 553, 190 11 Praha 9 – Běchovice, Czech Republic. For privacy matters, contact us at info@vrmodelfactory.cz or write to our registered office.
2. What data do we process and why?
Enquiries and business communications
We process information you provide, particularly your name, email address, company website and name where supplied, message, project brief and subsequent correspondence. We use it to respond, prepare a quotation, arrange a demonstration and discuss working together.
Depending on the relationship, the legal basis is taking steps at your request before entering into a contract and performing a contract under Article 6(1)(b) GDPR. For communications with company representatives and general enquiries, we rely on our legitimate interest in responding and establishing or maintaining business relationships under Article 6(1)(f) GDPR.
Completed projects and legal obligations
When carrying out a project, we may also process contractual, billing and other information needed to deliver and administer it. The legal bases are contract performance, compliance with legal obligations, particularly accounting and tax obligations, under Article 6(1)(c) GDPR and, where relevant, our legitimate interest in protecting legal claims.
Operating and protecting the website
Accessing the website and embedded applications involves transmitting technical data needed for internet communication, such as your IP address, browser and device information, requested address and request time. This enables content delivery, troubleshooting and protection against misuse. For processing necessary for secure operation, we rely on our legitimate interest under Article 6(1)(f) GDPR.
3. Contact forms
Our forms let you send a question, project enquiry or demonstration request. Submissions are forwarded by email and subsequently handled in Google Workspace. Saving submissions to the Bricks database is disabled; form messages are not stored there. This does not mean that messages are not retained in email correspondence.
Separately, technical logging of outgoing emails is enabled on the website through FluentSMTP. The website database may therefore retain sender and recipient details, the subject, message contents and delivery status to check delivery and troubleshoot sending problems. Retention for these logs is set to 14 days. These records are separate from Bricks form submission storage.
Please provide only information needed to handle your request. Without a contact email address, we cannot reply; other mandatory fields are marked in the form. Do not include special categories of personal data or other sensitive information that is unnecessary for your enquiry. Handling an enquiry does not depend on consent to analytics cookies.
4. Google Analytics 4 and cookies
What we measure
We use Google Analytics 4 (GA4) on the main website to understand traffic, page usage and successful form submissions. Analytics data may include online identifiers, pages visited, events, traffic sources and device and browser information. Our custom event for a successful form submission sends the form type, site language, page address and referring page address without query parameters or fragments; it does not send form field contents.
Consent and changing your choice
Analytics cookies and GA4 measurement on the main website require your consent under Article 6(1)(a) GDPR, managed through the SEOPress cookie banner. You can refuse consent or change your choice later using Cookie settings (Nastavení cookies on the Czech domain). Withdrawing consent does not affect the lawfulness of earlier processing.
SEOPress remembers your choice for 180 days. The Czech and English domains use separate consent cookies, so please make your choice on each domain. The period for remembering your choice is distinct from GA4 data retention and is not automatically the lifetime of analytics cookies.
GA4 loads only after you explicitly consent to analytics. If you decline, its measurement script does not run. When you withdraw consent, measurement is disabled, GA4 analytics cookies are removed and the page reloads automatically so that the previously loaded measurement script is no longer used.
GA4 retention
Event data and User data retention are both set to 14 months. Reset on new user activity is enabled: further activity renews the relevant retention period for the user identifier. Retention is therefore not always a fixed 14 months from the first visit. This setting does not apply in the same way to standard aggregated reports. See Google’s data retention documentation for details.
5. Cloudflare Turnstile
We use Cloudflare Turnstile on selected forms to reduce spam and automated abuse. Verification involves Cloudflare processing technical signals such as your IP address, browser and connection information, and information about the origin of the request. Checks may take place without a visible task for the visitor.
The purpose is to protect our forms and website availability; we rely on our legitimate interest under Article 6(1)(f) GDPR for this protection. Where verification is required and cannot be completed, the form may not be submitted successfully. For details of Cloudflare’s processing, see the Turnstile Privacy Notice.
6. Interactive 3D applications
The website embeds interactive 3D applications that communicate with a server to load and operate, for example when downloading models, textures and other files. These requests involve transmitting technical data needed to deliver the content, including your IP address.
Separate analytics have been removed from the 3D applications, and the applications do not have their own analytics tracking. This does not remove technical server communication or measurement of the main website as described in the GA4 section. The absence of analytics does not mean that the applications operate without transmitting any data.
7. Who may receive the data?
We use Hostinger for hosting, Google Workspace for email enquiries, Google Analytics 4 for analytics, and Cloudflare Turnstile to protect forms. These providers may access data to the extent relevant to their services. Data may also be disclosed to competent authorities where required by law.
WordPress, Bricks, Polylang and SEOPress provide the website’s technical and content environment and consent management. Using these tools does not in itself mean that their developers receive the contents of your enquiries.
Possible transfers outside the EEA
International providers, particularly Google and Cloudflare, may process data outside the European Economic Area, for example in the United States, depending on the service, contractual arrangements and subprocessors involved. We therefore cannot generally guarantee that all data remains solely within the EU.
Any such transfer must have an appropriate legal mechanism under Chapter V GDPR, for example an applicable adequacy decision or standard contractual clauses with supplementary measures where needed. You can request information about specific recipients and applicable safeguards, including how to obtain a copy, at info@vrmodelfactory.cz.
8. How long do we retain data?
We retain business enquiries that do not result in a contract for 24 months after the last communication. We then delete them unless another legal basis justifies continued retention, such as the need to protect a specific legal claim.
Data relating to completed projects is retained according to its purpose and applicable legal obligations. Retention may differ by the type of contract, accounting or tax record and any relevant legal claim; the period for unsuccessful enquiries does not automatically apply to those records.
For technical and security records, the relevant criterion is the time necessary to maintain operation, investigate an incident and protect related claims. GA4 retention and cookie choices are addressed separately above. Contact us by email for information about a specific data category.
9. Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure or restriction of processing. For automated processing based on consent or a contract, you may have a right to data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time.
Send your request to info@vrmodelfactory.cz. To protect personal data, proportionate identity verification may be necessary. We will respond without undue delay, normally within one month; if a statutory extension is needed, we will explain the reasons within that same period.
You also have the right to lodge a complaint with a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged GDPR infringement. In the Czech Republic, this is the Office for Personal Data Protection (ÚOOÚ).
10. Security and updates
The website is available over HTTPS, which protects transmission between your browser and the website. Technical and organisational measures to protect personal data need to be continually adapted to the nature and risks of processing; no internet transmission or system offers an absolute security guarantee.
We update this policy when our services, processing practices or legal requirements change. The date of the latest update appears at the beginning. If you have questions, contact info@vrmodelfactory.cz.