Privacy Policy

Controller for website enquiries

EPR Entry is a commercial brand and coordination platform and is not a separate legal entity. Green Blue, s.r.o. is the controller of personal data collected through the initial EPR Entry website enquiry process.

• Green Blue, s.r.o., registered office Mesačná 18, 821 02 Bratislava, Slovakia.
• Company ID: 47102349. Tax ID: 2023739828. VAT ID: SK2023739828.
• Registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, File No. 88514/B.
• Privacy contact: office@greenblue.sk, +421 948 882 468.

Enquiries concerning the Czech Republic

Where an enquiry concerns services in the Czech Republic, relevant personal data may be provided to Authorized Representative CZ, s.r.o., which processes the data it receives as an independent controller for its own pre-contractual communication and, where applicable, subsequent provision of Czech-market services.

Where an enquiry concerns both Slovakia and the Czech Republic, each national provider may process the relevant data for its respective market and service scope.

• Authorized Representative CZ, s.r.o., registered office Petrská 1166/33, Nové Město, 110 00 Prague 1, Czech Republic.
• Company ID: 29850932.
• Registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 453408.
• Contact: office@greenblue.sk, +421 948 882 468.

Personal data collected through the forms

The enquiry form and the EPR assessment request form transmit the information you enter or select.

• Name.
• Company.
• Work email.
• Company country.
• Selected markets.
• Selected product streams.
• Message, where you choose to write one.
• Privacy Policy acknowledgement.
• Server submission timestamp.
• Service context, where the submission is an EPR assessment request.

Technical information processed by the infrastructure

The hosting and security infrastructure serving this website may process ordinary technical request information, such as IP address, request timestamp, browser and network metadata, and security or diagnostic records. This information is processed to deliver the website, execute server requests and protect the service.

The application itself does not intentionally log the full submitted personal-data payload of a form submission.

Purposes of processing

• Responding to enquiries and EPR assessment requests: replying to you, assessing the EPR and product-compliance services requested, determining the applicable markets and product streams, preparing the requested pre-contractual communication, and arranging contact with the appropriate national provider.
• B2B communication: communicating with representatives, employees or contact persons of prospective corporate clients and handling business enquiries and possible service relationships.
• Security and abuse prevention: protecting the form and the website against spam, automated submissions, misuse and security incidents, and maintaining the necessary technical and diagnostic records.
• Legal and contractual compliance: where an enquiry develops into a client relationship, further processing may be necessary for contracts, statutory compliance, accounting, tax, record-keeping, and the establishment, exercise or defence of legal claims.

Legal bases

Submitting an enquiry is not processed on the general basis of consent. The applicable legal basis depends on the circumstances of the enquiry.

• Article 6(1)(b) GDPR: processing necessary to take steps at the request of the data subject prior to entering into a contract, where this legal basis is applicable.
• Article 6(1)(f) GDPR: legitimate interests in responding to business enquiries, communicating with representatives of prospective corporate clients and managing potential business relationships. This is particularly relevant where the person submitting the enquiry acts on behalf of a company rather than entering into the contract personally.
• Article 6(1)(f) GDPR: legitimate interests in operating and securing the website and preventing spam, fraud, abuse and technical incidents.
• Article 6(1)(c) GDPR: where processing is subsequently required to comply with applicable legal, accounting, tax or regulatory obligations.

Privacy Policy acknowledgement in the form

The required checkbox in the enquiry form confirms that this privacy information has been made available to you and acknowledged. It is not the Article 6 legal basis for processing your enquiry.

How the data flow works

The current production flow is: visitor, EPR Entry web form, server-side validation, SMTP email delivery, and the appropriate Green Blue or Czech provider mailbox.

No lead database is used, no CRM storage is currently used, no application-level permanent form archive is created, and the application does not intentionally log the full form payload. Once delivered, the enquiry exists in the recipient email environment and is subject to the retention described below.

Email provider

WEDOS provides email-hosting and SMTP infrastructure used to transmit and store enquiry emails for the Green Blue email environment. This provider handles the emails as part of the email service and not for its own marketing purposes.

Website hosting and deployment

The website is deployed through Lovable infrastructure and served using Cloudflare Workers runtime infrastructure. These are technical hosting, deployment and infrastructure services that may process technical data necessary to serve the website and execute server requests.

The exact infrastructure configuration and the location where technical data are handled may depend on the configuration of these service providers.

Google Fonts

• The website loads a font stylesheet from Google's font infrastructure, so your browser may make a technical request to that infrastructure.
• Such a request may disclose ordinary technical information such as your IP address and browser request data.
• EPR Entry does not intentionally send form content to Google through this font request.
• Google Fonts is not used here as an analytics or advertising cookie.

Recipients

We do not sell personal data submitted through the EPR Entry enquiry forms.

• Green Blue, s.r.o.
• Authorized Representative CZ, s.r.o., where the enquiry concerns the Czech Republic.
• The email-hosting and SMTP provider (WEDOS).
• Website hosting, deployment and infrastructure providers used to operate the site.
• Professional advisers or authorities, only where disclosure is legally required or necessary for legal claims.

International transfers

Some technology or infrastructure providers operate internationally. Where personal data are transferred outside the European Economic Area, the relevant transfer must be based on an applicable GDPR transfer mechanism, such as an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard.

The exact infrastructure location may depend on the service-provider configuration.

Retention of enquiries that do not become client relationships

Personal data from enquiries that do not result in a contractual or client relationship are retained for 12 months from the last substantive communication relating to the enquiry, after which they are deleted. This is an operational retention rule applied by the organisation, not a statutory GDPR retention period.

• A longer period may apply where necessary for the establishment, exercise or defence of legal claims.
• A longer period may apply where retention is required by law.
• A longer period may apply where another documented lawful purpose exists.

Retention where a service relationship follows

If an enquiry results in a service relationship, the relevant information becomes part of the applicable client and business records of the national provider concerned. Those records may be retained for the periods required by the contract, by accounting and tax laws, by regulatory obligations, and by legitimate legal-claims requirements. The applicable period therefore depends on the record and the obligation concerned.

Mandatory form information

Certain fields in the form are required so that the enquiry can be identified, assessed, routed to the appropriate market and provider, and answered. Where the required information is not provided, the enquiry may not be capable of being processed or answered. Submitting the form is voluntary and there is no legal obligation on you to do so.

Your rights

Requests can be sent to office@greenblue.sk.

• Right of access.
• Right to rectification.
• Right to erasure.
• Right to restriction of processing.
• Right to object where processing is based on legitimate interests.
• Right to data portability, where the legal conditions apply.
• Right to lodge a complaint with a competent supervisory authority.

Supervisory authorities

For processing carried out by Green Blue, s.r.o.: Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic.

For processing carried out independently by the Czech provider: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

These are not necessarily the only competent authorities. Where GDPR provides for another competent supervisory authority, for example in the country of your habitual residence or place of work, a complaint may be lodged there instead.

Automated decision-making

The enquiry process does not use automated decision-making or profiling that produces legal or similarly significant effects. Server-side routing of an enquiry based on the selected market is administrative routing and does not constitute such automated decision-making.

Security

Appropriate organisational and technical measures are used to protect personal data submitted through this website. No method of transmission or storage can be guaranteed to be absolutely secure, and detailed security configuration is not published.

Updates to this policy

This Privacy Policy may be updated where processing changes, where providers change, where new website functionality is introduced, or where legal requirements change.

Last updated: 27 August 2026.