Privacy policy

Introduction

The Nech mě růst z.s. association respects your privacy and is committed to protecting your personal data. This document informs you about how we process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR) and Act No. 110/2019 Coll., on the processing of personal data.

1. Data controller

Name: Nech mě růst, z.s.
Registered office: Dandova 2619/13, Horní Počernice, 193 00 Praha
IČ: 19602529
E-mail: info@nechmerust.org
Registration: The association is registered in the register of associations maintained by the Municipal Court in Prague under file no. L 77924

2. Purposes and legal basis for processing personal data

We process your personal data for the following purposes and on the following legal grounds:

E-shop and sale of products

Purpose: Processing the order, delivering goods, communicating with the customer and fulfilling legal obligations (accounting, taxes)

Legal basis: Performance of a contract – Art. 6(1)(b) GDPR and compliance with a legal obligation – Art. 6(1)(c) GDPR

Data processed: First name, surname, delivery address, billing address, e-mail, phone, details of the ordered goods

Membership records

Purpose: Keeping records of the association’s members, fulfilling the rights and obligations arising from membership

Legal basis: Performance of a contract (membership in the association) – Art. 6(1)(b) GDPR

Data processed: First name, surname, date of birth, address, e-mail, phone

Donors and supporters

Purpose: Processing donations, issuing donation confirmations for tax purposes, communicating with donors

Legal basis: Compliance with a legal obligation (tax regulations) – Art. 6(1)(c) GDPR and legitimate interest – Art. 6(1)(f) GDPR

Data processed: First name, surname, address, e-mail, donation amount, donation date

Volunteers

Purpose: Organising volunteer activities, communicating with volunteers

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR (organising the association’s activities)

Data processed: First name, surname, e-mail, phone

Participants of events and guests of experiences at the Meadow

Purpose: Registering for events, communicating about events, organising events, and handling enquiries and bookings of a private stay or experience at the Meadow

Legal basis: Consent – Art. 6(1)(a) GDPR; for a private stay booking, pre-contractual steps and performance of a contract – Art. 6(1)(b) GDPR

Data processed: First name, surname, e-mail, phone; for a private stay booking also the dates of the stay and the number of guests

Children. If a participant is under 15, the registration is submitted by their legal guardian — under § 7 of Act No. 110/2019 Coll. a child under 15 cannot validly give consent to online data processing on their own. Who is responsible for a child at an event, and when an accompanying adult is required, is described in the visitor rules of the Meadow.

Photographs and videos from events

Purpose: We take photographs and sometimes video at events so we can show how the animals are doing — on the website, on Instagram and Facebook, and in the annual report. We photograph the ordinary course of the event, not portraits of individual people.

Legal basis: Consent – Art. 6(1)(a) GDPR and permission under § 84 et seq. of the Civil Code. Do not want to be in photographs? Tell any of us at the start of the event or write to info@nechmerust.org — we will not photograph you, and we will take down an already published photograph on request, with no explanations and no negotiation. If a child is recognisable in a photograph, we publish it only with the consent of their legal guardian.

Data processed: A photograph or video recording of a person’s appearance, and possibly their name if it is given with the photograph

Virtual adoption

Purpose: Processing virtual adoptions of animals, sending information about adopted animals

Legal basis: Performance of a contract – Art. 6(1)(b) GDPR

Data processed: First name, surname, e-mail, address (for sending confirmations)

Contact forms and enquiries

Purpose: Answering enquiries, communicating with interested parties

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR (communication with interested parties)

Data processed: First name, surname, e-mail, content of the enquiry

Sending information about our work to donors

Purpose: Sending news about what is happening at the Meadow and how donations were used to people who have already supported us

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR. We send messages only to our donors, about our own activities and in connection with the donation they made. You can unsubscribe at any time — the link is at the bottom of every message, and the “unsubscribe” button that Gmail or Seznam shows next to the subject works as well. We respect an unsubscribe immediately and permanently; so that we do not add you back when we next download data from Darujme.cz, we keep a note on your record that you do not wish to receive messages. You may also object at any time under Art. 21 GDPR at info@nechmerust.org.

Data processed: Name, e-mail, donation history (to select who each message is addressed to), the date of unsubscribing and a note that an address is undeliverable

Access codes for the Louka Run game

Purpose: The web version of the Louka Run game is available with an invitation code. We keep a record of who a code was issued to and how many times it was redeemed, so that we can invalidate a code and detect its misuse. A redeemed code is stored in the `nmr_game` cookie in your browser, otherwise the game would close every time you came back. The app from Google Play has no access code and stores nothing of the kind.

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR (controlling access to content we prepare for supporters)

Data processed: The code, a note about who it was issued to (for a code from a mailing, also the link to that mailing and therefore to the donor), the number of redemptions and the date of invalidation. Game progress — coins, unlocked animals, high score — is stored solely on your device and is never sent to us.

Website security and prevention of form abuse

Purpose: So that the public forms (order, event registration, experience enquiry) cannot be flooded by a bot, we limit the number of submissions from a single IP address. We therefore store the IP address alongside the submitted form. For the same reason we record the IP address of the last sign-in to the website administration.

Legal basis: Legitimate interest – Art. 6(1)(f) GDPR (protecting the website and our animals from being flooded with fake registrations)

Data processed: IP address, date and time of the form submission or sign-in

3. Retention period of personal data

We keep personal data only for the time strictly necessary to fulfil the purpose for which it was collected:

• Association members: For the duration of membership and 10 years after its termination (archiving obligation)
• Donors: 10 years from the date of the donation (tax regulations)
• Volunteers: For the duration of the cooperation and 3 years after its end
• Event participants: 1 year from the event (unless consent to longer processing is given)
• Virtual adoption: For the duration of the adoption and 3 years after its end
• Contact forms: 2 years from the last contact
• E-shop (customers): For the time it takes to process the order and 10 years from the end of the accounting period (Accounting Act)
• Guests of experiences at the Meadow: 3 years from the end of the stay (handling the booking and any complaints)
• Donor mailing: For as long as you are our donor and 3 years thereafter. The record of unsubscribing is kept permanently — it is the only way to make sure we do not start sending you messages again
• Game access codes: 2 years from the issue of the code
• Photographs from events: For as long as we use the photograph, but no longer than until consent is withdrawn; photographs in the annual report remain as part of the association’s archive
• IP addresses attached to forms: For the same period as the order or registration they belong to

4. Recipients of personal data

We may pass your personal data on to the following recipients. We list them by name, because “IT service provider” tells nobody anything:

• Microsoft (Azure) — running the website, the database and the image storage. The servers are in Sweden, the registry of website images in Germany, i.e. within the European Union
• Forpsi (Internet CZ, a.s.) — sending e-mails, i.e. confirmations of orders, registrations, bookings and messages to donors
• Google — Google Calendar, where we record confirmed dates; for a private stay this includes the guest’s name, the dates and the number of people, so that a date is not double-booked. And Google Analytics, which however runs only with your consent and never receives your name or e-mail
• Darujme.cz (Nadace VIA) — the donation platform through which we receive donations and from which we download an overview of them
• Accounting and tax advisers — for the processing of accounting and tax obligations
• Carriers — we pass your name and delivery address to the carrier that brings you the parcel from our shop
• Public authorities — the tax office, courts, the police, and only where there is a legal obligation

All processors are carefully selected and bound by contract to protect your personal data.

Transfers outside the European Union. The website and the database run within the European Union. Google LLC is based in the USA — for Google services (Calendar, Analytics) the transfer is ensured by standard contractual clauses pursuant to Art. 46(2)(c) GDPR and the EU–US Data Privacy Framework. We do not transfer personal data anywhere else and we do not sell it to anyone.

5. Your rights as a data subject

In connection with the processing of your personal data you have the following rights:

Right of access to personal data

You have the right to obtain confirmation from us as to whether we process your personal data, and if so, you have the right to access that data and to information about how it is processed.

Right to rectification

You have the right to have inaccurate personal data concerning you corrected. You also have the right to have incomplete personal data completed.

Right to erasure (“the right to be forgotten”)

Under certain circumstances you have the right to request the erasure of your personal data. This right is not absolute and we may have legal grounds for retaining the data.

Right to restriction of processing

Under certain circumstances you have the right to request the restriction of the processing of your personal data.

Right to data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

Right to object

You have the right to object to the processing of your personal data that is carried out on the basis of legitimate interest.

Right to withdraw consent

Where processing is based on consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the Office for Personal Data Protection if you believe that the processing of your personal data breaches legal regulations.

Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Praha 7
Website: www.uoou.cz
E-mail: posta@uoou.cz

To exercise your rights, contact us at info@nechmerust.org. We will handle your request without undue delay, no later than 1 month from its receipt.

6. Cookies and analytics tools

What are cookies?

Cookies are small text files that are stored on your device when you visit a website. Alongside them, we also use browser storage (localStorage) in a few places — it holds the contents of your basket and whether the guide Karel has already given you his welcome. Both stay in your browser and are not sent to the server. The overview below lists everything the website stores on your device; without consent only what the website could not work without is activated, and analytics cookies solely with your consent.

Overview of cookies

* Google LLC is based in the USA. The transfer of personal data is ensured through standard contractual clauses (SCC) pursuant to Art. 46(2)(c) GDPR. More information: policies.google.com/privacy.

Managing consent

Consent to analytics cookies can be changed at any time.

How to manage cookies in your browser?

Cookies can also be managed or blocked in your web browser’s settings. Please note that blocking some cookies may affect the functionality of the website.

7. Security of personal data

We have adopted appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Only authorised persons bound by an obligation of confidentiality have access to personal data.

8. Changes to the privacy policy

We may update this privacy policy from time to time. We will inform you of any changes by publishing the new policy on this page. We recommend that you check this page regularly to stay informed about how we protect your personal data.

Last updated: 10 September 2026

9. Contact

If you have any questions about the processing of your personal data or wish to exercise your rights, please contact us:

Nech mě růst, z.s.
Dandova 2619/13, Horní Počernice, 193 00 Praha
info@nechmerust.org
IČ: 19602529, file no. L 77924 (Municipal Court in Prague)