Privacy Policy

(Last updated: 18 September 2026)

Privacy Policy

1. Who we are

The controller responsible for the processing of personal data through this website (the “Website”) is:

Madal Bal a.s.
Bartošova 40
760 01 Zlín
Czech Republic
Company ID: 49433717
VAT ID: CZ49433717
Email: info@madalbal.cz

In this Policy, “we”, “us” and “our” refer to Madal Bal a.s.

2. Scope of this Policy

This Policy explains how we process personal data when you visit the Website, use its contact form, contact us, or follow links to regional HERON distributors.

The Website contains links to websites operated by independent regional HERON distributors and other third parties. Their websites and any personal data you provide to them are governed by their own privacy policies. We are not responsible for their privacy practices.

3. Personal data we process

Depending on how you use the Website, we may process:

• contact and identification data, particularly your name and email address;
• enquiry and correspondence data, including the contents of your message and subsequent communications with us;
• business information that you voluntarily provide in connection with a potential wholesale or distribution relationship;
• technical and security data, such as your IP address, date and time of access, requested URL, referring page, browser and device information, operating system, language, HTTP headers, security signals and server logs.

We obtain this information directly from you or automatically from your device and the systems used to deliver and secure the Website.

The Website does not currently use analytics or advertising technologies to build visitor profiles or measure individual browsing behaviour.

4. Why we process personal data and our legal bases

4.1 Responding to enquiries and potential business relationships

When you use the contact form or contact us by email, we process the information you provide to respond to your enquiry, assess a potential wholesale or distribution relationship and take steps requested by you before entering into a contract.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take pre-contractual steps at your request. For general business correspondence or where you contact us on behalf of an organisation, the legal basis is our legitimate interest under Article 6(1)(f) GDPR in communicating with business contacts and developing and administering our business relationships.

The required contact-form fields are necessary for us to receive and respond to your request. If you do not provide them, we may be unable to process the enquiry.

4.2 Operating and securing the Website

We process limited technical and security data to deliver the Website, maintain its functionality, diagnose errors, prevent abuse, distinguish legitimate traffic from automated activity and protect the Website and contact form.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR in operating a secure and reliable website. Where information is stored on or accessed from your device, we use only technologies that are strictly necessary for the operation or security of the Website, to the extent permitted by applicable electronic communications law.

4.3 Compliance and legal claims

We may process and retain relevant personal data where necessary to comply with a legal obligation, respond to lawful requests from public authorities, or establish, exercise or defend legal claims.

The legal basis is Article 6(1)(c) GDPR where processing is required by law and Article 6(1)(f) GDPR where processing is necessary for our legitimate interest in protecting and exercising our legal rights.

5. Contact form and bot protection

The contact form is provided through Webflow and protected by Cloudflare Turnstile. Turnstile evaluates limited browser, device and interaction signals to distinguish legitimate visitors from automated submissions and generates a security token that is verified when the form is submitted.

The contents of the form fields are processed by Webflow to deliver the enquiry to us. Cloudflare Turnstile is used for security and is not used by us for advertising or visitor profiling.

6. Recipients and service providers

We disclose personal data only where necessary and proportionate. Recipients may include:

• authorised employees and contractors of Madal Bal a.s.;
• the relevant regional HERON distributor, where forwarding the enquiry is necessary to respond to your request; that distributor may act as an independent controller under its own privacy notice;
• Webflow, Inc., which provides Website hosting, content delivery and contact-form processing;
• Cloudflare, Inc., which provides security, traffic management and Turnstile bot protection;
• Google LLC, from whose servers the Website currently loads Google Fonts;
• providers of technical content-delivery, email, IT support and security services;
• courts, public authorities, professional advisers or other parties where disclosure is required by law or necessary to protect legal rights.

Service providers acting on our behalf may process personal data only for the agreed purposes and subject to applicable contractual and security obligations.

7. International transfers

Some service providers or their group companies are located outside the European Economic Area (EEA) or may process data outside the EEA, including in the United States.

Where personal data is transferred outside the EEA, the transfer is based on an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework where the recipient is validly certified, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Where required, supplementary technical and organisational measures are applied. Information about the safeguards relevant to a particular transfer may be requested using the contact details in section 1.

8. How long we retain personal data

We retain personal data only for as long as necessary for the purpose for which it was collected:

• contact enquiries and related correspondence are normally retained for no longer than three years after the last substantive communication, unless a business relationship is established or a longer period is necessary for legal claims or compliance with legal obligations;
• information relating to a contract, accounting or tax obligations is retained for the periods required by applicable law;
• technical and security logs are retained only for the period reasonably necessary to operate, protect and troubleshoot the Website, unless a security incident requires longer retention.

Data may be deleted or anonymised earlier where it is no longer required.

9. Your rights

Subject to the conditions laid down in the GDPR, you may have the right to:

• obtain confirmation as to whether we process your personal data and request access to it;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller where the right to data portability applies;
• object, on grounds relating to your particular situation, to processing based on our legitimate interests;
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at info@madalbal.cz. We may need to verify your identity before acting on a request.

You may lodge a complaint with the Czech supervisory authority:

Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Website: https://uoou.gov.cz/

You may also contact the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred.

10. Automated decision-making

We do not use personal data collected through the Website to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

11. Children

The Website is intended for business and general adult audiences and is not directed at children. We do not knowingly collect personal data from children through the Website.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No internet transmission or storage system can, however, be guaranteed to be completely secure.

13. Changes to this Policy

We may update this Policy when our processing activities, service providers or legal requirements change. The current version and its effective date will be published on this page.