This policy describes how we process the personal data of visitors to www.tomakotrade.eu, of people who send us an inquiry and of customers with whom we follow up on an inquiry. Cookies and other data stored in your browser are described in detail on the Cookies page. The contractual relationship is governed by our terms and conditions. Only our staff have accounts on the website; visitors do not register.
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Handling an inquiry from the contact form, the inquiry window (stock vehicle, rental, transport services), the configurator or a blog article, and preparing an offer. | Name, e-mail, phone and the details you enter in the form: company or municipality, company ID, region, type of organisation, timeframe, financing method, message, requested vehicle or configuration, details of your chassis. | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract. | 3 years from the last contact if no contract is concluded. |
| Offers, conclusion and performance of the contract, orders, accounting and tax records. | Name, company, contact details, content of the offer and order, details on the records. | Art. 6(1)(b) GDPR: performance of the contract. Art. 6(1)(c) GDPR: obligations under the Czech Accounting Act and VAT Act. | 10 years, as required by accounting and VAT legislation. |
| Sending a link to your unfinished configuration to your e-mail when you ask for it. | E-mail, unfinished configuration. | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract. | 3 years from the last contact if no contract is concluded. |
| Attributing an inquiry to the source of the visit (advertising, search engine, link) and recording how and when the inquiry arrived. | Parameters of the link you came from (utm, gclid), referring page, language, browser type and a one-way fingerprint (hash) of the IP address. For inquiries from the configurator, inquiries about a specific stock vehicle and inquiries from a blog article, also the IP address itself. For the configurator, additionally the approximate location derived from the IP address, screen resolution and the Google Analytics identifier (only with consent to analytics cookies). | Art. 6(1)(f) GDPR: legitimate interest in knowing where inquiries come from and in documenting the course of communication. | As long as the inquiry they belong to. |
| Your progress in the configurator, even if you do not send an inquiry. | Selected vehicle parameters, steps reached and their times, IP address, approximate location derived from the IP address, browser type, referring page, language, ad link parameters. | Art. 6(1)(f) GDPR: legitimate interest in measuring and improving the configurator. | No longer than 12 months. If you send an inquiry, as long as the inquiry. |
| Protecting forms against spam and abuse. | IP address, session identifier (sessionid cookie), one-way fingerprints (hashes) of the IP address, e-mail, phone and message text, result of the Cloudflare Turnstile check. | Art. 6(1)(f) GDPR: legitimate interest in protecting the website and its forms. | No longer than 12 months. |
| Our own statistics of views of articles, vehicles and links from our offers. | Page viewed, referring page and source of the visit, ad link parameters, language, browser type, one-way fingerprint (hash) of the IP address. | Art. 6(1)(f) GDPR: legitimate interest in knowing which articles, vehicles and offers attract interest. | No longer than 12 months. |
| Statistics of scans of the QR codes on our demonstration vehicles. | The vehicle whose QR code you scanned, time, IP address, browser type, referring page, browser language. | Art. 6(1)(f) GDPR: legitimate interest in knowing how many prospective customers the demonstration vehicles reach. | No longer than 12 months. |
| Offers we send you by e-mail. | Name, e-mail, content of the offer, information that you opened the link in the offer. | Art. 6(1)(b) GDPR if you asked for the offer, otherwise Art. 6(1)(f) GDPR: legitimate interest in offering you our vehicles and services. | 3 years from sending the offer if no contract is concluded. |
| Traffic analysis and advertising (Google Analytics, Google Ads). | Cookie identifiers, data about the visit and the device, as listed on the Cookies page. Without consent, cookieless signals: IP address, page viewed, ad link parameters. | Art. 6(1)(a) GDPR: your consent to cookies and personalised advertising. Art. 6(1)(f) GDPR: legitimate interest in measuring traffic and ad performance with cookieless signals when you do not give consent. | Cookies as stated on the Cookies page, at most until you withdraw consent. Cookieless signals according to Google’s rules. |
We store an inquiry from the contact form, the inquiry window (stock vehicle, rental, transport services), the configurator or a blog article in our database and send it by e-mail to the member of our staff who handles it. With the inquiry we also store the referring page, language, browser type, ad link parameters and a one-way fingerprint (hash) of your IP address. An inquiry from the configurator, about a specific stock vehicle or from a blog article additionally creates a record in our inquiry register, which also contains the IP address itself. For inquiries from the contact form and from the inquiry window without a specific vehicle (for example rental or transport services), we store the IP address only as a fingerprint. After you send an inquiry from the configurator or a blog article, we send a confirmation with a summary to the e-mail address you entered. We then work with the inquiry in our internal records: we prepare an offer and, if we reach an agreement, an order. The website and the database run on our own server in the Czech Republic.
Providing your details is voluntary. Without contact details (phone or e-mail), however, we cannot reply to your inquiry.
The configurator creates a record as soon as you choose the purpose of the vehicle, i.e. before you send an inquiry. In the record we store the selected parameters, the steps reached and their times, your IP address, browser type, referring page, browser language and ad link parameters. From the IP address we determine your approximate location (town, region, country and geographic coordinates), only for configurator records; for this we pass the IP address to the ip-api.com service. One version of the configurator also stores the screen resolution and the Google Analytics identifier, which exists only if you have consented to analytics cookies.
Your browser remembers the last 50 pages of this website that you visited (tmk_* data). This list stays only in your browser; the website currently does not send it to us. The parameters of the ad link through which you came to the website (tk_attribution data) are sent together with the configurator record and with an inquiry from the inquiry window. They serve to attribute the inquiry to the source of the visit, and we process them on the basis of legitimate interest, not consent. You can delete both at any time in your browser settings.
We protect our forms in three ways. A hidden field that people cannot see catches automated bots. We limit the number of submissions by IP address, browser session (sessionid cookie) and form content; for this we store the e-mail, phone and message text only as one-way fingerprints (hashes) from which the original data cannot be recovered. In addition, when a form is sent, the Cloudflare Turnstile service checks that it is not being sent by a bot. Cloudflare processes your IP address and technical data about your browser, and we also pass the IP address to Cloudflare when checking the result.
For blog articles, vehicle detail pages and links from our offers we keep our own view statistics without cookies. We store the page viewed, where you came from, ad link parameters, language and browser type, and instead of the IP address only its one-way fingerprint (hash). When you scan the QR code on one of our demonstration vehicles, we record the vehicle, the time, your IP address, browser type, referring page and browser language, and redirect you to the page the QR code points to.
The Google Analytics and Google Ads scripts are always loaded on our pages. They store cookies for traffic analysis, ad performance measurement and personalised advertising (remarketing) only with your consent. Without consent, Google receives only cookieless signals (Consent Mode): they contain your IP address, the page viewed and ad link parameters, but no browser identifier, and they do not add you to remarketing lists. We send these signals on the basis of our legitimate interest in measuring traffic and ad performance (Art. 6(1)(f) GDPR). Which cookies are stored, for how long and how to change or withdraw consent is described on the Cookies page.
Offers are sent by a member of our staff by e-mail to individual recipients, some with the offer as a PDF. The link in the offer contains an identifier that tells us you opened the offer on our website. We do not send a newsletter. If you do not want further offers from us, write to us and we will stop sending them.
The pages load fonts from the Google Fonts service, software libraries from the cdn.jsdelivr.net and cdnjs.cloudflare.com servers and some vehicle photos from the g.tipcars.com server. In doing so, your browser tells these servers its IP address and the technical data needed to deliver the file. We do this on the basis of our legitimate interest in displaying the website quickly and reliably (Art. 6(1)(f) GDPR).
Google and Cloudflare may also process data in the United States. Such transfers are governed by the EU-US Data Privacy Framework, for which the European Commission has decided that it ensures an adequate level of protection.
The periods in the overview above are maximum periods. If you exercise your right to erasure or object, we will delete the data earlier unless we need them to comply with a legal obligation or to defend legal claims. Copies of the data are also kept in database backups.
We do not make automated decisions about you and do not create profiles that would have legal effects on you or similarly significantly affect you. The only activity close to profiling is Google Ads remarketing lists, which your browser is added to only with your consent to advertising cookies.
You have the right:
You can exercise your rights by e-mail at tomas@tomakotrade.eu, by phone at +420 732 334 758 or by letter to our registered office. We will respond without undue delay and within one month at the latest. We have not appointed a data protection officer, as the law does not require us to.
The supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. You can also lodge a complaint with the supervisory authority in the EU member state where you live or work.
We will update this policy when the way we process personal data changes. This version applies from 23 September 2026.