Legal information

Privacy policy

This policy describes what personal data we collect through the website rioangel.com, why we process it, how long we keep it and what rights you have in relation to it.

1. 1. Who the controller is
2. 2. What data we process
3. 3. Purpose and legal basis
4. 4. How long we keep the data
5. 5. Who we share the data with
6. 6. Transfers outside the EU
7. 7. Your rights
8. 8. Cookies and analytics
9. 9. Security
10. 10. Changes to this policy

1. Who the data controller is

The controller of personal data is:

Controller	Martin Drdla
Address	Stojanova 136/9 602 00 Brno Czech Republic
E-mail	martin@drdla.eu
Phone	+420 777 637 352
Project	Rio Ángel Bio-reserve, Caňas, Cantón Buenos Aires, Provincia Puntarenas, Costa Rica

The controller has not appointed a data protection officer — given the scope and nature of the processing, the law does not require one. For all data protection matters, please use the contact details above.

2. What data we process

2.1 Data you provide yourself

Through the contact form, or directly by e-mail or phone, you may provide us with:

• your full name — optional, used to address you,
• your e-mail address — required; without it we cannot reply,
• your phone number — optional, if you prefer to be contacted by phone,
• the content of your message — whatever you choose to write to us.

Please do not include sensitive data (health, political opinions, national ID numbers, document or bank account numbers) in your message. We do not need this information to answer your enquiry and we do not process it.

2.2 Technical data

When you visit the site, the hosting server records the IP address, browser type, date and time of the request and the referring page in its operational logs. This is a standard part of running any web server and serves to ensure security and stability.

3. Purpose of processing and legal basis

Purpose	Answering your enquiry and negotiating your possible entry into the project Legal basis: steps taken at your request prior to entering into a contract — Article 6(1)(b) GDPR, or alternatively your consent — Article 6(1)(a) GDPR.
Purpose	Keeping a record of enquiries and subsequent communication Legal basis: legitimate interest of the controller in the proper management of business contacts — Article 6(1)(f) GDPR.
Purpose	Security and operation of the website Legal basis: legitimate interest in protection against misuse — Article 6(1)(f) GDPR.

Providing the data is voluntary. Without an e-mail address, however, we cannot reply — in that case please contact us by phone.

We carry out no automated decision-making or profiling within the meaning of Article 22 GDPR. We do not use your data for automated evaluation or for ad targeting.

4. How long we keep the data

• Enquiries that did not lead to further discussion: no more than 12 months from the last communication, after which we erase them.
• Enquiries that led to business negotiations: for the duration of the negotiations and then 3 years from their conclusion (the limitation period).
• Data processed on the basis of consent: until consent is withdrawn, but no longer than 3 years.
• Server operational logs: kept only to a limited extent — the server retains roughly the last 30 MB of records and overwrites older ones automatically.
• Data needed to comply with a legal obligation (for example accounting records, should a contract be concluded): for the period laid down by the relevant legislation.

5. Who we share the data with

Personal data is neither sold nor passed to third parties for marketing purposes. Only the following processors may have access to it, and only to the extent necessary for operations:

• Contabo GmbH, [DOPLNIT — registered office and company number], Germany — server operator; storage of the website and operational logs,
• Seonet Multimedia s.r.o., Company ID 27522041, Na Rybníčku 521/56, 746 01 Opava, Czech Republic — operator of the service GIGASERVER.CZ; mail server for sending the form messages and the mailbox on the domain,
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — delivery and storage of sent messages in the controller's mailbox (Gmail),
• legal, notarial and accounting services — only if a contract is concluded, and only to the extent necessary.

We have a data processing agreement under Article 28 GDPR in place with every processor.

We may also disclose the data to public authorities where the law requires it.

6. Transfers outside the European Union

The project is located in Costa Rica. If negotiations on acquiring a co-ownership share take place, it may be necessary to transfer the required identification data to local legal representatives, a notary and the competent authorities in Costa Rica — that is, to a third country outside the EU.

Such a transfer takes place only once you have genuinely expressed an interest in joining the project, under Article 49(1)(b) GDPR — the transfer is necessary for the performance of a contract, or for pre-contractual steps taken at your request. We will inform you before any such transfer.

Simply submitting the contact form does not itself trigger any transfer to a third country.

7. Your rights

In relation to your personal data you have the following rights under the GDPR:

• right of access (Article 15) — to learn what data we process about you and obtain a copy of it,
• right to rectification (Article 16) — to have inaccurate data corrected or incomplete data completed,
• right to erasure (Article 17) — to have data deleted where the reason for processing it has ceased,
• right to restriction of processing (Article 18),
• right to data portability (Article 20) — to receive the data in a machine-readable format,
• right to object (Article 21) to processing based on legitimate interest,
• right to withdraw consent — at any time and without giving a reason; withdrawal does not affect the lawfulness of processing before it,
• right to lodge a complaint with the supervisory authority.

8. Cookies and analytics

The site uses only strictly necessary cookies, without which it would not work correctly. Under Section 89(3) of Czech Act No. 127/2005 Coll., these do not require consent.

We do not use advertising or tracking cookies, social-network remarketing pixels, or tools that track behaviour across websites.

The site uses no analytics tool whatsoever. Should one be deployed in future, we will add its name, purpose, retention period and legal basis here — and, if it requires consent, a consent banner as well.

The site links to an external map service and to video hosting. By opening those links you leave our site and the policies of the relevant operator begin to apply.

9. Security

• The site is operated exclusively over an encrypted connection HTTPS.
• Only the controller has access to the enquiries received.
• We keep the data in a secure mailbox protected by a strong password and two-factor authentication.
• We regularly delete data we no longer need.

10. Changes to this policy

We may amend this policy from time to time — for example when the scope of processing or the tools used change. The current version is always available at this address. We will announce material changes visibly on the site.

Effective from 11. 8. 2026 · version 1.0