PRIVACY POLICY

1. INTRODUCTORY PROVISIONS

1.1. The controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”) is:

Company / Name: Dana Kápičková

Registered office / Address: Bartoňova 828, 53012 Pardubice

Company ID No.: 09614362

Contact: e-mail: dkapickova@seznam.cz

(hereinafter referred to as the “Controller”).

1.2. When processing personal data, the Controller acts in accordance with the GDPR, Act No. 101/2000 Coll., on the Protection of Personal Data, Act No. 89/2012 Coll., the Civil Code, and other related legal regulations.

1.3. The following sections specify the personal data collected, the manner in which such data are processed, the period for which your personal data are processed, the purposes of processing, as well as information provided to you as data subjects by the Controller.

2. CATEGORIES OF PERSONAL DATA

2.1. The Controller processes only the basic data that are strictly necessary, namely:

• identification data (your first and last name, business name, residential or registered office address, and, where applicable, your delivery address, Company ID No., VAT ID No., and date of birth);

• contact details (your e-mail address and telephone number, and, where applicable, your IP address).

2.2. The Controller processes personal data that you have provided to the Controller or personal data obtained by the Controller in connection with the fulfilment of your order.

3. REASONS AND PURPOSES OF PROCESSING PERSONAL DATA

3.1. The legal bases for the processing of personal data are:

• performance of a contract to which you, as the data subject, are a party;

• compliance with a legal obligation to which the Controller is subject;

• the Controller’s legitimate interest in carrying out direct marketing;

• your consent to the processing of personal data for the purposes of direct marketing (sending commercial communications and newsletters).

3.2. The Controller processes personal data for the purpose of processing your order, fulfilling the Controller’s own legal obligations towards the state (e.g. tax obligations), and carrying out marketing activities.

3.3. You may withdraw your consent to receiving commercial communications that you have given to the Controller at any time (see Section 7.6 of this Policy).

4. RETENTION PERIOD OF PERSONAL DATA

4.1. The Controller retains your personal data for the period necessary to exercise rights and fulfil obligations arising from the contractual relationship, or for the period necessary to comply with archiving obligations under other legislation (the Accounting Act, the Archives and Records Management Act, and the Value Added Tax Act), but for no longer than 10 years from the termination of the contractual relationship. If you do not withdraw your consent to the processing of personal data for direct marketing purposes, the data will be processed for no longer than 3 years.

4.2. Once the retention period has expired, your personal data will be deleted.

5. SECURITY OF PERSONAL DATA

5.1. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons arising from the processing, the Controller has implemented appropriate technical and organisational measures to comply with the requirements of the GDPR and protect the rights of data subjects.

6. RECIPIENTS OF PERSONAL DATA

6.1. The Controller provides personal data to the following recipients:

• external accountants;

• payment service providers and payment processors for the purpose of securing the transfer of funds.

6.2. We do not transfer your personal data to countries outside the European Union. Personal data are processed both manually and by automated means.

7. YOUR RIGHTS

7.1. RIGHT OF ACCESS TO PERSONAL DATA (Article 15 GDPR)

You have the right to request access to the personal data concerning you that are being processed and to the following information:

1. a) the purposes of the processing of personal data;

2. b) the categories of personal data being processed;

3. c) the categories of recipients to whom the personal data have been or will be disclosed;

4. d) the period for which the personal data will be processed and stored;

5. e) all available information concerning the source of the personal data, where the data have not been obtained from you;

6. f) whether automated decision-making, including profiling, takes place.

7.2. RIGHT TO RECTIFICATION OF PERSONAL DATA (Article 16 GDPR)

You may contact us with a request for rectification if the data we hold about you are inaccurate, incomplete or outdated. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

7.3. RIGHT TO ERASURE OF PERSONAL DATA (Article 17 GDPR)

You may contact us with a request for the deletion of your personal data if:

1. a) the data are no longer necessary for the purposes for which they were collected or otherwise processed;

2. b) you have withdrawn your consent to the processing of the data;

3. c) the data have been processed unlawfully;

4. d) the data must be erased in order to comply with a legal obligation under EU or Member State law to which the Controller is subject; or

5. e) you have objected to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

7.4. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA (Article 18 GDPR)

You have the right to obtain restriction of the processing of personal data if:

1. a) you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;

2. b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

3. c) we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims;

4. d) you have objected to processing pursuant to Article 21(1) of the GDPR, pending the verification whether our legitimate grounds override your legitimate grounds.

If you have obtained a restriction of processing, you will be informed in advance before the restriction of processing is lifted.

7.5. RIGHT TO DATA PORTABILITY (Article 20 GDPR)

You may request that we provide your personal data to you in a structured, commonly used and machine-readable format, or that we transmit such data directly to another controller, where:

1. a) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and

2. b) the processing is carried out by automated means.

7.6. RIGHT TO WITHDRAW YOUR CONSENT TO THE PROCESSING OF PERSONAL DATA AT ANY TIME

You may withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7.7. RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA (Article 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7.8. RIGHT TO LODGE A COMPLAINT

If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority, which is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů),

with its registered office at Pplk. Sochora 27, 170 00 Prague 7

Data Box ID: qkbaa2n

e-mail: posta@uoou.cz

8. PERSONAL DATA BREACH

8.1. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you of the breach without undue delay. The notification shall describe the nature of the personal data breach and shall contain at least the information and measures referred to in Article 33(3)(b), (c) and (d) of the GDPR. Such notification is not required if any of the following conditions are met:

1. a) we have implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular measures which render the personal data unintelligible to any person who is not authorised to access them, such as encryption;

2. b) we have taken subsequent measures which ensure that the high risk to your rights and freedoms is no longer likely to materialise;

3. c) it would involve disproportionate effort.

9. DATA PROTECTION OFFICER

9.1. The Controller has not appointed a Data Protection Officer. In matters relating to the processing of personal data, you may contact us directly.

All contact details can also be found on the Controller’s website: http://www.danakap.com/

These Privacy Policy provisions are effective as of 19 March 2025.