4. Recipients and Processors of Personal Data

Your personal data is primarily processed by the controller. In justified cases, the data may be made available to other recipients who provide certain services for the controller as processors, always on the basis of a data processing agreement and to the extent strictly necessary. Such recipients include in particular:

the web hosting and server infrastructure provider; the e-mail infrastructure provider and the newsletter distribution tool; providers of traffic measurement and marketing tools; external IT service providers, website management and maintenance providers; providers of accounting and legal services.

Personal data may also be transferred to public authorities where required by law or where necessary to protect the rights of the controller.

5. Cookies

Our website uses cookies and similar technologies. Detailed information about the cookies we use, their purpose and how you can manage your consent is available on the separate Cookie Use page.

6. Transfer of Personal Data to Third Countries

Your personal data is generally processed within the territory of the European Union. If, in connection with the use of certain providers’ services (for example, traffic analysis tools), data were transferred to third countries outside the EU/EEA, such transfer would take place exclusively in compliance with the conditions set out by the GDPR, in particular on the basis of an adequacy decision or standard contractual clauses approved by the European Commission.

7. Retention Period of Personal Data

We retain personal data only for the period strictly necessary to fulfil the purpose for which it was collected, and thereafter for the period required by the applicable legislation (in particular in the field of accounting and tax). The specific periods for each purpose are set out in the table in Article 3. After these periods expire, personal data is securely erased or anonymised.

8. Your Rights

In connection with the processing of personal data, you have the following rights under the GDPR. You may exercise these rights using the contact details provided in Article 1.

Right of access to personal data: you have the right to obtain confirmation as to whether your data is being processed and to access it (Art. 15 GDPR). Right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR). Right to erasure (“right to be forgotten”) under the conditions set out by the GDPR (Art. 17 GDPR). Right to restriction of processing (Art. 18 GDPR). Right to data portability: the right to receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR). Right to object to processing based on legitimate interest, including profiling, and to processing for direct marketing purposes (Art. 21 GDPR). Right to withdraw consent: where processing is based on consent, you have the right to withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR). Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

We will handle your request without undue delay, and at the latest within one month of receiving it. Where necessary, and taking into account the complexity and number of requests, this period may be extended by a further two months, of which we would inform you.

9. Automated Decision-Making and Profiling

When processing your personal data, no automated decision-making takes place that would produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR.

10. Security of Personal Data

The controller has implemented appropriate technical and organisational measures to secure personal data and protect it against unauthorised or accidental access, alteration, destruction, loss or misuse. Data is transmitted via an encrypted protocol (HTTPS) and only authorised persons bound by a duty of confidentiality have access to the data.

11. Supervisory Authority

If you believe that the processing of your personal data infringes data protection rules, you have the right to lodge a complaint with the supervisory authority, which is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27, 170 00 Praha 7 Website: www.uoou.cz Telephone: +420 234 665 111

12. Changes to the Privacy Policy

We may update this privacy policy from time to time, in particular in response to changes in legislation or in the way personal data is processed. The current version is always available on this page, with its effective date indicated. We therefore recommend that you review this policy each time you visit the website.

This privacy policy is effective from 1 June 2026.