Privacy Policy

prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, within the meaning of Articles 13 and 14 of the Regulation (the “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data (the “Personal Data Processing Act”)

Who processes your data?

Controller

What is personal data?

Personal data is practically any information that can identify a living natural person directly, or whose purpose is to reach such a person. Personal data can be divided into general data (e.g. name and surname, age, phone number, place of birth, marital status, etc.) and sensitive data (today referred to as special categories of personal data, which comprise only the following: biometric data, trade union/political party membership, ethnic origin, philosophical beliefs, genetic data, information on convictions and criminal offences, religious beliefs, political opinions, racial origin, sexual orientation/life, health status).

What is the processing of personal data?

Processing of personal data means systematic activity that the controller carries out with personal data for a specific purpose. Such activity includes in particular: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction.

Sources and categories of personal data

The controller processes personal data (obtained directly from you) that you have provided to it, or personal data obtained on the basis of fulfilling your order.

Your identification and contact details, and the data necessary for the performance of the contract.

Legal grounds and purpose of processing

The legal grounds for processing are:

• Your consent to the processing of personal data for the purpose of providing direct marketing pursuant to Art. 6(1)(a) GDPR
• For the purpose of concluding and performing the contract (i.e. in connection with the provision of our services) we process your personal data pursuant to Art. 6(1)(b) GDPR. The legal basis for processing your general personal data is therefore the contract.
• Once the contract has been fulfilled, we must archive your personal data for the period stipulated by applicable legal regulations. Here the legal ground for processing your general personal data is compliance with a legal obligation, as set out in Art. 6(1)(c) GDPR.

The purpose of personal data processing is:

Processing your order and exercising the rights and obligations arising from the contractual relationship between you and the Controller. When placing an order, the personal data necessary for successfully processing the order is required pursuant to Art. 6(1)(b) of the Regulation (this also relates to the subsequent execution of payment, delivery of services, handling of complaints, etc.); we use the personal data you provide to us so that we can conclude a contract with you and, where a contract has already been concluded between us, so that we can fulfil it. Processing of the customer’s personal data takes place without the customer’s consent, since the legal basis for processing their personal data for the purposes of performing the contract is the specific contract between the customer and the controller. Providing personal data is a necessary requirement for concluding and performing the contract; without providing personal data, it is not possible to conclude the contract or for the controller to fulfil its terms.

What personal data will we process, and to what extent?

In order to provide you with our services, we need to know the following personal data:

• general personal data: first and last name, permanent residence address, delivery address for services or goods, your phone number and e‑mail.

How long will we retain the data?

We will retain your personal data for as long as we are performing our mutual contract. After the termination of the contractual relationship, we will retain your personal data for as long as necessary to fulfil the mandatory archiving obligation under legal regulations that provide for archiving (such regulations include, for example, the Accounting Act, the VAT Act and the Archives and Records Act).

To whom do we further disclose your personal data?

Your personal data may be disclosed to the following categories of recipients: providers of legal, tax and accounting services, providers of technical solutions.

Your personal data may also be disclosed to public administration bodies and courts, but only provided that this is stipulated by specific legislation, or if you give your explicit consent.

Your personal data is disclosed to our processors always on the basis of a data processing agreement and in accordance with the minimum standard of personal data protection required by the GDPR.

The controller does not provide, disclose or make personal data accessible in third countries.

Personal data security conditions

The controller declares that it has adopted appropriate personnel, technical and organisational measures to ensure the protection of personal data.

The controller has adopted technical measures to secure data storage systems and files containing personal data.

The controller declares that only persons authorised by it have access to personal data.

Within the personal data processing activities that we carry out, no automated decision‑making or profiling takes place.

What are your rights in connection with the processing of your personal data?

Under the conditions set out in the GDPR, you have:

• the right of access to your personal data pursuant to Art. 15 GDPR,
• the right to rectification of personal data pursuant to Art. 16 GDPR,
• the right to restriction of processing,
• the right to erasure pursuant to Art. 17 GDPR,
• the right to object pursuant to Article 21 GDPR,
• the right to data portability pursuant to Article 21 GDPR,
• the right to withdraw consent (electronically, or to our correspondence address),
• the right to lodge a complaint with the personal data protection authority if you believe that your rights to the protection of personal data have been violated.

How can you exercise your rights?

Right of access

Upon your request, we must inform you whether or not we process your personal data. If we do process it, you have the right for us to inform you:

• for what purpose we process your data,
• to what extent this data is processed,
• how long it will be retained,
• to whom it will be disclosed,
• whether you can lodge a complaint with the Office for Personal Data Protection.

You may submit your request electronically, to the e‑mail address maresova@habrinol.cz, or by post to the address: Tovární 63, 407 11 Děčín XXXII‑Boletice nad Labem, Czech Republic.

Right to rectification

If you believe that we are processing incorrect (inaccurate) personal data about you, you have the right to have it corrected. If you discover such an inaccuracy in your personal data, please let us know and we will correct it without undue delay. You may submit your request electronically, to the e‑mail address maresova@habrinol.cz, or by post to the address: Tovární 63, 407 11 Děčín XXXII‑Boletice nad Labem, Czech Republic.

Right to erasure

In certain circumstances you have the right for us to erase your personal data. You may request the erasure of your data at any time. We will erase your personal data if:

• we no longer need your personal data for the purpose for which you provided it to us,
• you withdraw your consent,
• you object to the processing of your personal data,
• we are processing your personal data unlawfully,
• personal data must be erased in order to comply with a legal obligation,
• you are a child, or the parent of a child, who consented to the processing of personal data over the internet.

Right to restriction of processing

You may ask us to restrict the processing of your personal data. If we grant your request, we will only store your personal data and will not otherwise process it further. Your data processing will be restricted if:

• your personal data is inaccurate, until we verify its accuracy,
• we are processing your personal data unlawfully, but you do not agree to its erasure and instead request that we merely restrict its processing,
• we no longer need your data, but you need it to establish, exercise or defend legal claims,
• you have objected to the processing of your personal data, until it has been verified whether our legitimate interests override your reasons.

Right to data portability

You have the right to request that we provide you with your personal data in electronic form (e.g. an XML or CSV file) allowing you to easily transfer the data to another company. You may also ask us to transfer your personal data directly to a company of your choice. We will comply with your request provided that you supplied us with the personal data yourself and gave us your consent to its processing.

Right to object

You have the right to object to our processing of your personal data. If we process your personal data in the following cases:

• on the basis of our legitimate interest,
• the creation of a customer profile,
• you may object to their processing, provided you have personal reasons for doing so.

How can you exercise these rights?

You may contact us with your request in one of the following ways: by e‑mail: maresova@habrinol.cz, or by post to the address: Tovární 63, 407 11 Děčín XXXII‑Boletice nad Labem, Czech Republic.

If you believe that your rights to the protection of personal data have been violated, you have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection, at the following address:

This Privacy Policy is valid and effective from: 24 April 2019, updated on: 17 April 2026.