This is an English translation provided for convenience. In case of any discrepancy, the Czech version prevails.
In this policy we explain what personal data we process, why, on what legal basis, for how long and what rights you have. This policy is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data. Information on cookies can be found in the separate Cookie Policy, and the rules of cooperation in the Terms and Conditions.
1. Data controller
The controller of your personal data is:
- GroupcZ s.r.o., with its registered office at Gellnerova 163/16, Mladá Boleslav II, 293 01 Mladá Boleslav, Czech Republic,
- ID No. (IČO): 24297399, VAT No. (DIČ): CZ24297399,
- registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 194058
(the “Controller” or “we”).
2. Contact details
You can contact us in all matters relating to personal data:
- by e-mail at info@groupcz.eu,
- by post to our registered office: GroupcZ s.r.o., Gellnerova 163/16, 293 01 Mladá Boleslav, Czech Republic.
No data protection officer has been appointed, as we are not subject to this obligation under Article 37 GDPR. Your requests are handled directly by the company’s management.
3. What personal data we process
Contact form and e-mail communication
When you write to us using the contact form on the website, we process the data you provide to us yourself:
- first name, surname and company name,
- e-mail address,
- telephone number (optional),
- the selected topic of your enquiry and the content of your message,
- confirmation that you have read the information on the processing of personal data, and technical data about the submission (date and time, IP address).
The form is processed by a script on our server and its content is delivered to us by e-mail. Please do not enter special categories of personal data (e.g. health data) into the form.
Business cooperation
For customers and suppliers, we process identification and contact data of contact persons (name, job title, e-mail, telephone), billing data, data on orders, contracts and payments, and the content of mutual communication.
Visiting the website
When you visit the website, the server processes technical data necessary for its operation and security (IP address, browser type, time of request, requested page) in the form of server logs. We also store a cookie with your consent choice – details can be found in the Cookie Policy.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Handling an enquiry from the contact form or e-mail, preparing an offer | Steps taken prior to entering into a contract at your request – Article 6(1)(b) GDPR; for general enquiries, our legitimate interest in replying to your message – Article 6(1)(f) GDPR |
| Conclusion and performance of a contract, communication with contact persons of customers and suppliers | Performance of a contract – Article 6(1)(b) GDPR; for contact persons of legal entities, legitimate interest – Article 6(1)(f) GDPR |
| Bookkeeping and compliance with tax obligations | Compliance with a legal obligation – Article 6(1)(c) GDPR (in particular the Accounting Act and the VAT Act) |
| Security of the website and servers, prevention of form misuse, establishment and defence of legal claims | Legitimate interest – Article 6(1)(f) GDPR |
| Analytics and marketing cookies (if deployed) | Consent – Article 6(1)(a) GDPR in conjunction with Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications |
Where processing is based on legitimate interest, we have carefully assessed that our interest does not override your rights and freedoms. You may object to such processing at any time (see Article 8).
Providing data in the contact form is voluntary; however, without your name, e-mail and message we cannot deal with your enquiry. Providing data for the purposes of a contract is a contractual requirement, and we are required by law to process certain data.
5. Data retention period
- Form enquiries and e-mail communication – for the time needed to deal with the enquiry and thereafter for a maximum of 12 months, unless a contractual relationship arises from it. If we conclude a contract, we retain the communication for the term of the contract and the limitation period for asserting claims arising from it.
- Contractual documentation – for the term of the contract and thereafter for the duration of the limitation periods, usually 4 years from its termination.
- Accounting and tax documents – 10 years from the end of the tax period in which the supply took place, as required by tax legislation.
- Data processed on the basis of consent – until consent is withdrawn, at most for the period stated for the relevant cookie.
- Server logs – for the period necessary to ensure security, usually no more than a few months.
After these periods expire, we delete or anonymise the data.
6. Recipients and processors
We do not sell your personal data or provide it to third parties for their own marketing. We may only make it available to vetted entities that help us with our operations and that are bound by a contract and a duty of confidentiality:
- the provider of web hosting and server infrastructure,
- the provider of e-mail services,
- an external accountant or tax adviser,
- providers of IT services and system administration,
- public authorities, where required by law (e.g. tax office, courts).
Website fonts
The website uses the Red Hat Display and Red Hat Mono fonts, which are hosted directly on our own server. No data is therefore transferred to third parties (such as the Google Fonts service) when they are loaded.
Form protection – Google reCAPTCHA v3
We protect the contact form against spam and automated attacks using the reCAPTCHA v3 service (Google Ireland Limited, or Google LLC). The service is only loaded once you start filling in the form. It evaluates technical data about your interaction with the page (e.g. IP address, browser and device data, movement and time on the page) and may store the essential cookie _GRECAPTCHA in your browser. The processing is based on our legitimate interest in protecting the website and the form against misuse (Article 6(1)(f) GDPR). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More in the Google Privacy Policy and Terms of Service.
7. Transfers of data outside the EU
We process your data primarily within the European Union and the European Economic Area. Data may be transferred to third countries (for example to the USA in connection with Google services) only if an adequate level of protection is ensured, in particular on the basis of an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).
8. Your rights
In connection with the processing of personal data, you have the following rights:
- right of access – to find out whether and what data we process about you and to obtain a copy (Article 15 GDPR),
- right to rectification of inaccurate data or completion of incomplete data (Article 16 GDPR),
- right to erasure where the data are no longer needed or the legal ground for their processing no longer applies (Article 17 GDPR),
- right to restriction of processing, for example while the accuracy of the data is being verified (Article 18 GDPR),
- right to data portability in respect of data you have provided to us and that we process by automated means on the basis of consent or a contract (Article 20 GDPR),
- right to object to processing based on legitimate interest (Article 21 GDPR),
- right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal; you can change your cookie consent using the “Cookie settings” button in the website footer.
You can exercise your rights by e-mail at info@groupcz.eu or by post to our registered office. We will reply without undue delay and at the latest within one month; in more complex cases this period may be extended by a further two months, of which we will inform you. To protect your data, we may ask you to verify your identity.
9. Right to lodge a complaint
If you believe that our processing of your personal data infringes the law, you may contact the supervisory authority:
Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
www.uoou.cz
We would appreciate it if you contacted us first with any concerns – we can resolve most situations quickly and directly.
10. Data security
Cyber security is one of the pillars of our work. We protect personal data by appropriate technical and organisational measures, in particular:
- encrypted data transmission (HTTPS/TLS),
- management and restriction of access rights to persons who need the data for their work,
- regular backups, updates and monitoring of systems,
- protection of the form against automated misuse,
- a contractual duty of confidentiality for employees and processors.
11. Automated decision-making
We do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
12. Changes to this policy
We may update this policy, for example in the event of changes in legislation, our services or the tools used on the website. The current version is always published on this page together with its effective date. We will inform you in an appropriate manner of any material changes that affect you.
This policy is effective from 12 October 2026.