Privacy Policy

1. Identity of the Controller

The controller of personal data collected through the website vevoro.info is Vevoro, with its registered place of business at Přemilovická 135, Karlovy Vary, Czech Republic, reachable by email at [email protected] and by telephone at +420 353 564 351. The controller is responsible for determining the purposes and means of processing personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "General Data Protection Regulation" or "GDPR"), as implemented and supplemented by Act No. 110/2019 Coll., on the Processing of Personal Data (the "Czech Data Protection Act"). Any questions relating to the processing of personal data may be directed to the contact details specified above.

2. Categories of Personal Data Collected

When visitors use this website, the following categories of personal data may be collected: (a) identification data, including full name and email address, submitted voluntarily through the contact form; (b) communication data, meaning the content of messages submitted through the contact form; (c) technical data, including IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, and other standard web server log data collected automatically when a visitor accesses the website; and (d) preference data, such as cookie consent choices stored in accordance with the Cookie Policy. No sensitive categories of personal data within the meaning of Article 9 GDPR are collected or processed through this website.

3. Legal Bases for Processing

Processing of personal data submitted through the contact form is carried out on the basis of the legitimate interest of the controller in responding to inquiries received from website visitors, pursuant to Article 6(1)(f) GDPR, and where applicable on the basis of steps taken at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR. Processing of technical data collected through server logs and analytics cookies is carried out on the basis of the legitimate interest of the controller in maintaining website security and understanding how the website is used, subject to the data subject's right to object. Processing of non-essential cookies is carried out on the basis of the data subject's freely given, specific, informed, and unambiguous consent pursuant to Article 6(1)(a) GDPR, obtained through the cookie consent mechanism described in the Cookie Policy.

4. Purposes of Processing

Personal data collected through the contact form is processed for the purpose of handling and responding to the inquiry submitted. Technical data is processed for the purposes of ensuring the technical functionality and security of the website, diagnosing technical errors, and understanding aggregate usage patterns to improve the website's content and structure. Cookie preference data is stored for the purpose of recording and honoring consent choices across sessions, so that the data subject is not asked to repeat their consent decision on each visit. The controller does not use personal data collected through this website for automated decision-making or profiling within the meaning of Article 22 GDPR.

5. Retention Periods

Personal data submitted through the contact form is retained for a period no longer than necessary to handle the inquiry and any subsequent communication arising from it, and in any event for no longer than twenty-four months from the date of last contact, unless a longer retention period is required by applicable law or by the legitimate interest of the controller in documenting the communication. Technical log data is retained for a period of up to twelve months. Cookie consent records are retained for a period of twelve months from the date of consent, after which the data subject may be asked to renew their preference. At the end of the applicable retention period, personal data is securely deleted or anonymized.

6. Recipients and Transfers of Personal Data

Personal data collected through this website may be shared with third-party service providers acting as data processors on behalf of the controller, including hosting providers responsible for operating the web server infrastructure and email service providers used to receive and manage contact form submissions. Such processors are bound by data processing agreements requiring them to process personal data only on documented instructions of the controller and to implement appropriate technical and organizational security measures. The controller does not sell, rent, or otherwise disclose personal data to third parties for their own marketing purposes. Where personal data is transferred outside the European Economic Area, such transfers are conducted on the basis of appropriate safeguards as required by Chapter V of the GDPR, including Standard Contractual Clauses approved by the European Commission.

7. Rights of Data Subjects

Under the GDPR and the Czech Data Protection Act, data subjects have the following rights in relation to their personal data: the right of access to personal data processed by the controller (Article 15 GDPR); the right to rectification of inaccurate or incomplete personal data (Article 16 GDPR); the right to erasure of personal data where the conditions of Article 17 GDPR are met; the right to restriction of processing in the circumstances described in Article 18 GDPR; the right to data portability for data processed on the basis of consent or contract (Article 20 GDPR); the right to object to processing based on legitimate interests or for direct marketing purposes (Article 21 GDPR); and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR). Requests to exercise any of these rights should be submitted in writing to [email protected]. The controller will respond within one month of receiving the request, with the possibility of extending this period by a further two months where necessary due to complexity.

8. Right to Lodge a Complaint

Data subjects who consider that the processing of their personal data infringes the GDPR or applicable national law have the right to lodge a complaint with a supervisory authority. In the Czech Republic, the competent supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, UOOU), with its registered address at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, website www.uoou.cz. This right exists without prejudice to any other administrative or judicial remedy available to the data subject.

9. Security Measures

The controller implements appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration, in accordance with Article 32 GDPR. These measures include encryption of data in transit using TLS, access controls limiting access to personal data to authorized personnel only, and regular review of security practices. No method of transmission over the internet or method of electronic storage is completely secure, and the controller cannot guarantee the absolute security of personal data.

10. Changes to This Privacy Policy

The controller reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, the services provided, or the controller's data processing practices. The date of the most recent revision is indicated at the top of this document. Continued use of the website after a revised Privacy Policy has been published constitutes acceptance of the revised terms to the extent permitted by applicable law. Where changes are material, the controller will take reasonable steps to notify data subjects, which may include displaying a notice on the website.