PRIVACY POLICY

PRIVACY POLICY

I. Basic Provisions

1. The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is DaSty Energy s.r.o., Company ID: 23152940, with its registered office at Masarykova 752/111, 252 19 Rudná (hereinafter referred to as the “Controller”).

2. Controller’s contact details:

• Address: Masarykova 752/111, 252 19 Rudná

• Email: info@dasty-energy.com

• Phone: +420 605 521 014

3. Personal data means any information relating to an identified or identifiable natural person.

4. The Controller has / has not appointed a Data Protection Officer. Contact details of the officer (if appointed): …

II. Sources and Categories of Personal Data Processed

1. The Controller processes personal data you have provided or personal data obtained through the fulfilment of your order.

2. The Controller processes identification and contact information and data necessary to fulfil the contract.

III. Legal Basis and Purpose of Processing

1. The legal basis for processing personal data is:

• Performance of a contract between you and the Controller under Article 6(1)(b) GDPR,

• Controller’s legitimate interest in direct marketing under Article 6(1)(f) GDPR,

• Your consent to processing for direct marketing purposes (sending commercial messages, newsletters) under Article 6(1)(a) GDPR in conjunction with §7(2) of Act No. 480/2004 Sb.

2. The purposes of processing:

• Order fulfilment and exercising rights and obligations arising from the contractual relationship,

• Sending commercial messages and carrying out marketing activities.

3. The Controller does / does not carry out automated individual decision-making pursuant to Article 22 GDPR. You have given your explicit consent to such processing.

IV. Data Retention Period

1. The Controller retains personal data:

• For the period necessary to fulfil the rights and obligations arising from the contract (15 years after termination),

• Until consent to marketing processing is withdrawn, for a maximum of … years.

2. After the retention period, personal data will be erased.

V. Data Recipients (Processor Subcontractors)

1. Recipients may include:

• Entities involved in goods/services delivery and payment processing,

• Providers of e-commerce services (e.g. Shoptet) and related services,

• Marketing service providers.

2. The Controller does / does not intend to transfer personal data to a third country or international organization. If yes, recipients may include providers of mailing or cloud services.

VI. Your Rights

Under the GDPR, you have:

• Right of access (Article 15),

• Right to rectification (Article 16),

• Right to restriction of processing (Article 18),

• Right to erasure (Article 17),

• Right to object (Article 21),

• Right to data portability (Article 20),

• Right to withdraw consent at any time by writing or emailing the Controller.

You also have the right to lodge a complaint with the Office for Personal Data Protection if you believe your rights have been violated.

VII. Data Security

1. The Controller declares all necessary technical and organizational measures have been taken.

2. Technical measures include securing data storage and physical documents.

3. Access to personal data is granted only to authorized persons.

VIII. Final Provisions

1. By submitting your order, you confirm you are familiar with and accept this privacy policy.

2. You consent to this policy by ticking the consent checkbox on the website.

3. The Controller reserves the right to update this policy. New versions will be published online and sent to your provided email.

This policy is effective from 25 May 2018.