1. CONTENT AND PURPOSE OF THE DOCUMENT

1.1 This document contains information on the protection of personal data provided by visitors to the website www.provendia.cz, our clients, and those interested in our services and products across the European Union and beyond.

1.2 The purpose of this document is to inform you (data subjects) about your rights and provide clear information on how your personal data will be processed.

1.3 We appreciate your trust in providing us with your personal data. Therefore, we process it in accordance with Act No. 110/2019 Coll. on Personal Data Protection, as amended, and Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018. If applicable, we also comply with relevant national data protection laws in the countries where we operate.

1.4 Content of the document:

• Data Controller – Who are we, and how can you contact us?
• What personal data do we process, and how do we obtain it?
• For what purposes do we process personal data, for how long, and on what legal basis?
• Your rights regarding personal data protection
• How to exercise your rights

2. DATA CONTROLLER – WHO ARE WE, AND HOW CAN YOU CONTACT US?

Provendia s.r.o., Company ID: 02233827, registered office: Hlavní 108, 664 31 Lelekovice, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, file number C 93623/KSBR.

Contact details:

Email: info@provendia.eu

Phone: +420 730 809 411

Website: www.provendia.cz

For data subjects in other EU countries, we comply with GDPR and cooperate with local data protection authorities as needed.

3. WHAT PERSONAL DATA DO WE PROCESS, AND HOW DO WE OBTAIN IT?

3.1 We process data that you provide to us directly, such as:

• Filling out forms on our website
• Registering a user account
• Preparing contracts
• Communicating during contract execution
• Personal contact, telephone, or email communication

3.2 We may also process publicly available data, such as from the commercial register or social networks (Facebook, Instagram, LinkedIn).

3.3 If we require consent to process certain data, we only process such data with your explicit consent.

3.4 Providing personal data is voluntary but may be necessary to fulfill contracts or legal obligations.

3.5 Processed personal data:

• Name, surname, title
• Address
• Company ID, phone, email
• IP address, cookies
• Information on ordered goods and services
• Photographs and video recordings from company events

3.6 We do not process special category (sensitive) data.

4. PURPOSES, DURATION, AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

4.1 Contract conclusion and fulfillment

• Legal basis: Contract performance.
• Retention period: For the duration of the contract and 5 years after its termination according to applicable legal regulations.

4.2 Fulfillment of legal obligations

• Legal basis: Compliance with legal regulations (e.g., accounting or tax laws).
• Retention period: At least 10 years under the Accounting Act.

4.3 Legitimate interests

• We may process personal data to protect our rights, direct marketing, and other legitimate interests permitted under GDPR.
• Legal basis: Our legitimate interest.
• Retention period: Until the legitimate interest ceases or an objection is raised.

4.4 Processing based on consent

• If you have given us consent, we may send you commercial communications.
• Legal basis: Your consent.
• Retention period: Until consent is withdrawn.

4.5 Data transfer outside the EU

• If we transfer personal data outside the EU (for example, using cloud services based in third countries), we ensure appropriate safeguards such as:
• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Other GDPR-compliant security measures

5. YOUR RIGHTS REGARDING PERSONAL DATA PROTECTION

5.1 Right of access

You may request confirmation of whether we process your personal data and access it.

5.2 Right to rectification

If your data is inaccurate or incomplete, you have the right to request correction.

5.3 Right to erasure ("right to be forgotten")

You may request the deletion of your data if it is no longer needed or if you withdraw consent.

5.4 Right to restriction of processing

In certain cases, you may request the restriction of processing.

5.5 Right to data portability

Under GDPR conditions, you have the right to receive your data in a portable format.

5.6 Right to object

If we process data based on legitimate interest, you may object.

5.7 Right to lodge a complaint with a supervisory authority

If you believe your rights are being violated, you may contact the relevant Data Protection Authority:

Czech Republic: The Office for Personal Data Protection (https://www.uoou.cz/)

Germany: The Federal Commissioner for Data Protection and Freedom of Information (https://www.bfdi.bund.de/)

France: Commission Nationale de l'Informatique et des Libertés (https://www.cnil.fr/)

Other EU countries: Check with the national data protection authority.

6. HOW TO EXERCISE YOUR RIGHTS

If you have any questions or wish to exercise your rights, please contact us at info@provendia.eu. We may request identity verification when submitting a request.

This document is effective from February 21, 2025.
The current version is always available at www.provendia.cz.