Privacy Policy (GDPR)

I. Basic provisions

• The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 (GDPR) is
  ‍Vintage Garage Motors a.s.,
  Company ID: 09720260,
  registered office: Strančická 45, 100 00 Prague 10 – Strašnice
  ‍(hereinafter referred to as the "controller").
• Controller contact details:
  ‍Address: Strančická 45, 100 00 Prague 10 – Strašnice
  ‍Email: moto@vintage-garage.cz
  ‍Phone: +420 777 702 270
• Personal data means any information relating to an identified or identifiable natural person.
• The controller has not appointed a Data Protection Officer.

II. Sources and categories of personal data processed

• The controller processes personal data that you provide by:
  filling out a contact form,
  inquiring about services,
  ordering goods or services,
  direct communication.
• We primarily process:
  identification and contact details (name, phone number, email, address),
  data necessary for the performance of a contract, communication, and sending offers.

III. Legal basis and purpose of processing

• We process personal data based on:
  ‍performance of a contract pursuant to Article 6(1)(b) of the GDPR,
  ‍legitimate interest of the controller (direct marketing) pursuant to Article 6(1)(f) of the GDPR,
  ‍consent pursuant to Article 6(1)(a) of the GDPR — particularly for newsletters and commercial communications if no order has been placed.
• Purposes of processing:
  processing orders or service inquiries,
  communicating with customers and interested parties,
  sending commercial communications, newsletters, and marketing information.
• The controller does not engage in automated individual decision-making as per Article 22 of the GDPR.

IV. Data retention period

• We retain personal data:
  for the period necessary to fulfill the contract and for subsequent purposes (no longer than 10 years from the termination of the contractual relationship),
  for the duration of the consent granted for sending commercial communications (max. 5 years) or until such consent is withdrawn.
• Once the retention period has expired, personal data will be deleted.

V. Recipients of personal data

• Recipients of personal data may include:
  parties involved in the delivery of goods/services,
  web, IT, and hosting service providers,
  accounting and marketing service providers.
• The controller may transfer personal data outside the EU to cloud or mailing service providers, always in accordance with the GDPR and based on EU standard contractual clauses ensuring an adequate level of protection.

VI. Your Rights

You have the right:

• to access your personal data pursuant to Article 15 of the GDPR,
• to rectification pursuant to Article 16 of the GDPR,
• to erasure pursuant to Article 17 of the GDPR,
• to restriction of processing pursuant to Article 18 of the GDPR,
• to data portability pursuant to Article 20 of the GDPR,
• object to processing pursuant to Article 21 of the GDPR,
• withdraw your consent to the processing of personal data at any time.

If you have any doubts regarding compliance with the GDPR, you have the right to file a complaint with the Office for Personal Data Protection(www.uoou.cz).

VII. Personal Data Security

• The controller has implemented technical and organizational measures to protect personal data.
• These measures include, in particular:
  password protection for systems,
  use of encrypted connections (HTTPS),
  regular software updates,
  antivirus protection,
  secure document storage.
• Only authorized persons have access to personal data.

VIII. Final Provisions

• By submitting an inquiry, form, or order, you confirm that you have read these privacy policy terms.
• The controller reserves the right to update these terms. The new version will always be published on the website.