Customer support:+420 720 949 310info@gbcreative.cz
    Currency
    EUR
    Language
    English
    Home / Privacy Policy

    PRIVACY POLICY

    Privacy Policy

    within the meaning of Article 30 of Regulation (EU) 2016/679 – GDPR

    I. Basic provisions

    1. Personal data controller

    The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”) is GB Creative s.r.o., company identification number: 22490558, with its registered office at Březenecká 4808, 430 04 Chomutov (hereinafter the “Controller”).

    Controller’s contact details:
    Address: Březenecká 4808, 430 04 Chomutov
    Email: info@gbcreative.cz
    Telephone: 720 949 310

    2. Data protection officer

    Contact details of the data protection officer:

    Ing. Milada Svobodová
    Telephone: 720 949 310
    Email: milada.svobodova@gbcreative.cz

    3. Purposes of processing

    We process your personal data for the following purposes:

    • Processing your order

    • Marketing campaigns

    • Handling complaints concerning defective goods

    • Responding to your enquiries

    • Providing targeted offers of our goods and services

    • Retaining purchase history for targeted offers

    4. Scope of personal data processing

    Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is someone who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

    We process only the data strictly necessary for the purposes listed above.

    In particular, we process the following data:

    • First name and surname

    • Delivery address for the goods ordered

    • Billing details in the case of payment against an invoice

    • Telephone number

    • Email address

    • Purchase history for complaints concerning defective goods or repeat orders

    • History of activity in email campaigns to personalise offers

    II. Sources and categories of personal data processed

    1. The Controller processes personal data you have provided, as well as personal data obtained by the Controller in the course of fulfilling your order.

    2. The Controller processes, in particular, your identification and contact details and data necessary for performance of the contract.

    III. Legal basis and purpose of personal data processing

    1. Legal basis for processing

    The legal basis for processing personal data is:

    • Performance of a contract between you and the Controller pursuant to Article 6(1)(b) GDPR.

    • The Controller’s legitimate interest in direct marketing, particularly sending commercial communications and newsletters, pursuant to Article 6(1)(f) GDPR.

    • Your consent to the processing of personal data for direct marketing purposes, particularly sending commercial communications and newsletters, pursuant to Article 6(1)(a) GDPR in conjunction with Section 7(2) of Czech Act No. 480/2004 Coll., where no order for goods or services has been placed.

    2. Purpose of processing

    The purposes of personal data processing are:

    • Processing your order and exercising rights and fulfilling obligations arising from the contractual relationship between you and the Controller. When placing an order, personal data necessary for its successful fulfilment is required (name, address, contact details). Providing personal data is a necessary condition for concluding and performing the contract. Without this data, the contract cannot be concluded or performed.

    • Sending commercial communications and carrying out other marketing activities.

    3. Automated decisions

    The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR. You have given your explicit consent to such processing where required in an individual case.

    IV. Personal data retention period

    The Controller retains personal data:

    • For the period necessary to exercise rights and fulfil obligations arising from the contractual relationship between you and the Controller and to enforce claims arising from that relationship, but no longer than 15 years after the contractual relationship ends.

    • Until consent to the processing of personal data for marketing purposes is withdrawn, but no longer than 10 years, where the data is processed on the basis of your consent.

    After the retention period expires, the Controller deletes the personal data.

    V. Recipients of personal data (the Controller’s processors)

    Recipients of personal data are persons:

    • Involved in delivering goods, providing services or processing payments under the contract.

    • Providing services for the operation of the online shop and related services.

    • Providing marketing services.

    The Controller does not intend to transfer personal data to a third country outside the EU or to an international organisation.

    VI. Your rights

    1. Rights under the GDPR

    Subject to the conditions laid down in the GDPR, you have:

    • The right to access your personal data pursuant to Article 15 GDPR.

    • The right to rectification of personal data pursuant to Article 16 GDPR or to restriction of processing pursuant to Article 18 GDPR.

    • The right to erasure of personal data pursuant to Article 17 GDPR.

    • The right to object to processing pursuant to Article 21 GDPR.

    • The right to data portability pursuant to Article 20 GDPR.

    • The right to withdraw your consent at any time in writing or electronically using the contact details specified in Section III.

    2. Right to lodge a complaint

    You also have the right to lodge a complaint with the competent data protection supervisory authority if you believe that your right to personal data protection has been infringed.

    VII. Personal data security measures

    1. The Controller declares that it has taken all appropriate technical and organisational measures to protect personal data.

    2. The Controller has taken technical measures to secure data storage systems and paper archives containing personal data.

    3. The Controller declares that only the Controller and persons authorised by the Controller have access to personal data.

    VIII. Final provisions

    1. By submitting an order through the online order form, you confirm that you are familiar with these personal data protection terms, accept them in full and consent to the processing of your personal data.

    2. By ticking the relevant box in the online form, you confirm that you are familiar with these personal data protection terms, accept them in full and consent to the processing of your personal data.

    3. The Controller is entitled to amend these personal data protection terms. The new version will be published on the website and simultaneously sent to the email address you have provided.

    These terms take effect on 2.10. 2026.

    We are registered with the Office for Personal Data Protection. The public register is available at:
    http://www.uoou.cz/uoou.aspx?menu=29&submenu=30