# Privacy Policy

**Carbon Planet s.r.o.**

Registered office: Chodouň 215, 267 51 Zdice, Czech Republic
Company registration number (IČO): 09086536
Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 330640
E-mail: info@carbonplanet.cz · Telephone: +420 603 426 334, +420 607 211 585

for the on-line shop at www.carbonplanet.cz

> **Note on this English version.** This document is an informative translation. The binding wording is the Czech version. In the event of any discrepancy between the Czech and the English wording, the Czech wording prevails.

This document fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "**GDPR**") and under Act No. 110/2019 Coll., on personal data processing.

---

## 1. Data controller

1.1. The controller of personal data is **Carbon Planet s.r.o.**, company registration number 09086536, with its registered office at Chodouň 215, 267 51 Zdice, Czech Republic (hereinafter the "**Controller**" or "**we**").

1.2. Contact details for all matters concerning the protection of personal data: e-mail **info@carbonplanet.cz**, telephone +420 603 426 334, +420 607 211 585, postal address Chodouň 215, 267 51 Zdice, Czech Republic.

1.3. The Controller has not appointed a data protection officer, as no such obligation has arisen under Article 37 of the GDPR.

1.4. Personal data means any information relating to an identified or identifiable natural person. Data concerning legal entities are not personal data; however, where an order contains the contact details of a specific natural person acting on behalf of a legal entity, those details are personal data and this Privacy Policy applies to them.

---

## 2. What data we process, for what purpose and on what legal basis

| Purpose of processing | Categories of data | Legal basis | Retention period |
|---|---|---|---|
| Conclusion and performance of the purchase agreement, processing of the order, delivery of goods, communication about the order | name and surname, delivery and billing address, e-mail, telephone, details of the goods ordered, company registration number and VAT number in the case of business buyers | Art. 6(1)(b) GDPR — performance of a contract | for the duration of the contractual relationship and a further 4 years after its termination (limitation period) |
| Bookkeeping, issuing and archiving of tax documents | billing details, payment details | Art. 6(1)(c) GDPR — compliance with a legal obligation (Act No. 563/1991 Coll., on Accounting; Act No. 235/2004 Coll., on VAT) | 5 years, or 10 years for documents where required by law |
| Handling of complaints and rights arising from defective performance | identification and contact details, description of the defect, photographic documentation, proof of purchase | Art. 6(1)(b) and (c) GDPR | 4 years from settlement of the complaint |
| Operation of the user account in the e-shop | username, e-mail, password (in encrypted form), order history | Art. 6(1)(b) GDPR | for as long as the account exists; we cancel accounts after 24 months of inactivity or at your request |
| Documentation for custom-made production (models, scans, drawings, photographs of parts or vehicles) | technical documentation supplied by the customer, and where stated on such documentation, a registration plate or VIN | Art. 6(1)(b) GDPR | for the duration of the contractual relationship and a further 4 years, unless agreed otherwise with you |
| Protection of legal claims, recovery of receivables | identification and contact details, order and payment details | Art. 6(1)(f) GDPR — legitimate interest in protecting our rights | for the duration of the dispute and 1 year thereafter |
| Traffic measurement and improvement of the website (Google Analytics) | device data, IP address, behaviour on the website, cookie identifiers | Art. 6(1)(a) GDPR — your consent given in the cookie bar | until consent is withdrawn, at the longest for the lifetime of the relevant cookies |

2.2. Providing the personal data listed in the first row of the table is a contractual requirement. Without it, the purchase agreement cannot be concluded and the order cannot be processed. All other processing is voluntary.

2.3. **Commercial communications.** We do not currently send commercial communications. Should we introduce this service, we will process your e-mail address either on the basis of your separately given consent under Art. 6(1)(a) GDPR or — where our own similar goods are concerned and we obtained your contact details in connection with a sale — on the basis of legitimate interest under Art. 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Coll. Every commercial communication will contain a link for free unsubscription, and you may also end your subscription at any time by e-mail to info@carbonplanet.cz. We will inform you in advance by updating this Privacy Policy before the service is launched.

---

## 3. Where we obtain the data

3.1. We obtain personal data directly from you — from the order form, from the registration of a user account, from e-mail and telephone communication, and from the documentation you provide to us for the purposes of custom-made production.

3.2. Some data are generated automatically when you visit the website (see the last row of the table in Article 2).

---

## 4. Recipients of the data

4.1. We disclose your personal data only to the extent necessary to fulfil the purposes set out above. The recipients are:

**Processors (processing data on our instructions):**

- **Bohemiasoft s.r.o.**, company registration number 28090403 — operation of the Webareal e-shop system and related hosting
- **Google Ireland Limited** — Google Analytics (only where consent to analytical cookies has been given)
- an external accounting firm handling the Controller's bookkeeping

**Independent controllers (processing data under their own responsibility):**

- the carriers we select for delivery of the consignment: **Česká pošta, s.p.**, **PPL CZ s.r.o.**, **DHL Express (Czech Republic) s.r.o.**, **United Parcel Service Czech Republic, s.r.o.**, **FedEx Express Czech Republic s.r.o.**, **TOPTRANS EU, a.s.**
- **Česká spořitelna, a.s.** — maintenance of the bank account and processing of payments
- **PayPal (Europe) S.à r.l. et Cie, S.C.A.** — payment processing, where this payment method has been arranged with you
- public authorities, where required by law (tax authority, Czech Trade Inspection Authority, courts, law enforcement authorities)

4.2. We have concluded a data processing agreement under Article 28 of the GDPR with each processor.

4.3. We do not publish personal data and we do not sell them to third parties for their own marketing purposes.

---

## 5. Transfers of data outside the EU

5.1. As a rule, we process personal data within the European Union.

5.2. The exception is **Google Analytics**, where data may be transferred to the United States of America. Such transfer takes place on the basis of the European Commission's adequacy decision under the **EU–U.S. Data Privacy Framework**, or on the basis of standard contractual clauses approved by the European Commission. This processing takes place only if you consent to analytical cookies.

5.3. Similarly, a transfer to a third country may occur in the case of international carriage of a consignment where the place of delivery is outside the EU, and solely to the extent of the data necessary for delivery and customs clearance.

---

## 6. Your rights

6.1. In relation to your personal data, you have the following rights:

- **right of access** (Art. 15 GDPR) — to find out what data we process about you and to obtain a copy;
- **right to rectification** (Art. 16 GDPR) — to have inaccurate data corrected or incomplete data completed;
- **right to erasure** (Art. 17 GDPR) — the so-called right to be forgotten; this does not apply where we have a legal obligation to retain the data, typically in the case of accounting documents;
- **right to restriction of processing** (Art. 18 GDPR);
- **right to data portability** (Art. 20 GDPR) — to receive the data in a machine-readable format or to have them transmitted to another controller;
- **right to object** to processing based on legitimate interest (Art. 21 GDPR);
- **right to withdraw consent** where processing is based on consent (analytical cookies, future commercial communications). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;
- **right to lodge a complaint** with the supervisory authority.

6.2. You may exercise these rights by e-mail at **info@carbonplanet.cz** or in writing at the Controller's registered office. We will deal with them without undue delay, at the latest within one month of receipt of the request; in justified cases this period may be extended by a further two months, of which we will notify you. In order not to disclose data to the wrong person, we may ask you to verify your identity.

6.3. The supervisory authority is the **Office for Personal Data Protection** (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. If you reside in another EU Member State, you may also lodge a complaint with the supervisory authority of that state.

---

## 7. Automated decision-making and profiling

7.1. No automated decision-making or profiling within the meaning of Article 22 of the GDPR takes place in the processing of your personal data.

---

## 8. Security of personal data

8.1. We have adopted appropriate technical and organisational measures to secure personal data, in particular:

- encrypted transfer of data between the website and the browser (HTTPS/TLS);
- controlled access to systems, limited to authorised persons and based on individual access credentials;
- regular updates of the software used and protection of end devices;
- regular data backups;
- an obligation of confidentiality for persons who come into contact with personal data.

8.2. In the event of a personal data breach involving a risk to your rights and freedoms, we will report it to the Office for Personal Data Protection within 72 hours and, where the risk is high, we will also inform you directly.

---

## 9. Cookies

9.1. The terms of use of cookies, their categories and the option to withdraw consent are set out in a separate document available on the website. Cookies that are not strictly necessary for the operation of the website — including the analytical cookies of the Google Analytics service — are stored only with your prior consent given in the cookie bar.

---

## 10. Final provisions

10.1. By sending an order you confirm that you have acquainted yourself with this Privacy Policy. This Privacy Policy does not constitute consent to processing; the processing of data necessary to fulfil your order is carried out on the basis of performance of a contract, not on the basis of your consent.

10.2. We may update this Privacy Policy, in particular where the method of processing, the range of processors or the applicable legislation changes. The current wording will always be published on the website.

10.3. This Privacy Policy takes effect on **1 August 2026** and replaces the previous wording of 8 June 2022.