Personal data processing rules of GWP Klima s.r.o.
Effective from: April 27, 2026
These Personal Data Processing Rules ("PDPR") were issued by GWP Klima s.r.o., with registered office at Kurzova 2222/16, Stodůlky, 155 00 Praha 5, ID No.: 24424790, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 440437 (the "Company"). These PDPR describe how the Company collects, processes, and shares information of users (the "user") of the website gwpklima.cz, and of customers (the "customer") using its services.
The Company is both the controller and processor of personal data of customers who provide it when requesting or ordering services. The Company may also use other processors listed below to process personal data.
We recommend that you read the entire PDPR and ensure that you fully understand the information provided. If you have any questions regarding these PDPR or the collection, processing, and sharing of personal data by the Company, please contact us at [email protected].
The Company processes data obtained from the use of the website and through cookies. For better targeting of advertising campaigns and improving the website, the Company uses information about the user, the pages visited, links clicked, and other activities on the website such as filling in inquiry and contact forms. This data is collected automatically through the Company's tools and the tools of the data processors listed below. If you have cookie storage enabled on your device, this data is also collected through these files.
The Company primarily processes data you provide in the inquiry or contact form. Some personal data is necessary to fill in the form (name and email address) and serves for basic identification of the user.
The data the Company processes:
The Company knowingly does not collect information from persons under 18 years of age and persons under 18 cannot use its services. If you become aware that a person under 18 has provided us with personal information in violation of these PDPR, you can notify us at [email protected].
The Company always processes personal data exclusively for the purposes for which it was collected, on the basis of legitimate interest, legal obligation or granted consent. We process personal data for various purposes, primarily for:
Personal data is primarily processed by the Company and its employees, who are bound by confidentiality, and by the Company's service providers if processed in connection with fulfillment and execution of contracts (e.g., accounting firm, lawyers).
The Company may also use processors. These entities may process personal data only for the purposes and in the manner determined by the Company and may not extend them without further consent. We pass to processors only the data they absolutely need to provide their services. The Company uses as processors:
Personal data may be transferred to these entities:
Personal data for the purposes mentioned in point 2 is processed to the extent necessary to fulfill these purposes and for the time necessary to achieve them, or for the time directly stipulated by legal regulations. After that, personal data is deleted or anonymized.
After this period, personal data may be retained only for state statistical service, scientific, and archival purposes.
Data of customer contact persons is processed for the entire duration of the business relationship, or until the customer updates the data.
For service customers, the Company is entitled to process their basic personal, identification, contact data, service data, and data from their communication with the Company for 10 years from the date of termination of the last contract.
Invoices issued by the Company are archived for 10 years from their issue in accordance with § 35 of Act No. 235/2004 Coll., on Value Added Tax. Due to the need to prove the legal reason for issuing invoices, contracts are also archived for 10 years from the date of termination.
Data obtained for marketing purposes is processed for the entire duration of consent, including the time when the user allows storage in the cookie settings on the website or in their browser. Processing may continue even after consent is withdrawn, but no longer than until the expiration of the relevant type of Cookies.
Cookie consent records (consent logs) are retained for 3 years for the purpose of demonstrating granted consent according to Article 7(1) GDPR.
Customers can cancel the receipt of any marketing and commercial communications at any time, by:
The user can adjust advertising targeting (Cookies) at any time via the "Cookie settings" button on the Cookies page or by changing settings directly in their browser. If you disable storage of selected Cookies, some parts of the website may not work correctly.
Processing of personal data takes place both manually and automatically in electronic information systems, in electronic or paper form, always with high technical, organizational and personnel security in line with the requirements of generally binding legal regulations.
All persons who, by virtue of their work position (or contractual obligations), come into contact with personal data are trained and bound by confidentiality.
The data subject will have the following rights in case they are an identifiable natural or legal person and prove their identity:
According to Article 15 GDPR, the data subject has the right of access to personal data, which includes the right to obtain from the Company confirmation of whether it processes their personal data, information about the purposes of processing, categories of personal data concerned, recipients, planned processing duration, the right to request rectification or erasure from the controller, the right to lodge a complaint with the supervisory authority, and, where the rights and freedoms of others are not adversely affected, also a copy of the personal data. In case of repeated requests, the Company will be entitled to charge a reasonable fee for the copy of personal data.
According to Article 16 GDPR, you have the right to rectification of inaccurate personal data the Company processes about you. You also have the obligation to notify changes to your personal data and to prove that such a change has occurred. We will perform the rectification without undue delay, always with regard to the technical possibilities.
According to Article 17 GDPR, you have the right to erasure of personal data concerning you, unless the Company demonstrates legitimate reasons for processing such personal data. The Company has set up mechanisms to ensure automatic anonymization or erasure of personal data when it is no longer needed for the purpose for which it was processed.
According to Article 18 GDPR, the data subject has the right, until the matter is resolved, to restriction of processing if they dispute the accuracy of personal data, the reasons for its processing, or if they raise an objection to its processing, in writing to the address of the Company's registered office.
According to Article 19 GDPR, the data subject has the right to be notified by the Company in case of rectification, erasure or restriction of processing of personal data.
According to Article 20 GDPR, you have the right to portability of data concerning you that you have provided to us as the controller, in a structured, commonly used, and machine-readable format. You also have the right to ask us to transmit this data to another controller.
According to Article 21 GDPR, you have the right to object to the processing of your personal data by the Company. If the Company does not demonstrate that there is a serious legitimate reason for processing that overrides the interests or rights and freedoms of the data subject, the Company will end the processing on the basis of the objection without undue delay.
If you grant the Company consent to process personal data, it is possible to withdraw it at any time. Withdrawal must be made by an explicit, comprehensible and definite expression of will, either in writing to the address of the Company's registered office, or via the email address [email protected].
The data subject has the right not to be subject to any decision based solely on automated processing, including profiling. The Company states that it does not perform automated decision-making without human assessment with legal effects for data subjects.
You have the right to lodge a complaint regarding our processing of your personal data with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7. Office website: www.uoou.cz.
The Company undertakes to protect personal data and other information about its customers and users of its services. To this end, it uses a range of security technologies and measures designed to protect information from unauthorized access, use, or disclosure. The website uses HTTPS encrypted data transmission, sensitive data is protected against CSRF and XSS attacks. Personal data security is regularly tested by the Company and protection is constantly improved. However, please bear in mind that 100% certainty cannot be guaranteed on the internet. All personal data in electronic form is stored in databases and systems accessible only to persons who need to handle personal data directly for the purposes specified in these rules, and only to the extent necessary.
If you have any questions regarding the processing of personal data or wish to exercise your rights, do not hesitate to contact us at [email protected].
The controller of your personal data is GWP Klima s.r.o., with registered office at Kurzova 2222/16, Stodůlky, 155 00 Praha 5, ID No.: 24424790, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 440437.
We hereby inform you that we may modify or update these Personal Data Processing Rules at any time.
Any changes to these rules become effective upon their publication at https://gwpklima.cz/en/ochrana-osobnich-udaju.
