AIR EXTRACTION AND FILTRATION

1. Introductory Provisions

The data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the ‘GDPR’) is:

Company / name: CIPRES FILTR BRNO s.r.o.

Registered office / address: Rebešovická 13, Brno 643 00

Company registration number: 46976531

Represented by: Ing. Přemysl Pazdera

Contact: email: cipres@cipres.cz, tel.: 545220506

(hereinafter referred to as the ‘controller’).

1.1. When processing personal data, the Controller complies with the GDPR, Act No. 101/2000 Coll., on the Protection of Personal Data, Act No. 89/2012 Coll., the Civil Code, and other relevant legislation.

1.2. Set out below is a list of personal data, the manner in which it is processed, the period for which your personal data is processed, the purpose of such processing, as well as the information provided to you, as data subjects, by the controller.

2.  Categories of personal data

2.1. The controller processes only the essential basic data, namely:

• identification data (your first name and surname, business name, residential or registered address, and, where applicable, your postal address, company registration number, VAT number and date of birth)
• contact details (your email address and your telephone number or, where applicable, your IP address).

2.2. The controller processes personal data that you have provided to it or personal data that the controller has obtained in connection with the fulfilment of your order.

3. Reason and purpose of personal data processing

3.1. The lawful basis for the processing of personal data is:

• the performance of a contract to which you, as the data subject, are a party,
• compliance with the Controller’s legal obligations,

3.2. The Controller processes personal data for the purpose of fulfilling your order, for the purpose of complying with its own legal obligations towards the state (e.g. tax obligations) and for the purpose of marketing activities.

3.3. You may withdraw the consent you have given to the controller to receive marketing communications at any time (see section 7.6 of the Policy).

4. Retention period for personal data

4.1. The Controller retains your personal data for the period necessary to exercise the rights and fulfil the obligations arising from the contractual relationship, or for the period necessary to comply with archiving obligations under other legislation (the Accounting Act, the Act on Archiving and Records, the VAT Act), but for no longer than 10 years from the termination of the contractual relationship. Unless you withdraw your consent to the processing of personal data for direct marketing purposes, the data will be processed for a maximum of 3 years.

4.2. Once the retention period for personal data has expired, we will delete your personal data.

5. Security of personal data

5.1. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons posed by the processing, the controller has implemented appropriate technical and organisational measures to comply with the requirements of the GDPR and to protect the rights of data subjects.

6. Recipients of personal data

6.1. The controller does not disclose personal data to third parties.

6.2. We do not transfer your personal data to a country outside the European Union. Personal data is processed both manually and by automated means.

7. Your rights

Right of access to personal data (Article 15 of the GDPR)

7.1. You have the right to request access to the personal data concerning you that is being processed, and to the following information:

• the purpose of the processing of personal data;
• the categories of personal data being processed;
• the categories of recipients to whom your personal data have been or will be disclosed;
• the period for which the personal data will be processed and stored;
• any available information regarding the source of the personal data, where it has not been obtained from you;
• whether automated decision-making, including profiling, takes place.

Right to rectification of personal data (Article 16 of the GDPR)

7.2. You may contact us to request rectification if the data we hold about you is inaccurate, incomplete or out of date. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure of personal data (Article 17 of the GDPR)

7.3. You may contact us to request that your personal data be erased if:

1. the data is no longer necessary for the purpose for which it was collected or otherwise processed,
2. you have withdrawn your consent to the processing of the data,
3. the data has been processed unlawfully,
4. the data must be erased to comply with a legal obligation under EU or Member State law to which the controller is subject, or
5. you have objected to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

Right to restriction of processing of personal data (Article 18 of the GDPR)

7.4. You have the right to have the processing of your personal data restricted if:

• you contest the accuracy of the personal data, for the period necessary for us to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead;
• we no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims;
• you have objected to the processing pursuant to Article 21(1) of the GDPR, pending verification of whether our legitimate grounds override your legitimate grounds.

If you have obtained a restriction on processing, you will be notified in advance that the restriction on processing will be lifted.

Right to data portability (Article 20 of the GDPR)

7.5. You may request that we provide you with your personal data in a structured, commonly used and machine-readable format, or that this data be transferred directly to another controller, provided that:

1. the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and
2. the processing is carried out by automated means.

The right to withdraw your consent to the processing of personal data at any time

7.6. You may withdraw your consent to the processing of personal data at any time, without this affecting the lawfulness of processing based on consent prior to its withdrawal.

Right to object to the processing of personal data (Article 21 of the GDPR)

7.7. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f), including profiling based on those provisions. We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

7.8. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling in so far as it relates to such direct marketing.

8. Right to lodge a complaint

8.1 If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority, which is:

The Office for Personal Data Protection,

registered office at Pplk. Sochora 27, 170 00 Prague 7

DS ID: qkbaa2n

Email: posta@uoou.cz

Landline: +420 234 665 111 (Switchboard)

Fax: +420 234 665 444

Personal data breaches

8.2 If a particular personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you of the breach without undue delay. The notification shall describe the nature of the personal data breach and shall set out, at a minimum, the information and measures referred to in Article 33(3)(b), (c) and (d) of the GDPR. This notification is not required if any of the following conditions are met:

1. we have implemented appropriate technical and organisational security measures, and these measures were applied to the personal data affected by the personal data breach, in particular those that render such data unintelligible to any person not authorised to access it, such as encryption;
2. we have taken follow-up measures to ensure that the high risk to your rights and freedoms is no longer likely to materialise;
3. it would require a disproportionate effort.

Data Protection Officer

8.3 The data controller does not have a designated Data Protection Officer. For matters relating to the processing of personal data, you may contact us directly at CIPRES FILTR BRNO s.r.o.

Postal address: Rebešovická 13, Brno 643 00

Email: cipres@cipres.cz

All contact details can also be found on the controller’s website: www.cipres.cz.

This Policy is effective from 22 May 2026.