GBH – Gaudete Bruder Holding s.r.o. Registered office: Dlouhá 730/35, Staré Město, 110 00 Prague 1, Czech Republic ID number: 10975187 E-mail: info@gbhdefence.com Website: gbhacademy.cz
Effective date: 18/02/2025 Operator: GBH – Gaudete Bruder Holding s.r.o. (hereinafter referred to as “Company” or “Provider”)
1. Introductory Provisions
GBH – Gaudete Bruder Holding s.r.o. (hereinafter referred to as “administrator”) hereby informs data subjects (hereinafter referred to as “client”, “user” or “data subject”) about the principles of personal data processing in accordance with Articles 13 and 14 of Regulation (eu) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of the directive 95/46/es (hereinafter referred to as "GDPR") and further according to the relevant provisions of Act No. 110/2019 Coll., on the processing of personal data, as amended.
The Administrator hereby declares full compliance with the rules established by the legislation of the European Union and the Czech Republic in the area of personal data protection.
2. Scope and types of processed data
The administrator collects and processes the following personal data of data subjects, while the scope and purpose of processing is always in accordance with the legitimate interests of the administrator and/or the necessity for the performance of the contractual relationship between the administrator and the data subject.
2.1. Identification data
- Name and surname
- Business name (if applicable)
- Personal identification number (IČO) and tax identification number (TIN)
2.2. Contact details
- Phone number
- Email address
- Address of permanent residence or registered office of the company
2.3. Data on the contractual relationship
- Ordered services and products
- History of billing and payment transactions
- Communication between the administrator and the data subject
2.4. Technical and analytical data
- IP address (anonymized within Google Analytics)
- The type and version of the browser you are using
- Operating system and device type
- Cookies (see section 8 for details)
- Records of user behavior on the administrator's website (pages visited, time spent on the page, source of visit)
- Records of mouse movements, clicks, scrolling and interactions with page elements captured by Microsoft Clarity
- Session identifiers and anonymous user identifiers assigned by analytics tools
2.5. Data collected as part of marketing activities
- Data about the user's preferences based on his behavior on the administrator's website
- Data from newsletter campaigns and other forms of direct marketing
2.6. Data from the contact form
The following personal data are processed within the Non-binding inquiry form:
- Name and surname (required)
- Email address (required)
- Phone number (required)
- Content of the message / request (optional)
These data are processed for the purpose of processing the request and establishing business communication with the data subject. The legal basis is the administrator's legitimate interest according to Article 6 paragraph 1 letter f) GDPR and preparation for the conclusion of the contract according to Article 6 paragraph 1 letter b) GDPR.
The Administrator expressly states that it does not process special categories of personal data pursuant to Article 9, Paragraph 1 of the GDPR (i.e. data relating to racial or ethnic origin, political opinions, religious beliefs, genetic and biometric data, etc.), except in cases where the data subject provides them to the Administrator on the basis of express consent.
3. Purposes of personal data processing
Personal data is processed only to the extent necessary for the following purposes:
- Fulfillment of contractual obligations – includes the processing of personal data necessary for the conclusion and implementation of the contract between the controller and the data subject.
- Compliance with legal obligations – includes in particular obligations arising from accounting and tax legislation, including Act No. 563/1991 Coll., on accounting, and Act No. 235/2004 Coll., on value added tax.
- Dealing with requests and business communication – processing of personal data entered in the contact form in order to respond to a question or request of the data subject.
- Web analytics and site optimization - monitoring of traffic and user behavior through Google Analytics and Microsoft Clarity in order to improve the content and functions of the website.
- Management of analytical tools - deploying and managing third-party analytics and marketing scripts via Google Tag Manager.
- Legitimate interests of the controller – include the protection of the controller's rights and property, fraud prevention, customer relationship management, ensuring the security of the controller's website and direct marketing.
- Consent of the data subject – if consent is required for processing (especially in the case of analytical and marketing cookies), the data subject has the right to revoke it at any time.
4. Legal basis of processing
The processing of personal data is carried out on the basis of one or more of the following legal bases in accordance with Article 6 GDPR:
- Fulfillment of the contract according to Article 6 paragraph 1 letter b) GDPR
- Fulfillment of legal obligations according to Article 6, paragraph 1 letter c) GDPR
- Legitimate interests of the administrator according to Article 6, paragraph 1 letter f) GDPR
- Consent of the data subject pursuant to Article 6 paragraph 1 letter a) GDPR - especially for the processing of analytical and marketing cookies (Google Analytics, Microsoft Clarity)
5. Period of retention of personal data
The administrator keeps personal data only for the time necessary to fulfill the processing purposes.
- Data on contractual relationships – they are kept for the duration of the contractual relationship and subsequently for 10 years after its termination
- Billing and accounting data – are kept for 10 years in accordance with Act No. 563/1991 Coll., on accounting
- Data from the contact form – they are kept for the time necessary to process the request, no longer than 3 years from receipt, if no contract has been concluded
- Analytics data (Google Analytics) – they are stored for the period specified in the Google Analytics settings, 14 months by default
- Analytics data (Microsoft Clarity) – session recordings and heatmaps are kept for 30 days; summary analytical data for a period of 13 months
- Marketing Data – are kept until the data subject withdraws consent
6. Rights of data subjects
Data subjects have the right to:
- Request access to your personal data according to Article 15 GDPR
- Request the correction of inaccurate data according to Article 16 GDPR
- Request erasure of personal data according to Article 17 GDPR ("right to be forgotten")
- Object to processing according to Article 21 of the GDPR
- Request restriction of processing according to Article 18 GDPR
- Require data portability according to Article 20 GDPR
- Revoke granted consent to processing at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent
Data subjects also have the right to file a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).
Applications can be submitted electronically at info@gbhdefence.com.
7. Processors and recipients of personal data
The administrator may transfer personal data to the following categories of recipients:
- Accounting and tax advisors – to the extent necessary for the fulfillment of legal obligations
- IT and hosting service providers – to the extent necessary for the operation of the administrator's website and systems
- Public authorities – in cases established by law
The administrator uses the following third-party tools, within which personal and technical data of users are processed:
7.1. Google Analytics
The administrator uses the Google Analytics service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This service is used to analyze website traffic. Google Analytics collects anonymized data about user behavior (pages visited, source of the visit, duration of the session, etc.). IP addresses are anonymized before they are processed. The data may be transferred to servers of Google LLC in the USA; the transfer takes place in accordance with the EU-US Data Privacy Framework. More information: Google Privacy Policy.
7.2. Google Tag Manager
The administrator uses the Google Tag Manager service operated by Google Ireland Limited. Google Tag Manager is a tag management system that allows you to deploy and manage third-party scripts (including Google Analytics and Microsoft Clarity) without directly modifying the site's source code. Google Tag Manager itself does not collect personal data; data is processed through the tags deployed through it. More information: Google Tag Manager Terms of Use.
7.3. Microsoft Clarity
The administrator uses the Microsoft Clarity service operated by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA). Microsoft Clarity is a user behavior analysis tool that records mouse movements, clicks, scrolling and captures heatmaps and session recordings. These records are used exclusively to improve the user experience of the administrator's website. Microsoft Clarity may process data on servers located outside the EU; the transfer takes place in accordance with standard contractual clauses and the EU-US Data Privacy Framework. More information: Microsoft Privacy Policy.
8. Cookies
The administrator's website uses cookies - small text files stored on the user's device. Cookies are divided into the following categories:
- Necessary cookies - they ensure the basic functionality of the website and are always active regardless of the user's consent. The legal basis is the administrator's legitimate interest.
- Analytical cookies - used to collect anonymized data about user behavior in order to improve the website (Google Analytics, Microsoft Clarity). They require user consent.
- Marketing cookies – serves to personalize advertising and monitor the effectiveness of marketing campaigns. They require user consent.
Consent to the use of optional cookies can be granted or refused via the consent management bar (cookie banner) displayed when you first visit the website. The given consent can be revoked at any time in the management of cookies on the website or by sending a request to info@gbhdefence.com.
9. Security of personal data
The controller has taken adequate technical and organizational measures to protect personal data from unauthorized access, loss, destruction or other unauthorized processing. Access to personal data is limited only to authorized persons who are bound by the obligation of confidentiality.
10. Final Provisions
The administrator reserves the right to update this policy at any time in response to legislative changes or changes in the tools and services used. The current version will always be available at gbhacademy.cz. The administrator will inform about significant changes via the website.