Updated 30 September 2026
1 Personal Data Controller
1.1 The personal data controller Cavixo s.r.o., ID 03575080, registered office at Sanderova 1616/16, Holešovice, 170 00 Praha, recorded in Company Register maintained by Municipal Court in Prague, under the reference C 233989 (hereinafter referred to as the "data controller"), declares that all personal data processed by the data controller are strictly confidential. The processing of the data by the data controller follows all relevant national and EU regulations pertaining to the protection of personal data.
1.2 The controller processes personal data in accordance with Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll. on personal data processing and other applicable legislation. The purposes and legal bases for processing are described below.
1.3 The data controller also collects such personal data through its website at https://www.cavixo.cz/ (hereinafter referred to as the "Website").
1.4 This policy is issued by the data controller so that you are sufficiently informed about what personal data the data controller processes, for what purpose, for how long, who will have access to your personal data and what rights you have. This policy applies to all personal data collected by the controller, whether collected for the purpose of fulfilling a contractual relationship, a legal obligation, a legitimate interest, or consent granted.
2 Processed data
2.1 The data controller is entitled to process the following personal data according to the purpose, according to the categories of personal data, according to the categories of the data subject, according to the categories of recipients and according to the period of collection as follows.
| No. | Purpose of processing | Categories of personal data | Retention period |
|---|---|---|---|
| 1 | Handling an enquiry, request or order | Contact, identification and descriptive data provided in the form or communication | For the handling and subsequent communication, no longer than 12 months after the last contact unless a contractual relationship arises |
| 2 | Sending commercial communications and offering products and services | Address and identification data, descriptive data | 5 years |
| 3 | Statistics | Address and identification data, descriptive data | 5 years |
2.2 The following is meant by the individual purposes of processing:
2.2.1 performance of the contractual relationship means: the relationship between you and the data controller based on an order, registration (after signing a contract), application and participation in a contest etc.
2.2.2 distribution of commercial communications and offering of products and services means: distribution of commercial communication by e-mail, SMS or telephone call;
2.2.3 accounting and tax purposes means: meeting of taxation and accounting obligations under the respective legislation;
2.2.4 statistical purposes means: anonymised monitoring of website visitor rate, the number of pages viewed, time spent on the website, type of device used by a visitor to access a website. the data is being collected in order to improve the quality of the provided services and to offer our clients relevant contents;
2.2.5 displaying of advertisements means: displaying of advertisements and commercials on a website based on the preferences of our customers identified statistically;
2.2.6 legitimate interest means: efficient defence in a dispute; the processing of personal data in such a case takes 4 years from the expiry of the respective warranty (which may be prolonged) based on the duration of the resolution of a dispute. Given that our goal is to continuously improve our existing services, to deliver new innovative services as well as to avoid any potential risks and obstacles, all activities supporting this effort are seen as our legitimate interest. Legitimate interest also includes the processing of data to prevent fraud (such as anticipating risks of signing a contract) (direct marketing e.g. offering relevant services to our current customers), transfer of personal data within a Group for internal administrative purposes, reporting of criminal offences and transfer of personal data to competent authorities, adopting various security measures regarding the network and information. The list above is only example;
2.2.7 performance of other legal duties means: providing information to law enforcement authorities, to inform other public authorities, and so on.
2.3 We process your personal data only for the time necessary for the purpose of processing i.e. protecting all rights and duties arising from a legal action at least for the time needed for the handling of an order, the implementation of a business case, the performance of a service etc. This also includes a period defined as the “obligatory retention period” pursuant to universal laws and regulations or a period based on a received consent. Otherwise, the data processing time depends on the purpose for which the personal data is being processed or based on the respective legislation.
2.4 Personal data are processed manually and automatically by the data controller. The data controller may process certain information by automated means to generate statistics on the number of visitors accessing its website.
3 Personal data processed on the basis of consent
3.1 Where we obtain your consent, we use personal data only for the purpose, scope and period specified when the consent was given.
3.1.1 Sending commercial communications and doing other marketing activities;
3.1.2 Handling an enquiry or order and performing a contract does not depend on consent where processing is necessary to take steps before entering into a contract or to perform a contract under Article 6(1)(b) GDPR.
3.1.3 Communication between the subject and the personal data controller.
4 Rights of the data subject
4.1 As a data subject, you have the stated rights that arise for you from legal regulations and that you can exercise at any time. It is noted about:
4.1.1 right of access to personal data, under which you may obtain confirmation as to whether the controller processes your personal data and, where it does, access to those data and the information listed in Article 15 GDPR. The controller provides the first copy free of charge; it may charge a reasonable fee for additional copies or manifestly unfounded or excessive requests, or refuse such requests;
4.1.2 right to rectification or erasure of personal data, or restriction of processing, according to which you have the right to have personal data that are inaccurate or incorrect corrected. If your personal data is no longer needed for the purposes for which it was collected or is being processed illegally you have the right to request erasure. Alternatively, to temporarily restrict their processing, you can request the restriction processing;
4.1.3 right to request an explanation if you suspect that the processing of personal data by the controller is contrary to the law;
4.1.4 right to contact the Office for Personal Data Protection in case of doubt about compliance with obligations related to the processing of personal data;
4.1.5 right to data portability, i.e. right to receive the personal data concerning you, which you provided to the data controller in a structured, commonly used and machine-readable format (for more details see Art. 20 GDPR);
4.1.6 right to object to the processing of personal data that are processed for the purpose of performing a task carried out in the public interest or in the exercise of official authority or for the purpose of protecting the legitimate interests of the controller. The data controller shall terminate the processing without undue delay except where such interest/reason are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data;
4.1.7 right to withdraw your consent to the processing of personal data granted to the data controller at any time.
5 Cookies
5.1 Cookies are short text files that a website sends to your browser. They allow the website to record information about your visit, such as the selected language etc., making your next visit to the website easier and more pleasant. Cookie files enable a better exploitation of your website and the customisation of its content to your needs. Cookies are used by nearly all websites in the world. Cookies allow you to make better use of our website and adapt its content to your needs; they are used by almost every website in the world. Cookies are useful because they increase the user-friendliness of a repeatedly visited website.
5.2 Each data controller may use the below types of cookies on its website:
5.2.1 Session (i.e. temporary) cookies allow us to link your individual activities while browsing the website. When you open your browser window, these files are activated and deactivated when you close your browser window. Session cookies are of temporary nature and deleted from your device after closing your browser.
5.2.2 Persistent cookies help us identify your computer when you visit our website again. Another advantage of persistent cookies is that they allow us to accommodate our website to your needs.
5.3 In accordance with the Electronic Communications Act no. 127/2005 Coll. § 89 Sec. 3 as amended, our website uses cookies i.e. which means that your cookies (session and persistent) are processed.
5.4 Internet browsers usually include cookie management. As part of your browser settings, you can probably manually delete, block or completely disable the use of individual cookies. For more information, use the help of your Internet browser. If you do not allow the use of cookies, some features and pages may not work as they should.
5.5 The Website uses necessary technical tools and Google reCAPTCHA on the contact form to prevent spam and abuse. Other analytics, advertising or personalisation cookies may be used only after they are activated and, where required by law, after consent has been provided through the cookie banner.
5.6 If marketing or analytics services are activated, their providers may receive information about use of the Website. Details of the specific services and cookie lifetimes will be available in the cookie settings.
6 Transfers to third countries
6.1 Some technical service providers, in particular Google in connection with reCAPTCHA, may process data outside the European Economic Area. Transfers take place only where GDPR requirements are met, in particular under an adequacy decision or standard contractual clauses.
7 Data recipients and contact
7.1 Personal data may be accessed by authorised controller personnel and contracted hosting, email, IT and security providers, only to the extent necessary.
7.2 You can exercise your rights by emailing info@cavixo.cz. You may lodge a complaint with the Czech Office for Personal Data Protection at uoou.gov.cz.