Privacy Policy

We value the trust you place in us when you share your personal data. That is why we handle it responsibly.  

JOHNNY SERVIS, s.r.o., Company ID No.: 47538856, registered office at náměstí Kněžny Ludmily 1, 26601 Tetín, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 18533 (hereinafter “JS”), processes personal data in accordance with the rules set out in this Privacy Policy to ensure effective protection of personal data and prevent any misuse.

The rules for processing personal data set out in this policy comply with the obligations imposed on us as a data controller by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”).

Through this policy, we provide information and rights that we are required to communicate under GDPR, ensuring transparency and openness in the processing of personal data.

This policy sets out the procedures and principles under which we process personal data. Additional information or clarification may be provided by our Data Protection Coordinator listed below.

Collection of Personal Data

Reasons for Collecting Personal Data
We collect and process personal data on the basis of an appropriate legal ground, particularly when necessary for:

• performance of a contract,

• provision of a service,

• compliance with legal obligations,

• protection of vital interests of data subjects,

• purposes of our legitimate interests, provided such interests do not override the interests or rights of data subjects,

• or on the basis of your consent, where consent is required for a specific processing purpose.

Personal Data
When registering, entering into contracts, or using our services, we process your name, surname, e‑mail address, telephone number, address, and, where applicable, company identification details.

Direct Marketing Communications

One of JS’s legitimate interests is the processing of personal data for direct marketing purposes — sending commercial communications to clients who have purchased a product or used a service. You may unsubscribe from commercial communications at any time via the link provided in the e‑mail or via the contact e‑mail listed below. Personal data for these purposes is processed for three years from the last purchase.

Where marketing processing is based on your consent, the processing period is governed by the conditions of the specific consent.

Consent

Where the legal basis for processing is your consent, we process personal data only to the extent and for the purposes for which you have granted consent. Consent may be withdrawn at any time using the method provided when the consent was given or via the contact details listed in this policy. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Obtaining Personal Data

JS always processes personal data in accordance with this policy and GDPR. We obtain personal data directly from individuals who provide it to us or from third parties who have obtained the data in accordance with GDPR. We request personal data during registration, contract conclusion, or when using our services. Some data is also collected automatically, for example through cookies and similar technologies when visiting our website. Information on the specific purpose of processing is always provided in the contract, service terms, cookie banner, or in this policy.

Use of Cookies and Advertising Identifiers

When visiting our website, cookies and similar technologies may be stored for website functionality, analytics, and advertising personalization.

As part of marketing and advertising services, we use Google technologies, which may, depending on the specific service and device, use:

• cookies,

• mobile advertising identifiers,

• online identifiers,

• behavioural data from the website,

• advertising interaction data.

These data may be used for:

• personalised advertising,

• non‑personalised advertising,

• measuring advertising performance,

• audience creation,

• traffic analysis.

Processing of these data is based on your consent provided via the cookie banner. Consent may be withdrawn at any time.

Personalised Advertising

If you grant consent, your personal data (e.g., cookies, online identifiers, website activity data) may be used for personalised advertising through third‑party services, particularly Google.

This includes:

• tailoring ads to your interests,

• creating user segments,

• measuring advertising campaign performance,

• displaying relevant ads on other websites.

For these purposes, we primarily use Google Ads and Google Analytics, which may be implemented on our website through Google Tag Manager.

Processing takes place only on the basis of your consent granted via the cookie banner.

Use of Personal Data

We use personal data primarily to provide services, conclude contracts, fulfil legal obligations, inform about service changes, and improve our products. We also use contact details to send general advertising messages not targeted at specific groups of recipients for a period of three years.

Disclosure of Personal Data to Third Parties

We disclose personal data only in cases specified in this policy.

JS employees who have access to personal data are bound by confidentiality and trained in personal data protection.

We disclose personal data to processors who provide appropriate guarantees of personal data protection. Processors are contractually bound to comply with GDPR obligations.

Processing of Personal Data by Google

When using Google services, certain data may be transferred to Google Ireland Limited or Google LLC (USA). Google processes this data in accordance with its privacy policies.

Detailed information on how Google handles personal data within its business and advertising services can be found at:

https://business.safety.google/privacy/

Transfers Outside the EU

When using Google services, certain data may be transferred outside the European Economic Area, particularly to the USA. Such transfers are carried out in accordance with applicable legal regulations and using appropriate mechanisms to ensure personal data protection, such as standard contractual clauses where applicable.

Automated Decision‑Making and Profiling

JS does not carry out any automated individual decision‑making that would have legal effects on data subjects.

Within marketing services, profiling may occur for advertising personalisation, and only on the basis of your consent.

Profiling includes:

• evaluating website behaviour,

• creating user segments,

• displaying personalised ads.

Retention Periods

We process personal data only for the necessary period.

• Based on consent – for the period specified in the consent.

• Based on law – for the period required by legal regulations.

• Based on contract – for 10 years after contract termination.

• For direct marketing – for 5 years from consent or until withdrawal.

• For legitimate interest – for 3 years from service provision.

Your Rights

Right to Information
You may contact us at any time to request confirmation of whether we process your personal data. If we do, you have the right to access the following information:

• the purpose of processing and categories of personal data,

• recipients and processors of personal data,

• retention period or criteria for determining it,

• which personal data you may request to be erased or restricted, and your right to object,

• your right to lodge a complaint with the supervisory authority,

• the source of personal data,

• whether automated decision‑making or profiling occurs.

Upon request, we will provide a copy of your personal data. Additional copies may be subject to a fee covering administrative costs. Electronic copies will be provided electronically unless you request otherwise. We may require identity verification to ensure personal data is not disclosed to unauthorised persons.

We aim to provide information as soon as possible, typically within one month of receiving the request.

Right to Rectification
If you find that your personal data is inaccurate, incorrect, or incomplete, you have the right to request correction or completion without undue delay.

Right to Erasure 
You have the right to request erasure of your personal data without undue delay if:

• the data is no longer needed for the purposes for which it was collected,

• you withdraw your consent,

• you object to processing,

• the data was processed unlawfully,

• erasure is required by law,

• the data was collected in connection with information society services.

We will not erase personal data if any of the grounds under Article 17(3) GDPR apply.

If personal data has been disclosed or transferred to third parties, we will ensure erasure where technically possible.

Right to Restriction of Processing
You have the right to request restriction of processing if:

• you contest the accuracy of personal data (for the period of verification),

• processing is unlawful and you request restriction instead of erasure,

• we no longer need the data but you require it for legal claims,

• you have objected to processing (for the period of verification).

During restriction, personal data may only be stored or processed with your consent, for legal claims, or for reasons of public interest.

Right to Object
You have the right to object to processing of your personal data for direct marketing purposes. The objection must be sent in writing or by e‑mail using the contact details below. If you object to processing for direct marketing, we will no longer process your personal data for this purpose unless we demonstrate compelling legitimate grounds that override your interests or for legal claims.

Right to Data Portability
Upon request, JS will provide your personal data in a structured, commonly used format so you can transfer it to another controller. Where technically feasible, you may request direct transfer to another controller.

Right to Lodge a Complaint
You may lodge a complaint regarding personal data processing or GDPR compliance with the supervisory authority:

Czech Republic:  

Úřad pro ochranu osobních údajů

Pplk. Sochora 27

170 00 Praha 7

www.uoou.cz

Implemented Measures

JS has implemented personnel, organisational, and technical measures to minimise risks to rights and freedoms and ensure personal data protection. Employees handling personal data are trained. Physical records are protected against unauthorised access. Electronic data is secured according to security standards. JS has conducted a risk analysis and implemented measures to mitigate risks.

Data Protection Coordinator

JS is not required to appoint a Data Protection Officer under GDPR and has not appointed one. However, JS has designated a Data Protection Coordinator responsible for personal data protection. You may contact the coordinator regarding any personal data matters or to exercise your rights at: This email address is being protected from spambots. You need JavaScript enabled to view it.

Contact Details

For any requests, questions, comments, or concerns, you may contact us at: This email address is being protected from spambots. You need JavaScript enabled to view it. or in writing at our registered office address.

Conclusion

This policy was adopted on 1 January 2023 and updated on 10 September 2026, particularly to include information on the use of cookies and similar technologies, advertising personalisation, and data processing related to Google services. JS may update this policy over time, provided it remains compliant with applicable legal regulations and GDPR.