Personal Data Processing Policy

This policy describes how Vejvodovi KIWI Group s.r.o. processes the personal data you provide through the contact form on www.kiwigroup.cz, and what rights you have in connection with that processing. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Czech Act No. 110/2019 Coll., on personal data processing.

1. Data controller

The data controller is:

Vejvodovi KIWI Group s.r.o.
registered office at Velehradská 1301/17, 130 00 Prague 3 – Vinohrady
Company ID: 05150574, VAT ID: CZ05150574
registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 259029
email: vejvodova@kiwigroup.cz, phone: +420 608 37 07 77

The controller has not appointed a data protection officer. For any matter concerning the processing of your personal data, please use the contact details above.

2. What data we process

We process only the personal data you voluntarily provide by filling in the contact form, namely:

• first name and surname,
• email address,
• phone number (optional),
• the content of your message (your question, enquiry and any information you choose to include).

We do not obtain any further data about you from other sources and we do not process any special categories of personal data (so-called sensitive data).

3. Purpose and legal basis of processing

We process your personal data for the purpose of handling your question or enquiry and subsequent communication with you (a reply by phone or email, and the preparation of a possible offer of cooperation).

The legal basis for processing is your consent under Article 6(1)(a) GDPR, which you give by ticking the relevant box in the form. If your enquiry concerns the conclusion or performance of a contract, the legal basis may also be steps taken prior to entering into a contract under Article 6(1)(b) GDPR.

Providing your data is voluntary. However, without contact details (name and email) we cannot handle your enquiry or reply to you.

4. Recipients of personal data and processors

We do not pass your personal data to third parties for their marketing purposes. To the extent necessary, the data may be accessed by processors who provide our technical infrastructure:

• Hostinger International Ltd. (Lithuania, EU) — operation of the server the website runs on,
• Seznam.cz, a.s. (Czech Republic) — the email service through which the form message is sent and delivered to our mailbox,
• Backblaze Inc. — encrypted server backup; backups are stored in a data centre in the European Union and are encrypted before being sent,
• Google Ireland Limited (YouTube) — only if you yourself start a video on an artist’s page; until then we do not contact YouTube at all (see point 8 for details).

We have appropriate data protection terms in place with these processors. Traffic analytics run on our own server and are not passed to any further recipient (see point 7).

Transfers outside the EU. Your data is processed and stored in the European Union. The only exception occurs if you yourself start a video on an artist’s page: at that moment the player requests content from Google’s servers, which are also located outside the EU, and your IP address and browser details are transmitted to them. This does not happen without your click. Backblaze Inc. is a US company, but it stores our backups in a data centre in the EU and they are encrypted with a key that remains with the controller.

5. Retention period

We process personal data for as long as is necessary to handle your enquiry and for related communication, but no longer than 12 months from the last mutual communication, or until you withdraw your consent. After that period, or after consent is withdrawn, the data is erased unless further retention is required on another legal ground (for example compliance with a legal obligation or protection of the controller’s legitimate interests).

Operational records. The server keeps a technical record of each form submission (date and time, the sender’s IP address, the email address in shortened form, and the enquiry type). It serves to protect the form against misuse and to trace operational errors. These records are deleted automatically after 14 days. The content of the message itself is not stored on the server — it is sent straight to our email address.

6. Your rights

In connection with the processing of personal data you have, in particular, the following rights under the GDPR:

• the right of access to your personal data and to information about its processing,
• the right to rectification of inaccurate or incomplete data,
• the right to erasure (the “right to be forgotten”) under the conditions laid down by the GDPR,
• the right to restriction of processing,
• the right to data portability ,
• the right to object to processing,
• the right to withdraw consent at any time , without affecting the lawfulness of processing carried out before its withdrawal,
• the right to lodge a complaint with the supervisory authority.

You may withdraw your consent at any time and exercise any of the rights listed above by sending a request to vejvodova@kiwigroup.cz or in writing to the controller’s registered office.

The supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, with which you have the right to lodge a complaint if you believe that the processing of your personal data is contrary to the law.

7. Traffic analytics

We use Umami, our own analytics tool running on our own server. It stores no cookies, does not track visitors across websites and collects no personal data — it measures only anonymous aggregate traffic figures (page views, referral source, device type). The data never leaves our server and is not passed to third parties.

8. YouTube videos — loaded only after you click

Individual artists’ pages contain YouTube videos. They are not embedded live: until you click a video, all that stands in place of the player is a preview image stored on our own server plus a play button. Opening the page therefore sends no request to YouTube or Google, and those companies learn nothing about your visit.

Only when you click the play button is a player from the youtube-nocookie.com domain inserted into the page. That transmits your IP address, browser details and information about which video you started to YouTube (Google Ireland Limited); the player may also store its own cookies or similar identifiers under Google’s rules. That processing then takes place on Google’s side and is governed by Google’s privacy policy. The legal basis is your consent, which you give precisely by starting the video yourself; if you do not start it, nothing is transmitted.

9. Cookies and automated decision-making

The www.kiwigroup.cz website uses no tracking or marketing cookies and carries out no profiling or automated decision-making producing legal effects for the data subject. The analytics tool described in point 7 above also uses no cookies. The only exception is the YouTube player: if you start a video yourself, it may store its own identifiers — see point 8. Should tracking or marketing tools be deployed in the future, this policy will be updated accordingly and supplemented with cookie consent.

10. Changes to this policy

We may update this policy as needed; the current version is always available at www.kiwigroup.cz.

This policy is effective from 11 July 2026, last updated 19 August 2026.

The Czech version is legally binding.