info@profiobklady.cz+420 737 246 887

Information on the Processing of Personal Data

On this page we explain how we process the personal data of customers, their contact persons and prospective customers who buy from us or contact us via the profiobklady.cz website (an order via the cart, the enquiry or complaint form), by email or by phone. We act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

1. Data controller

The controller is CZ-THERM s.r.o., with its registered office at Bartošova 5532, 760 01 Zlín, Czech Republic, Company ID (IČO) 21503761, VAT ID (DIČ) CZ21503761, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 139188.

Contact for questions about personal data: email info@profiobklady.cz, phone +420 737 246 887. We have not appointed a data protection officer, as the law does not require us to do so.

2. What data we process

  • identification and contact details: first name and surname, for companies the company name, Company ID (IČO), VAT ID (DIČ) and VAT number (IČ DPH), email, phone, billing and delivery address,
  • enquiry and order details: goods, quantity, prices, shipping, payment method (cash on delivery or invoice), order number, note, delivery date and place,
  • your choice of whether you are buying as a company or as a private individual, and confirmation that you have read the terms and conditions, both with date and time,
  • for companies, the result of the check in the ARES register and of the VAT number (IČ DPH) validity check in the VIES system,
  • shipment details: carrier, tracking number, delivery status and collection of cash on delivery,
  • details of complaints, returns and withdrawal from the contract: description of the defect, photos, the carrier’s report, the requested remedy and the bank account number for refunds,
  • invoice and payment details,
  • the content of our communication with each other,
  • technical data: the IP address and time of access stored by the server, for orders a hash of the IP address and the time of sending, and data processed by the form protection (section 6).

We obtain data directly from you. The details of a contact person or shipment recipient may also be entered by someone else, for example a colleague ordering on behalf of the company. You can load the company name, VAT ID (DIČ) and registered office address into the form from the public ARES register using the Company ID (IČO); we verify the validity of the VAT number (IČ DPH) in the VIES system, and the carrier provides us with delivery details.

3. Why we process data and on what basis

  • Handling enquiries, concluding and performing the contract (order, delivery of goods, invoicing, complaints, returns, withdrawal from the contract). Legal basis: negotiating and performing a contract, Art. 6(1)(b) GDPR, if you are the contracting party (a private individual or sole trader).
  • Communication with company contact persons. We conclude the contract with the company. We process the details of its employees and representatives who place orders, receive shipments or handle complaints on the basis of our legitimate interest in processing the order and communicating with the company, Art. 6(1)(f) GDPR.
  • Correct VAT rate. For Slovak companies, we verify the validity of the VAT number (IČ DPH) in the VIES system. Legal basis: compliance with a legal obligation under the VAT Act, Art. 6(1)(c) GDPR.
  • Verified by Customers satisfaction survey. After an order with a billing address in the Czech Republic, we pass your email address, order number and ordered goods to Heureka Group a.s., and Heureka sends you a short satisfaction survey. Legal basis: legitimate interest in measuring customer satisfaction and improving our services, Art. 6(1)(f) GDPR. You can decline the survey by ticking the box at checkout, or later by objecting at info@profiobklady.cz.
  • Measuring how many orders come from Heureka.cz. Only if you choose Accept in the cookie bar (section 6). Legal basis: consent, Art. 6(1)(a) GDPR.
  • Traffic measurement and advertising on Facebook and Instagram. Only if you choose Accept in the cookie bar (section 6). Legal basis: consent, Art. 6(1)(a) GDPR.
  • Accounting and tax obligations (invoices, VAT records, EC sales lists and VAT control statements). Legal basis: compliance with a legal obligation, Art. 6(1)(c) GDPR, in particular under the Accounting Act and the VAT Act.
  • Handling complaints and consumer rights (confirmation of the complaint and of how it was resolved). Legal basis: compliance with a legal obligation under the Civil Code and the Consumer Protection Act, Art. 6(1)(c) GDPR.
  • Protecting our rights and website security (debt collection, dispute resolution, data backups, protecting the checkout and forms from abuse and bots). Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

We need the details marked as mandatory in the forms to be able to handle the enquiry, order or complaint. Without them we cannot handle it. We do not carry out profiling or automated decision-making. For Slovak companies, the checkout sets the VAT rate based on the result of the VAT number (IČ DPH) check in VIES. If you disagree with the result, write to us and we will check it manually.

4. How long we keep data

  • enquiries that did not result in an order: 1 year from the last communication,
  • orders that did not result in a contract (unconfirmed, rejected and cancelled): 1 year from sending,
  • data from the contract, order, complaints and returns, including photos: for the duration of the contract and the liability for defects, and then for a further 4 years because of limitation periods and possible disputes,
  • accounting and tax documents and supporting records (for example a record of the VAT number check in VIES and transport documents): 10 years from the end of the year in which they were issued,
  • IP address hash for orders: 6 months from sending the order,
  • website backups: no more than 14 days, after which they are overwritten by newer ones,
  • technical data from the server: only for as long as necessary to keep the website secure,
  • cart contents and data in your browser storage: see section 6; we have no access to this data.

5. Who we share data with

We share data only to the necessary extent with the following recipients:

  • Šikmo s.r.o., Company ID (IČO) 09046577, Jičínská 226/17, 130 00 Praha 3, as the provider of website hosting and e-mail services and the website administrator,
  • Seznam.cz, a.s., Company ID (IČO) 26168685, Radlická 3294/10, 150 00 Praha 5, as the provider of the mailbox that receives copies of orders, enquiries and complaints,
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, where we store website backups (Google Drive),
  • Cloudflare, Inc. (USA), which operates the Turnstile form protection,
  • carriers who deliver the goods and collect cash on delivery: TOPTRANS and GEIS,
  • Heureka Group a.s., Company ID (IČO) 02387727, Karolinská 650/1, 186 00 Praha 8, to which, after an order from the Czech Republic, we pass your email address, order number and ordered goods for the Verified by Customers satisfaction survey (unless you declined it at checkout), and which, with your cookie consent, measures orders coming from Heureka.cz,
  • Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which, with your cookie consent, measures website traffic and shows our ads on Facebook and Instagram; the data may also be processed by Meta Platforms, Inc. in the USA, which participates in the EU-US Data Privacy Framework,
  • the accounting and tax office and the bank,
  • the Ministry of Finance of the Czech Republic, when you load details from the ARES register by Company ID (IČO), and the European Commission’s VIES system when verifying a VAT number (only the IČO or VAT number is transmitted),
  • public authorities, where required by law.

We do not sell data. We transfer it outside the European Union and the European Economic Area only when necessary and secured by safeguards under the GDPR. For the Cloudflare service, these are the EU-US data protection framework (EU-US Data Privacy Framework) and standard contractual clauses.

6. Cookies and browser storage

The website uses technical files and browser storage necessary for it to work. We use other cookies only with your consent, which we ask for in a bar on your first visit. You can change or withdraw your consent at any time in the cookie settings (the link is also in the website footer).

  • Cart. We store the contents of your cart (product codes and quantities) in your browser’s storage (localStorage). This is necessary for the cart you use yourself to work, so we do not need your consent for it. The cart is cleared once the order is sent. You can empty it or delete the website data in your browser at any time.
  • Checkout in progress and information windows. The details you fill in at checkout and the fact that you have closed an information window are kept by the browser only in the temporary storage of this tab (sessionStorage), or in localStorage. Checkout details are deleted once the order is sent or the tab is closed.
  • Heureka.cz conversion tracking (only with consent). If you choose Accept in the cookie bar, the Heureka.cz tracking script, which stores Heureka cookies, loads on product pages and after the order is sent. This way we pass Heureka the order number, ordered goods, prices and currency so that we know how many orders come to us via Heureka. The controller of these cookies is Heureka Group a.s. Your choice is remembered by browser storage (localStorage) for 12 months. Legal basis: consent, Art. 6(1)(a) GDPR.
  • Meta Pixel (only with consent). If you choose Accept in the cookie bar, the Meta Pixel tracking code of Meta Platforms Ireland Limited loads on every page of the website and stores the _fbp and _fbc cookies. Meta thus receives the address of the visited page, your IP address and technical data about your browser and device, and if you are logged in to Facebook or Instagram, it may link them to your account. This lets us measure how well our ads work and show them to people who may be interested. We and Meta are joint controllers for collecting and passing on this data (Art. 26 GDPR): we are responsible for this information and for your consent, Meta for securing the data on its side and for handling your rights regarding it, which you can exercise with us or directly with Meta. Further processing is governed by Meta's privacy policy. The Meta Pixel does not load on the Checkout page. Meta cookies last up to 90 days, and your choice is remembered by browser storage (localStorage) for 12 months. Legal basis: consent, Art. 6(1)(a) GDPR.
  • Form protection. At checkout and on forms (enquiry, complaint) we use the Cloudflare Turnstile service. It tells humans from bots based on technical data about the browser and device, including the IP address. We do not use Turnstile data for advertising or traffic measurement. Legal basis: legitimate interest in protecting the website from abuse, Art. 6(1)(f) GDPR.

7. Your rights

  • the right of access to personal data,
  • the right to rectification of inaccurate data,
  • the right to erasure if we no longer need the data or process it unlawfully,
  • the right to restriction of processing,
  • the right to data portability,
  • the right to object to processing based on legitimate interest,
  • the right to withdraw consent where processing is based on consent,
  • the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

You can exercise your rights by email at info@profiobklady.cz or by letter to our registered office address. We will reply within 1 month at the latest.

8. Security

We protect data with technical and organisational measures. The website communicates over an encrypted connection. We store orders in a non-public part of the website that only authorised persons can access. The checkout and forms are protected by bot protection and a limit on the number of submissions.

This information is effective from 19 October 2026.