Skip to main content

GBH – Gaudete Bruder Holding s.r.o. Registered office: Dlouhá 730/35, Staré Město, 110 00 Prague 1, Czech Republic Company ID: 10975187 Email: info@gbhdefence.com Web: gbhdefence.com

Effective date: 18.02.2025 Operator: GBH – Gaudete Bruder Holding s.r.o. (hereinafter referred to as “Company” or “Provider”)

1. Introductory Provisions

GBH – Gaudete Bruder Holding s.r.o. (hereinafter referred to as “controller”) hereby informs data subjects (hereinafter referred to as “client”, “user” or “data subject”) about the principles of personal data processing in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) and further in accordance with the relevant provisions of Act No. 110/2019 Coll., on the processing of personal data, as amended.

The controller hereby declares full compliance with the rules established by the legislation of the European Union and the Czech Republic in the field of personal data protection.

2. Scope and Types of Processed Data

The controller collects and processes the following personal data of data subjects, whereby the scope and purpose of processing are always in accordance with the legitimate interests of the controller and/or the necessity for the performance of the contractual relationship between the controller and the data subject.

2.1. Identification Data

  • Name and surname
  • Business name (if relevant)
  • Identification number (IČO) and tax identification number (DIČ)

2.2. Contact Data

  • Phone number
  • Email address
  • Address of permanent residence or company headquarters

2.3. Contractual Relationship Data

  • Ordered services and products
  • Billing and payment transaction history
  • Communication between the controller and the data subject

2.4. Technical and Analytical Data

  • IP address (anonymized within Google Analytics)
  • Type and version of browser used
  • Operating system and device type
  • Cookie files (details see section 8)
  • Records of user behavior on the controller’s websites (pages visited, time spent on page, traffic source)
  • Records of mouse movement, clicks, scrolling and interactions with page elements collected by Microsoft Clarity
  • Session identifiers and anonymous user identifiers assigned by analytical tools

2.5. Data Collected Within Marketing Activities

  • Data about user preferences based on their behavior on the controller’s websites
  • Data from newsletter campaigns and other forms of direct marketing

2.6. Data from Contact Form

The following personal data are processed within the Non-binding Inquiry form:

  • Name and surname (mandatory)
  • Email address (mandatory)
  • Phone number (mandatory)
  • Message / inquiry content (optional)

These data are processed for the purpose of handling the inquiry and establishing business communication with the data subject. The legal basis is the legitimate interest of the controller pursuant to Art. 6 para. 1 letter f) GDPR and preparation for the conclusion of a contract pursuant to Art. 6 para. 1 letter b) GDPR.

The controller expressly states that it does not process special categories of personal data pursuant to Art. 9 para. 1 GDPR (i.e., data concerning racial or ethnic origin, political opinions, religious beliefs, genetic and biometric data, etc.), except in cases where the data subject provides them to the controller on the basis of explicit consent.

3. Purposes of Personal Data Processing

Personal data are processed only to the extent necessary for the following purposes:

  • Fulfillment of contractual obligations – includes processing of personal data necessary for the conclusion and implementation of a contract between the controller and the data subject.
  • Fulfillment of legal obligations – includes obligations arising from accounting and tax legislation, including Act No. 563/1991 Coll., on Accounting, and Act No. 235/2004 Coll., on Value Added Tax.
  • Handling inquiries and business communication – processing of personal data entered into the contact form for the purpose of responding to the data subject’s inquiry or request.
  • Web analytics and website improvement – monitoring website traffic and user behavior through Google Analytics and Microsoft Clarity to improve the content and functionality of the website.
  • Analytics tools management – deployment and management of third-party analytical and marketing scripts through Google Tag Manager.
  • Legitimate interests of the controller – include protection of the controller’s rights and property, fraud prevention, customer relationship management, ensuring the security of the controller’s websites and direct marketing.
  • Consent of the data subject – if consent is required for processing (particularly for analytical and marketing cookies), the data subject has the right to withdraw it at any time.

Processing of personal data is carried out on the basis of one or more of the following legal bases in accordance with Art. 6 GDPR:

  1. Performance of a contract pursuant to Art. 6 para. 1 letter b) GDPR
  2. Compliance with a legal obligation pursuant to Art. 6 para. 1 letter c) GDPR
  3. Legitimate interests of the controller pursuant to Art. 6 para. 1 letter f) GDPR
  4. Consent of the data subject pursuant to Art. 6 para. 1 letter a) GDPR – particularly for processing of analytical and marketing cookies (Google Analytics, Microsoft Clarity)

5. Retention Period of Personal Data

The controller retains personal data only for the period necessary to fulfill the purposes of processing.

  • Contractual relationship data – retained for the duration of the contractual relationship and subsequently for a period of 10 years from its termination
  • Billing and accounting data – retained for a period of 10 years in accordance with Act No. 563/1991 Coll., on Accounting
  • Contact form data – retained for the period necessary to process the inquiry, no longer than 3 years from receipt, unless a contract is concluded
  • Analytical data (Google Analytics) – retained for the period set in Google Analytics settings, typically 14 months
  • Analytical data (Microsoft Clarity) – session recordings and heatmaps are retained for 30 days; aggregated analytical data for 13 months
  • Marketing data – retained until withdrawal of consent by the data subject

6. Rights of Data Subjects

Data subjects have the right to:

  • Request access to their personal data pursuant to Art. 15 GDPR
  • Request correction of inaccurate data pursuant to Art. 16 GDPR
  • Request erasure of personal data pursuant to Art. 17 GDPR (“right to be forgotten”)
  • Object to processing pursuant to Art. 21 GDPR
  • Request restriction of processing pursuant to Art. 18 GDPR
  • Request data portability pursuant to Art. 20 GDPR
  • Withdraw consent to processing at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent

Data subjects also have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).

Requests can be exercised electronically at info@gbhdefence.com.

7. Processors and Recipients of Personal Data

The controller may transfer personal data to the following categories of recipients:

  • Accountants and tax advisors – to the extent necessary for the fulfillment of legal obligations
  • IT and hosting service providers – to the extent necessary for the operation of the controller’s websites and systems
  • Public authorities – in cases specified by law

The controller uses the following third-party tools, within which personal and technical data of users are processed:

7.1. Google Analytics

The controller uses the Google Analytics service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This service is used for website traffic analysis. Within Google Analytics, anonymized data about user behavior are collected (pages visited, traffic source, session duration, etc.). IP addresses are anonymized before processing. Data may be transferred to servers of Google LLC in the USA; the transfer is carried out in accordance with the EU–US Data Privacy Framework. More information: Google Privacy Policy.

7.2. Google Tag Manager

The controller uses the Google Tag Manager service operated by Google Ireland Limited. Google Tag Manager is a tag management system that enables the deployment and management of third-party scripts (including Google Analytics and Microsoft Clarity) without directly modifying the website source code. Google Tag Manager itself does not collect personal data; data processing occurs through the tags deployed via it. More information: Google Tag Manager Terms of Service.

7.3. Microsoft Clarity

The controller uses the Microsoft Clarity service operated by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA). Microsoft Clarity is a user behavior analytics tool that records mouse movements, clicks, scrolling, and captures heatmaps and session recordings. These recordings serve exclusively to improve the user experience of the controller’s websites. Microsoft Clarity may process data on servers located outside the EU; the transfer is carried out in accordance with standard contractual clauses and the EU–US Data Privacy Framework. More information: Microsoft Privacy Statement.

7.4. Meta Pixel

After marketing cookie consent is granted, the controller uses Meta Pixel operated by Meta Platforms Ireland Limited. The pixel records page visits and successful form submissions together with technical browser and device information. The data are used to measure campaign performance and build advertising audiences; Meta may associate them with a user’s account when the user is signed in to Meta services. More information: Meta Privacy Policy.

7.5. LinkedIn Insight Tag

After marketing cookie consent is granted, the controller uses the LinkedIn Insight Tag, operated by LinkedIn Ireland Unlimited Company, on the non-binding consultation page. The tag records the page visit together with technical browser and device information. The data are used to measure campaign performance and build advertising audiences; LinkedIn may associate them with a member account when the user is signed in to the service. More information: LinkedIn Privacy Policy.

8. Cookies

The controller’s websites use cookies – small text files stored on the user’s device. Cookies are divided into the following categories:

  • Necessary cookies – ensure basic website functionality and are always active regardless of user consent. The legal basis is the legitimate interest of the controller.
  • Analytical cookies – used to collect anonymized data about user behavior for the purpose of website improvement (Google Analytics, Microsoft Clarity). Require user consent.
  • Marketing cookies – used for advertising personalization and tracking the effectiveness of marketing campaigns. Require user consent.

Consent for the use of non-essential cookies can be granted or refused via the consent management bar (cookie banner) displayed upon the first visit to the website. Granted consent can be withdrawn at any time in the cookie management on the website or by sending a request to info@gbhdefence.com.

9. Security of Personal Data

The controller has implemented appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or other unauthorized processing. Access to personal data is restricted only to authorized persons who are bound by a duty of confidentiality.

10. Final Provisions

The controller reserves the right to update these policies at any time in response to legislative changes or changes in the tools and services used. The current version will always be available at gbhdefence.com. The controller will inform about significant changes through the website.