PRIVACY POLICY

1. Introductory Provisions

1.1. This Privacy Policy (hereinafter referred to as the "Policy") describes how Love production s.r.o. (hereinafter referred to as the "Administrator") processes the personal data of users of the website www.novaosmicka.cz (hereinafter referred to as the "Website"), the EightID user account service, and the related food ordering and delivery system (hereinafter referred to as "Nová Osmička Food"), and is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

1.2. The Administrator processes personal data as a controller and is responsible for complying with personal data protection rules.

1.3. Providing personal data is always voluntary. However, without providing the data necessary for the performance of a contract (e.g. when ordering food or purchasing tickets), it may not be possible to provide the requested service.

2. Purpose and Legal Basis for Data Processing

3. Recipients and Processors of Personal Data

• Webhosting provider: Active 24, s.r.o., which technically ensures the operation and storage of the Website.
• Providers of IT, analytical, and marketing services:
  • Google Ireland Limited (Google Analytics, Google Search Console, Google Forms, Google Tag Manager, Google OAuth login, Firebase Cloud Messaging, Google Wallet for electronic tickets).
  • ENIGOO s.r.o. (ticketing platform operator and ticket seller; recipient of personal data required for ticket purchases via the EightID account).
  • Meta Platforms, Inc. (Facebook Pixel Code, Facebook OAuth login).
  • Microsoft Corporation (Microsoft Webtools).
  • hCaptcha (Intuition Machines, Inc.) for form security.
  • Functional Software, Inc. (Sentry) for application error monitoring.
  • Stripe Payments Europe, Ltd. / Stripe, Inc. (processing payments for orders in the Nová Osmička Food system and payouts to partner restaurants and drivers via Stripe Connect).
• Recipients related to food order delivery: The partner restaurant where the order was placed and the driver assigned to the delivery receive the data necessary to fulfill and deliver the order (name, phone number, delivery address, order contents, and any order notes).
• External advisors: Accounting, tax, or legal advisors, if necessary for the Administrator to comply with a legal obligation.

Transfer outside the EU:

Personal data is transferred to the USA (Google incl. Firebase, Meta, Microsoft, Sentry, Stripe). This transfer is secured using Standard Contractual Clauses (SCCs) approved by the European Commission, which ensure an adequate level of protection.

4. Cookies and Tracking Technologies

4.1. The Website uses cookies and similar tracking technologies (e.g., Facebook Pixel, Google Analytics scripts). Cookies are small text files stored on the user's device.

4.2. Types of cookies:

• Necessary (technical) cookies: These cookies are crucial for the proper functioning of the Website and are processed on the basis of a legitimate interest. They do not require your consent.
• Analytical, marketing, and preference cookies: These cookies are used only with the prior explicit consent of the user , which is obtained through the implemented cookie bar (banner).

4.3. Cookie Management:

You can revoke or change your consent to analytical and marketing cookies at any time through the consent management tool (cookie bar) on our Website.

5. Data Retention Periods

5.1. EightID account data (profile data, notification preferences, favorite events, followed organisations, badges, and check-in history) is retained for as long as the account exists. After the account is deleted by the user, all data is permanently removed.

5.2. Consent to receiving marketing e-mails can be withdrawn at any time in the account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.3. Device identifiers for push notifications (FCM tokens) are automatically removed when the user logs out of a device or deletes their account.

5.4. Login activity records are retained for 90 days for account security purposes. Logs of connections to the free Wi-Fi network (including device MAC address and related technical operational data) are retained in the EightID database for 12 months.

5.5. The user has the right to export all of their data at any time via the "Download my data" feature in the account settings.

5.6. Data on orders in the Nová Osmička Food system (delivery address, order contents, payment and payout identifiers) is retained for the period required by law for accounting and tax records, i.e. 10 years from the end of the tax period to which it relates.

5.7. Data on the driver's current GPS location is retained only for the duration of their active shift and assigned order; historical routes are retained for 12 months from delivery for delivery and complaint-handling purposes.

5.8. Copies of sent e-mails and data on their click-through are retained for 24 months for the purposes of evaluating deliverability and marketing campaigns.

5.9. User segments under Section 2, item G) are recalculated regularly; an individual user is removed from a segment without undue delay after withdrawing the relevant consent or objecting to the processing.

6. Personal Data of Third Parties Provided by a User

6.1. As part of certain features of the Website, the EightID service, and the Nová Osmička Food system (e.g. creating a team for a group reservation or entering a delivery address), a user may provide the Administrator with personal data (in particular name, surname, e-mail, or address) of a third party who is not themselves a registered user or otherwise in contact with the Administrator.

6.2. The user who enters such data is responsible for being entitled to provide it to the Administrator and for having informed the third party concerned in advance about the processing of their personal data to the extent of this Policy.

6.3. The Administrator processes data obtained in this way exclusively for the purpose for which it was provided (e.g. recording a team member, delivering an order), for the time necessary to fulfill that purpose. The third party concerned may exercise their rights under Section 7 of this Policy in the same way as a registered user.

7. Rights of the Data Subject

As a data subject, the user has the following rights, which can be exercised by contacting the Administrator at the email address provided in Section 1:

1. Right of access: You have the right to obtain confirmation as to whether or not your personal data is being processed, and if so, to obtain a copy thereof.
2. Right to rectification: You have the right to have inaccurate or incomplete personal data concerning you rectified without undue delay.
3. Right to erasure (right to be forgotten) Right to erasure (right to be forgotten): You have the right to have your personal data erased if one of the reasons under Article 17 of the GDPR applies.
4. Right to restriction of processing: You have the right to restrict the processing of data in the cases set out in Article 18 of the GDPR.
5. Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
6. Right to object: You have the right to object at any time to processing based on legitimate interest.
7. Right to withdraw consent: If processing is based on your consent, you have the right to withdraw it at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
8. Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (ÚOOÚ), with its registered office at Pplk. Sochora 27, 170 00 Praha 7.