Privacy Policy

1.1.The controller is Lumivix Technologies s.r.o., registered office: Korunní 2569/108, 101 00 Prague 10, Czech Republic (Company ID (IČO) 30131553, registered in the Commercial Register kept by the Municipal Court in Prague, file number C 456947) (“LUMIVIX”, “we”).

1.2.For privacy matters contact us at info@lumivix.cz (business inquiries also at b2b@lumivix.cz) or in writing at our registered office.

1.3.We have not appointed a Data Protection Officer as we are not required to under Art. 37 GDPR.

1.4.This notice applies to b2b.lumivix.cz. The consumer site lumivix.cz has a separate notice (in Czech).

2.7.Providing data is voluntary, but without contact details we cannot respond to your inquiry. We do not carry out automated individual decision-making (Art. 22 GDPR).

3.1.Necessary storage is always used, as the site otherwise cannot remember your choice. Analytics and marketing tools run only after your explicit consent; until then their scripts are not loaded at all. Rejecting is as easy as accepting. Your choice on this site is independent of your choice on lumivix.cz.

3.2.Your choice is stored in your browser with a timestamp and version; we ask again after 12 months or when our tools change. For Google tools we use Google Consent Mode v2 in basic mode (Google’s script loads only after consent).

Consent record: to be able to demonstrate your consent (Art. 7(1) GDPR), our server stores a record of each choice you make in the cookie banner – a randomly generated consent ID (also kept in your browser), date and time, site, banner version, the chosen categories and how you chose (accept all / reject all / save settings). We do not store your IP address, browser details or anything that directly identifies you. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR). Records are deleted automatically after 3 years.

• Inquiries and business correspondence: for the duration of discussions and then 3 years from the last contact, matching the general limitation period (Section 629 of the Czech Civil Code). If a contract is concluded, for its term and the limitation period, and as required by accounting and tax law (typically 5 to 10 years).
• Inquiry source data: for the same period as the inquiry.
• Server logs: briefly, per the hosting provider’s settings, typically no more than 30 days.
• Google Analytics: 14 months from collection. Cookie durations are listed in Section III.
• Consent records (given, changed or withdrawn): 3 years from creation, then deleted automatically.

After the retention period we delete or irreversibly anonymise the data.

• Vercel Inc. (USA) – website hosting and server logs; processor.
• Neon Inc. (USA), via the Vercel platform – inquiry database hosted in an EU data centre (Frankfurt am Main); processor.
• Sendinblue SAS (France, Brevo service) – sends the new-inquiry notification to our company mailbox; processor.
• Google Ireland Limited (Ireland) – Google Analytics 4 and Google Ads, consent only; for advertising services Google may act as an independent controller.
• Meta Platforms Ireland Limited (Ireland) – Meta Pixel and Meta Conversions API, consent only; joint controllership for collection and transmission (CJEU C-40/17 Fashion ID) under Meta’s Controller Addendum.
• LinkedIn Ireland Unlimited Company (Ireland) – LinkedIn Insight Tag, consent only; as with Meta.
• Pinterest Europe Limited (Ireland) – Pinterest Tag, consent only; as with Meta.
• Public authorities – only where required by law.

We have data processing agreements with our processors under Art. 28 GDPR. We do not sell personal data.

Vercel Inc. and Neon Inc. are based in the USA; Google, Meta, LinkedIn and Pinterest may process data through their US parent companies. Transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework of 10 July 2023 where the recipient is certified, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

• access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20);
• objection to processing based on legitimate interest (Art. 21(1) GDPR) and, at any time, to direct marketing (Art. 21(2));
• withdrawal of consent at any time, without affecting prior processing (Art. 7(3) GDPR);
• complaint to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz (Art. 77 GDPR), or to the supervisory authority of your EU member state of residence or work.

Exercise your rights at info@lumivix.cz. We respond without undue delay and within one month; in complex cases this may be extended by two further months (Art. 12(3) GDPR). It is free of charge; where we have reasonable doubts we may ask you to verify your identity.

8.1.The site is intended for businesses and their staff, not for persons under 15.

8.2.We apply appropriate technical and organisational measures (Art. 32 GDPR): encrypted HTTPS connections, protected and restricted database access, and storage of form data in an EU data centre.

We may update this notice, in particular when the tools we use change. The current version, with its effective date, is always published on this page. In case of discrepancy between the Czech and English versions, the Czech version prevails.