Information on the processing of personal data

Document No.: DOC-GDPR-005

Revision: 1.0

Effective Date: 1 January 2026

This document is the Seller's detailed GDPR information notice. For a shorter, user-facing overview, please also see the Seller's separate Privacy Policy, published on the Seller's website.

1. Data Controller

GEZGİN OUTDOOR s.r.o., with its registered seat at Vojtěšská 211/6, Nové Město, 110 00 Prague 1, Czech Republic, Company ID (IČO): 27432114, registered in the Commercial Register maintained by the Municipal Court in Prague (hereinafter the “Controller” or the “Seller”), is the controller of the personal data described in this document, within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

Contact: info@gezginoutdoor.com | +420 777 789 091.

2. Whose Personal Data We Process

• Contact persons, representatives, and employees of registered Buyers and Contractors (natural persons acting on behalf of a business entity);
• Buyers who are natural persons (including sole traders and, where applicable, consumers) placing orders with the Seller;
• Users of the e-order web service and holders of the Customer Card;
• Visitors to the Seller's websites (including brand-specific websites operated by GEZGİN OUTDOOR s.r.o.);
• Callers to the Seller's customer hotline.

3. What Personal Data We Process

• Identification data: name, surname, job title, employer/company name;
• Contact data: e-mail address, telephone number, delivery and billing address;
• Contractual and transactional data: order history, invoices, delivery notes, payment and credit information, complaint records;
• Account data: e-order login credentials, Customer Card number and associated purchase/loyalty history;
• Communication data: content of e-mail correspondence, and, where the customer hotline is used, call recordings (see Article 8 below);
• Technical data collected via the website through cookies and similar technologies, as further described in the Seller's separate Cookie Policy.

4. Purposes and Legal Basis of Processing

4.1 Performance of the purchase contract (Art. 6(1)(b) GDPR)

Processing necessary for Buyer registration, order processing, delivery, invoicing, payment collection, returnable packaging management, and handling of complaints and withdrawals, as described in the GTC, the e-order Terms, and the Customer Card Terms.

4.2 Compliance with legal obligations (Art. 6(1)(c) GDPR)

Processing necessary to comply with accounting, tax, and record-keeping obligations under Czech law (e.g., retention of tax documents), and to respond to requests from public authorities.

4.3 Legitimate interests of the Controller (Art. 6(1)(f) GDPR)

Processing necessary for: fraud prevention and credit risk assessment; maintaining the security and functionality of the e-order system; call recording for quality assurance and dispute resolution purposes (Article 8); direct business communication with existing Buyers regarding similar goods and services; and the establishment, exercise, or defence of legal claims.

4.4 Consent (Art. 6(1)(a) GDPR)

Where required by law, certain processing activities (e.g., non-essential cookies, or marketing communications to persons who are not existing customers) are carried out only on the basis of the data subject's freely given, specific, informed consent, which may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

5. Recipients of Personal Data

Personal data may be shared with: IT and software service providers operating the Seller's ordering, accounting, and e-order systems (as referred to in Article XIX.2 of the GTC); logistics and delivery partners; payment processors and financial institutions; professional advisors (auditors, legal counsel); and public authorities, where required by law. The Seller requires such recipients, acting as processors, to provide appropriate safeguards for personal data through written data processing agreements.

Personal data is processed within the European Economic Area. If, exceptionally, personal data were to be transferred to a recipient outside the EEA, the Seller shall ensure such transfer is subject to appropriate safeguards recognized under Chapter V of the GDPR (e.g., the European Commission's Standard Contractual Clauses).

6. Retention Period

Personal data is retained for the duration of the contractual relationship and, thereafter, for the periods required by applicable law (in particular, accounting and tax records are retained for the statutory periods under Czech law, generally up to 10 years), or until the expiry of the relevant statute of limitations for potential legal claims. Data processed solely on the basis of consent is retained until the consent is withdrawn.

7. Rights of Data Subjects

Subject to the conditions set out in the GDPR, a data subject has the right to: request access to their personal data; request rectification of inaccurate data; request erasure of their data; request restriction of processing; object to processing carried out on the basis of legitimate interests, including profiling; request data portability; and withdraw consent at any time, where processing is based on consent.

These rights may be exercised by contacting the Controller at info@gezginoutdoor.com. The Controller will respond to such requests without undue delay, and in any event within one month, as required by the GDPR.

A data subject also has the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Czech Republic (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, or with the supervisory authority of their habitual residence or place of the alleged infringement.

8. Call Recording

As set out in Article XIX.4 of the GTC, calls made to the Seller's customer telephone hotline may be recorded for the purpose of evaluating and improving the quality of services provided, and for the documentation of orders and complaints. Callers are informed of the recording at the start of the call and may object to the recording, in which case the call may be continued without recording or handled by alternative means.

9. Automated Decision-Making

The Controller does not carry out processing that produces legal effects concerning data subjects or similarly significantly affects them based solely on automated processing, including profiling, without human involvement.

10. Website Cookies

Information on the use of cookies and similar technologies on the Seller's website is set out in the separate Cookie Policy, published on the Seller's website.

11. Changes to this Document

The Controller may update this document from time to time to reflect changes in its data processing practices or in applicable law. The current version is always available on the Seller's website.

Language. In the event of any discrepancy or difference in interpretation between this English version and the Czech-language version of this Information on the Processing of Personal Data, the Czech-language version shall be exclusively decisive and binding, without prejudice to any mandatory consumer-protection rights under applicable law.