This is an English translation provided for information purposes. In case of any discrepancy, the Czech version prevails.
Personal Data Processing Policy
Effective from the date of publication
This policy describes how KUMO Transport s.r.o. processes personal data in connection with the operation of the websites www.kumogroup.cz, www.kumotransport.cz (including its language versions and pages for investors), www.kumopack.cz (including the e-shop) and www.kumocars.cz (together the “Websites”) and with the activities offered on the Websites, i.e. the transport services of KUMO Transport, the manufacture and sale of packaging by KUMO Pack, the sale of vehicles by KUMO Cars and the offering of investment securities. Details on cookies can be found in the Cookie Policy below on this page.
1. Controller and scope of the policy
1.1 The controller of personal data is KUMO Transport s.r.o., with its registered office at Kaprova 42/14, Staré Město, 110 00 Prague 1, Company ID No. 199 44 705, VAT No. CZ19944705, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 394284 (the “Controller”).
1.2 In matters of personal data protection, the Controller can be contacted at the address of its registered office or by e-mail at info@kumotransport.cz. The Controller has not appointed a data protection officer.
1.3 This policy applies in particular to visitors to the Websites, persons interested in the Controller’s services and goods and its customers (including customers of the KUMO Pack e-shop and persons interested in buying vehicles from KUMO Cars), persons interested in investing and investors, contact persons of customers, suppliers and other business partners, recipients of commercial communications and persons making a complaint, withdrawing from a contract or making another request.
2. Data processed and their sources
2.1 Depending on the specific purpose, the Controller processes in particular:
(a) identification and contact data, e.g. first name and surname, business name and company ID number of an entrepreneur, address, e-mail and telephone number;
(b) data on enquiries, orders, contracts, payments, delivery, complaints and withdrawals from contracts, including data on the customer account in the e-shop;
(c) the content of communication with the Controller;
(d) for persons interested in investing, the approximate amount of the investment under consideration;
(e) for investors who have subscribed for securities, the date of birth and permanent address, for legal entities data on registration in a public register and on representation, bank details and data on the securities subscribed and redeemed;
(f) marketing preferences and data on responses to commercial communications, e.g. on opening an e-mail or clicking a link;
(g) technical data on the device and on the use of the Websites, e.g. IP address, browser type, pages visited and cookie identifiers.
2.2 The Controller obtains the data directly from the data subject, from the person on whose behalf the data subject acts, through the use of the Websites and their functions, from the service providers listed in Article 5 or from public registers.
3. Purposes, legal bases and retention periods
3.1 The scope of processing depends on how a person communicates with the Controller and which services they use. A basic overview is given below.
| Purpose | Legal basis | Basic retention period |
|---|---|---|
| Enquiry or question via the contact form, e-mail or telephone, price quotation and negotiations prior to entering into a contract | Art. 6(1)(b) GDPR; for contact persons of legal entities Art. 6(1)(f) – legitimate interest in communicating with business partners | For the duration of negotiations and generally 1 year from the last communication |
| Conclusion and performance of a contract – transport services, sale of packaging including e-shop orders and custom manufacturing, sale of vehicles – including payment and delivery | Art. 6(1)(b) GDPR; for contact persons of legal entities Art. 6(1)(f) – legitimate interest in communicating with business partners | For the duration of the contract |
| Customer account in the e-shop | Art. 6(1)(b) GDPR | For as long as the account exists; the account can be cancelled at any time |
| Complaints, withdrawal from a contract and rights arising from defective performance | Art. 6(1)(b) and (c) GDPR | Until the matter is settled |
| Arranging a meeting and negotiating an investment at the request of the interested person | Art. 6(1)(b) GDPR | For the duration of negotiations and generally 1 year from the last communication |
| Subscription, issue and administration of securities, keeping the list of holders, payment of returns and redemption | Art. 6(1)(b) and (c) GDPR | For as long as the securities are held and thereafter for the period laid down by law, generally 10 years |
| Accounting, tax and other legal obligations | Art. 6(1)(c) GDPR | For the period laid down by law; generally 10 years for tax and accounting documents |
| Sending commercial communications about the Controller’s own similar goods and services to existing customers | Art. 6(1)(f) GDPR – legitimate interest in direct marketing; Section 7(3) of Act No. 480/2004 Coll. | Until an objection is raised or the recipient unsubscribes; a limited record of the objection is kept in order to respect it |
| Sending the newsletter and commercial communications to other interested persons, including news for investors | Consent under Art. 6(1)(a) GDPR and Section 7(2) of Act No. 480/2004 Coll. | Until consent is withdrawn; proof of consent generally for 3 years thereafter |
| Evaluation of opens and clicks in commercial communications | For newsletter subscribers, consent under Art. 6(1)(a) GDPR; for existing customers Art. 6(1)(f) GDPR – legitimate interest in evaluating the effectiveness of communications | For as long as commercial communications are sent |
| Traffic analytics and evaluation of the performance of the Websites | Consent under Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll. | Data in Google Analytics for no longer than 14 months; for cookie lifetimes see the Cookie Policy |
| Targeted advertising, remarketing and conversion tracking; display of embedded third-party content (videos, maps) | Consent under Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll. | According to the rules of the respective provider; for cookie lifetimes see the Cookie Policy |
| Technical operation, security and prevention of misuse of the Websites | Art. 6(1)(f) GDPR – legitimate interest in the secure and functional operation of the Websites; for strictly necessary cookies Section 89(3) of Act No. 127/2005 Coll. | Technical logs generally for no longer than 6 months, unless a security incident occurs |
| Establishment and defence of legal claims, including keeping documentation after the end of a contract | Art. 6(1)(f) GDPR – legitimate interest in protecting legal claims | For the duration of the limitation periods, generally 3 years from performance of the contract or settlement of the complaint; longer in the event of a pending dispute |
3.2 The Controller may keep the data for longer only if this is necessary to comply with a legal obligation or to protect legal claims. Thereafter it erases or anonymises the data.
3.3 Providing the data needed to handle an enquiry, to enter into and perform a contract or to subscribe for securities is a contractual or statutory requirement; without them the request cannot be handled or the contract cannot be concluded. Giving consent for marketing purposes and to cookies is voluntary.
4. Commercial communications
4.1 Consent to receiving the newsletter can be given when subscribing to it on the Websites. The Controller may send existing customers whose contact details it obtained in connection with the sale of its goods or services commercial communications relating to its own similar goods or services even without consent, unless the customer refused this when the contact details were obtained or later. The Controller sends offers relating to its other activities (e.g. offers of vehicles or investments to customers of its transport services) only with consent.
4.2 It is possible to unsubscribe at any time via the link in each communication or by contacting the Controller as set out in Article 1.2. An objection to processing for direct marketing purposes can be raised in the same way; the Controller will then no longer use the data for that purpose.
4.3 Commercial communications sent via the Ecomail service contain tracking elements that record the opening of the e-mail and clicks on links.
5. Recipients and transfers abroad
5.1 Only authorised employees of the Controller and its suppliers have access to personal data, to the extent necessary for their work. Recipients may include in particular providers of hosting, IT services, the content management system and form automation, the operator of the e-shop platform, providers of e-mailing, analytics and advertising services, payment service providers and banks, carriers, accountants and tax advisers, the auditor, legal advisers and public authorities where required by law.
5.2 In connection with the Websites, the Controller uses in particular the following services:
| Provider | Service | Role |
|---|---|---|
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics 4, Looker Studio | Processor |
| Google Ireland Limited | Google Ads | Independent controller, processor for certain functions |
| Google Ireland Limited | Embedded YouTube videos; embedded Google Maps | Independent controller |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland | Meta Pixel (Facebook, Instagram) | Joint controller for the collection and transmission of data, thereafter independent controller (see Article 5.3) |
| LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland | LinkedIn Insight Tag | Joint controller for the collection and transmission of data, thereafter independent controller (see Article 5.3) |
| Seznam.cz, a.s., Radlická 3294/10, Smíchov, 150 00 Prague 5 | Sklik – conversion tracking and retargeting | Independent controller |
| Tanganica s.r.o. | Tanganica – management and evaluation of advertising campaigns | Processor |
| Ecomail.cz, s.r.o. | Ecomail – sending newsletters and commercial communications | Processor |
| Shoptet, a.s. | Shoptet – operation of the KUMO Pack e-shop | Processor |
5.3 When data are collected via the Meta Pixel and the LinkedIn Insight Tag on the Websites and transmitted to Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company, the Controller and the respective provider are joint controllers under Article 26 GDPR. Under their arrangement, the Controller is responsible for obtaining consent and providing information about this processing, and the provider is responsible for the subsequent processing, which it carries out as an independent controller, including handling requests concerning the data stored by it. The data subject may exercise their rights against either of them.
5.4 Some providers may transfer data outside the European Economic Area, in particular to the USA. For recipients certified under the EU–US Data Privacy Framework, the transfer is safeguarded by a European Commission adequacy decision; for other recipients by standard contractual clauses adopted by the European Commission. Information on these safeguards, including how to obtain a copy of them, can be requested by contacting the Controller as set out in Article 1.2.
6. Cookies and similar technologies
6.1 Information about the cookies used is set out in the Cookie Policy below on this page.
7. Rights of data subjects
7.1 Under the conditions of the GDPR, the data subject has the right to request access to their personal data and its rectification or erasure, restriction of processing, data portability and information about the processing. They also have the right to object to processing based on legitimate interest, including direct marketing, and to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
7.2 A request can be submitted by contacting the Controller as set out in Article 1.2.
7.3 The data subject has the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
8. Final provisions
8.1 The current version of this policy is always published on the Websites. This policy takes effect on the date of its publication.
Cookie Policy
Effective from the date of publication
1. Basic information
1.1 This policy explains the use of cookies and similar technologies on the websites www.kumogroup.cz, www.kumotransport.cz (including its language versions and pages for investors), www.kumopack.cz (including the e-shop) and www.kumocars.cz (together the “Websites”), which are operated by KUMO Transport s.r.o., with its registered office at Kaprova 42/14, Staré Město, 110 00 Prague 1, Company ID No. 199 44 705 (the “Operator”).
1.2 A cookie is a small file stored on the visitor’s device. Similar technologies include in particular pixels, tags and local storage.
2. Legal basis and the visitor’s choice
2.1 The Operator uses strictly necessary technologies without consent pursuant to Section 89(3) of Act No. 127/2005 Coll.
2.2 The Operator uses other technologies only with the visitor’s consent, which can be given in the cookie bar for individual categories and changed or withdrawn at any time via the “Cookie settings” link in the footer of the Websites. The choice is stored separately for each Website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
3. Categories of technologies
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Remembering the cookie choice, security, operation of the basket, orders and login in the e-shop and other functions necessary for the operation of the Websites. | Not required; this category cannot be switched off |
| Analytics | Measuring traffic, performance and use of the Websites and compiling aggregate statistics. | Required |
| Marketing | Campaign evaluation, conversion tracking, remarketing, audience building, display of relevant advertising and display of embedded third-party content (YouTube videos, Google Maps). | Required |
4. Services used
4.1 The Operator uses the following services on the Websites:
| Service | Category | Purpose |
|---|---|---|
| Cookie bar of the Websites | Strictly necessary | Storing the choice of cookie categories. |
| Shoptet | Strictly necessary | Operation of the KUMO Pack e-shop (basket, order, login to the customer account). |
| Google Analytics 4 | Analytics | Measuring traffic and behaviour on the Websites. Measurement IDs: G-Z77PSRD0SK (kumogroup.cz), G-JZRRMJ7TQB (kumotransport.cz), G-46WN8RJGXV (kumopack.cz), G-KB67NFZ0SH (kumocars.cz). |
| Google Ads | Marketing | Conversion tracking, remarketing and display of advertising in the Google network. |
| Meta Pixel | Marketing | Conversion tracking, remarketing and advertising on Facebook and Instagram. |
| LinkedIn Insight Tag | Marketing | Conversion tracking, remarketing and advertising on the LinkedIn network. |
| Sklik (Seznam.cz) | Marketing | Conversion tracking and retargeting in the Sklik advertising system. |
| Tanganica | Marketing | Management and evaluation of advertising campaigns and conversion tracking. |
| Ecomail | Marketing | Linking visits to the Websites with e-mail campaigns and evaluating them. |
| YouTube | Marketing | Playback of embedded videos. |
| Google Maps | Marketing | Display of embedded maps. |
5. Overview of specific cookies
5.1 The main cookies set by the Websites and the services listed are shown below. The actual list may vary depending on the configuration and on changes made by the providers.
| Provider / cookie | Purpose | Duration |
|---|---|---|
| Website: kumo_souhlas | Storing the choice of cookie categories | 6 months |
| Shoptet: e-shop session cookies (e.g. PHPSESSID) | Basket, order and login | Until the end of the session |
| Google Analytics: _ga | Distinguishing visitors | 2 years |
| Google Analytics: _ga_<measurement ID> | Maintaining the session state of the GA4 service | 2 years |
| Google Ads: _gcl_au, _gcl_aw | Tracking conversions from Google ads | 3 months |
| Google (doubleclick.net): IDE | Remarketing and display of advertising | 13 months |
| Meta: _fbp, or _fbc | Distinguishing the browser, measurement and attribution of ad visits | 3 months |
| LinkedIn: li_fat_id, bcookie, lidc | Conversion tracking, distinguishing the browser and routing requests | 30 days to 1 year |
| Seznam.cz: sid | Sklik conversion tracking and retargeting | Up to 1 year |
| Tanganica: campaign tracking cookies | Attributing conversions to advertising campaigns | Up to 1 year |
| Ecomail: campaign tracking cookie | Linking a visit with an e-mail campaign | Up to 1 year |
| YouTube: YSC, VISITOR_INFO1_LIVE | Video playback and playback statistics | Until the end of the session (YSC), 6 months (VISITOR_INFO1_LIVE) |
| Google Maps: NID | Displaying the map and storing preferences | 6 months |
6. Recipients and transfers abroad
6.1 Depending on the category chosen, data obtained through these technologies are received by the providers listed in Article 4. Their role (processor, independent controller or joint controller) and information on transfers of data outside the European Economic Area are set out in Article 5 of the Personal Data Processing Policy above on this page.
7. Contact and effective date
7.1 Questions can be sent to info@kumotransport.cz. Further information is contained in the Personal Data Processing Policy above on this page. This policy takes effect on the date of its publication.