Privacy policy
Privacy Notice on the processing of personal data
version 3. 4. 2025
Who are we?
The subject of business of Exit Rat Race s.r.o., ID No.: 49450301, with registered office at Sportovní 845/20, Vršovice, 101 00 Praha 10, Czech republic, registered in the Commercial Register maintained by the Municipal Court in Prague, under file number C 403713, contact: info@exitrr.com (hereinafter referred to as ERR) sells goods with customized prints, i.e. tailored to the customer's choice using their decisions or print data. An integral part of the business activity is also marketing activity to promote the ERR and its goods and to improve services to customers, which includes the processing of personal data of customers and including contact details needed for delivery of goods.
ERR is the controller of personal data. Enquiries about the processing of your personal data will be answered by ERR sending them to the email address info@exitrr.com or by post to ERR's registered office. Information on the processing of your personal data you can always find on ERR's website.
What do we have to do to process your data?
ERR, as the data controller, is obliged to comply with its obligations under the law when processing personal data. ERR regularly checks the compliance of its procedures with applicable legislation and takes a responsible approach to fulfilling these obligations, with an emphasis on preserving the privacy of individuals and protecting their data.
What data do we process about you and for what purposes?
ERR, as a data controller, processes your personal data regarding the purchase contract based on Article 6(1)(b) of GDPR and Article 6(1)(f) of GDPR. For the purpose of the contract ERR is processing your personal data f.e. for following activities: the processing of the product order, the conclusion of the purchase contract, the delivery of the goods, the storage of personal data due to subsequent claims of the consumer or the controller under the relevant legislation for the necessary period of time provided for by law.
The purpose of the processing of personal data is the processing of your order and the exercise of rights and obligations arising from the contractual relationship between you and ERR; when placing an order, personal data are required that are necessary for the successful processing of the order (name and address, contact details), the provision of personal data is a necessary requirement for the conclusion and performance of the contract. Without the provision of personal data it is not possible to conclude the contract or its performance by ERR.
ERR processes personal data that you have provided to ERR or personal data that ERR has obtained on the basis of the fulfilment of your order or / and purchase contract. ERR processes your personal data such as name, surname, address, phone number, e-mail address and contact data necessary for the performance of the contract and for the delivery of goods.
Data retention period
ERR retains the personal data for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and ERR and to assert claims arising from these contractual relationships.
After the expiry of the retention period, the controller will delete the personal data.
Why do we process your personal data and how long do we keep it?
ERR keeps the personal data for the entire duration of the contractual relationship in order to fulfil the contract and the contractual obligations and exercise the rights arising from it. For the purpose of archiving contracts and for the exercise of any claims that may arise from the contract after its termination, we retain the data for the period necessary to exercise these claims after the termination of the contractual relationship. After the expiry of the retention period, the controller will delete the personal data.
Special categories of personal data are not subject to processing.
With whom do we share your data or to whom do we pass it on?
Your personal data is not shared with another data controller.
We may share processed personal data on a limited basis with processors who perform certain activities for us, such as providing e-shop operation services and other services in connection with the operation of the e-shop, providing the service of printing goods, delivery of goods to customers, processing complete tax documents and payments, managing customer service etc. The processing of personal data may only be carried out for ERR by processors on the basis of a contract for the processing of personal data, i.e. with guarantees for the organisational and technical security of the data and with a definition of the purpose of the processing, whereby the processors may not use the data for other purposes.
Transfer of personal data outside the European Union
Personal are transferred to third parties based outside the European Union, namely Canada with a guarantee of compliance with all relevant requirements EU regulations, especially GDPR. To meet all requirements, ERR and his processors rely on the European Commission’s adequacy decision for Canada when personal data are transferred to Canada.
The existence of automated decision-making including profiling
No automated individual decision-making or profiling is carried out.
What are Data security measures
ERR declares that it has taken all appropriate technical and organisational measures to secure personal data. ERR has taken technical measures to secure data storage and storage of personal data in paper form, in particular anti-virus programs, backups, encryption etc. ERR declares further that only persons authorised by it have access to personal data.
Cookies
We process cookies automatically. Personalisation, marketing and analytical advertising can be disabled anytime in Cookies Preferences in the bottom bar of the ERR's website.
What is a cookie file?
A cookie is a small text file created upon a visit to a website. It serves as a standard tool for the storage of information about visits to our website and how our website is used.
Thus we can distinguish (but not identify) individual users and customise the content to individual preferences. Cookies are important and web browsing would be far more difficult without them.
What are cookies used for?
Cookies serve several purposes. We use the following cookies on our e-shop website and in our mobile applications:
Technical cookies
We use technical cookies to ensure our e-shop works properly (e.g. for you to create a user profile, log in, and buy goods and services). The e-shop would not work without these cookies. For this reason, these cookies are marked as required .
Analytical cookies
Analytical cookies help us improve our online store, which ultimately benefits you. Analytical cookies on our website are collected by the Google Inc. script, which subsequently anonymises the data. The data ceases to be personal data after anonymisation: anonymised cookies cannot be matched with a particular user or person. We only work with anonymised cookies. Even if we wanted to, we would be unable to find out the way in which any particular user behaved on our website (sites visited, goods displayed etc.).
| Partner | Usage | Privacy Policy |
|---|---|---|
| Google Analytics | Analysis of web page usage | https://business.safety.google/privacy |
| Microsoft Clarity | Analysis of web page usage | https://clarity.microsoft.com/privacy |
Marketing cookies
These cookies track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers.
Cookies for personalization
These cookies store details about your actions to personalize your next visit to the website.
We also use the findings obtained from these cookies for advertising purposes; we may also display an ad that we consider relevant to you on other websites.
How you can control which cookies we will process
You can use one of the common browsers with anonymous browsing switched on. This shall prevent storage of data concerning the sites visited. You can also block the storage of cookies in the browser. However, if you block the processing of technical and functional cookies, you will disable certain useful website functions.
You can easily control the processing of analytical cookies by us if you use this add-on program from Google (can only be run on a computer). However, switching off analytical cookies makes it difficult for us to improve our online store experience.
Data protection rights and remedies specific to cookies
Your data protection rights and remedies and their limitations are set out in detail in the GDPR (in particular Articles 15, 16, 17, 18, 19, 21, 22, 77, 78, 79 and 82).
You as user:
- may prohibit and allow the placement of cookies by means of the cookie settings;
- may request information on what personal data is processed when using cookies;
- may request the rectification of his/her personal data processed when using cookies; and
- may request the deletion of his/her personal data processed when using cookies or the restriction of their processing.
Without prejudice to any other administrative or judicial remedies, you have the right to lodge a complaint with a data protection supervisory authority - in particular in the Member State of his/her habitual residence, place of work or place of suspected infringement - if the processing of personal data in the use of cookies infringes the provisions of the GDPR.
You can obtain information on the supervisory authorities operating in the territory of the European Union on this website: https://edpb.europa.eu/about-edpb/about-edpb/members_cs
What are the rights of individuals when processing their personal data?
The GDPR sets out in detail your data protection rights and the available legal remedies, as well as the restrictions thereof (in particular Articles 5, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79 and 82 of the GDPR). You can request information at any time about personal data processed concerning you, you can request the rectification or erasure of your personal data or the restriction of the processing, furthermore you can object to data processing based on a legitimate interest. The most important provisions are summarised below.
Right to information
Where the ERR processes personal data concerning you, it must provide you with information concerning the data relating to you – even without your special request to that effect – concerning the main characteristics of the data processing including the purpose, legal basis and period of processing, the identity and contact details of the ERR and its representative, the contact details of the data protection officer, the recipients of the personal data (in case of data transfer to third countries indicating also the adequate and appropriate guarantees), the legitimate interests of the ERR and/or third parties in case of a data processing based on a legitimate interest, furthermore your data protection rights and your possibilities of seeking a legal remedy (including the right of lodging a complaint with the supervisory authority), the source of personal data – if you are not the source –, as well as the categories of personal data, in the case you have not had yet all this information. In case of automated decision-making and profiling you must be informed by the ERR in an understandable way about the logic involved, as well as the significance and the envisaged consequences of such processing for you. Controllers provide the above mentioned information by making this privacy notice available to you.
Right of access
You have the right to obtain from the ERR confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain information related to the data processing such as the purpose of the data processing, the categories of the personal data processed, the recipients of the personal data, the (scheduled) duration of the data processing, the data subject’s data protection rights and possibilities of seeking a legal remedy (including the right of lodging a complaint with the supervisory authority), furthermore information on the source of the data, where they are collected from the data subject.
At your request, the ERR shall provide you with a copy of your personal data undergoing processing. For any further copies requested by you, the ERR may charge a reasonable fee based on administrative costs. If you submitted your request by electronic means, the information should be provided in a commonly used electronic format, unless otherwise requested by you. The right to obtain a copy shall not adversely affect the rights and freedoms of others.
The ERR give you information on the possibility, the procedure, the potential costs and other details of providing the copy after receiving your request.
In case of automated decision-making and profiling the individual has access to the following information: the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Right to rectification
You have the right to obtain from the ERR without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure
You have the right to obtain from the ERR the erasure of personal data concerning you without undue delay and the ERR shall have the obligation to erase personal data without undue delay where certain grounds apply or certain conditions are met. Among other grounds, the ERR is obliged to erase your personal data at your request if, for example, the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; if you withdraw your consent on which the processing is based, and where there is no other legal ground for the processing; if the personal data have been unlawfully processed; or if you object to the processing and there are no overriding legitimate grounds for the processing; if the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the ERR is subject; or if the personal data have been collected in relation to the offer of information society services.
If the data processing is based on your consent the consequence of the withdrawal of the consent: we do not send or offer tailored, personalised marketing (advertising) messages, promotional offers, coupons.
We inform you that the withdrawal of your consent does not affect the legality of the data processing carried out before the withdrawal, based on your consent.
Right to restriction of processing
You have the right to obtain from the ERR restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by you, for a period enabling the ERR to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- the ERR no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
- you have objected to processing, pending the verification whether the legitimate grounds of the ERR override your legitimate grounds.
Where the processing has been restricted for any of the above-mentioned reasons, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You shall be informed by the ERR before the restriction of processing requested by you is lifted.
Right to data portability
You have the right to receive the personal data concerning you, which you provided to controllers in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from controllers to which the personal data have been provided, where:
- the processing is based on your consent or on the performance of a contract (to which you are a party); and
- the processing is carried out by automated means.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to data portability shall be without prejudice to the provisions governing the right to erasure; furthermore, it shall not adversely affect the rights and freedoms of others.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on the legitimate interests of the controller, including profiling based on those provisions. In this case, the ERR shall no longer process the personal data unless the ERR demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such direct marketing purposes.
Where you object to the processing of your personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.
The framework of exercising rights
The ERR shall provide information on action taken on a request based on your above-mentioned rights without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The ERR shall inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. Where you made the request by electronic means, the information shall be provided by electronic means, where possible, unless otherwise requested by you.
You can obtain information on the supervisory authorities operating in the territory of the European Union on this website: https://edpb.europa.eu/about-edpb/about-edpb/members_cs
If the ERR does not take action on your request, the controller shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with the competent data protection supervisory authority (in Czech republic: Úřad na ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Česká republika, e-mail: posta@uoou.cz, tel: +420 234 665 111, web page: https://www.uoou.cz and seeking for a judicial remedy).
If your rights are violated, you may be summoned to court. The above falls within the jurisdiction of the ordinary court. Proceedings may be brought before the court of the place of residence of the person concerned at his or her choice. The court may order the data controllers to provide information, to rectify, restrict or erase the data or to cancel the processing based on automated decision-making and to take into account your right to object. The court may order the publication of its judgment to identify the data controller or other data controller and the breach it or they have committed.
You can claim compensation for damages incurred in connection with the unauthorised processing of your data (including failure to take security measures) from the Data Controller responsible for the damage. If the Data Controllers violate your right to protection of your personal data as a result of unauthorised processing or a breach of data security requirements, you can claim damages from the Data Controllers. The data controller is exempt from liability if it proves that the damage or prejudice to the personal data protection rights was caused by an unavoidable cause outside the scope of the processing of the personal data.
Compensation for damages is not required and cannot be claimed if the damage was caused by the willful or gross negligence of the injured party.
The above information must be provided in writing or otherwise, including, where appropriate, the electronic format. At your request, oral information may also be provided, on condition that your identity has been verified in any other way.
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if your consider that the processing of personal data relating to your infringes the provisions of GDPR. You shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning you. Furthermore, you shall have the right to an effective judicial remedy where the competent supervisory authority does not handle your complaint or does not inform you within three months on the progress or outcome of the complaint lodged by you. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, you shall have the right to an effective judicial remedy where you consider that your rights under GDPR have been infringed as a result of the processing of your personal data in non-compliance with GDPR. Proceedings against the ERR or its controller or processor shall be brought before the courts of the Member State where the ERR or its controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.
In the Czech Republic, the action fall within the jurisdiction of the ordinary courts. At the data subject's discretion, the action may be brought before the court of the data subject's place of residence or domicile. For further information on the jurisdiction of the courts and contact details of each court, please visit www.justice.cz.
The court may order the data controller to provide the information, to rectify, block or erase the data in question, to annul the decision adopted by means of automated data-processing systems, to honor your objection. The court may order publication of its decision, indicating the identification of the data controller or any other data controllers and the committed infringement.
The data controller concerned shall be liable for any damage caused to you as a result of unlawful processing or by any breach of data security requirements. Where any data controller violates the rights of the data subject relating to personality as a result of unlawful processing or by any breach of data security requirements, the data subject shall be entitled to demand restitution from the data controller concerned. Data controller may be exempted from liability for damages or for payment of restitution if he proves that the damage was caused by or the violation of the rights of the data subject relating to personality is attributable to inevitable reasons beyond his control.
No compensation shall be paid and no restitution may be demanded where the damage was caused by or the violation of rights relating to personality is attributable to intentional or negligent conduct on the part of the data subject.
Exit Rat Race s.r.o.