Cookie Policy Principles

Data Controller: Baumann Group a.s.
Trade Brand: GOLDU ®
Registered Office: Vyskočilova 1481/4, 140 00 Prague 4, Czech Republic
Company ID No.: 22263284
VAT ID No.: CZ22263284
Registered in the Commercial Register: Municipal Court in Prague, Section B, Insert 29197
Operator of the Website and E-shop: Baumann Group a.s.
Website: www.goldu.cz
E-mail: info@goldu.eu
Telephone: +420 601 359 200

1. Identity and Contact Details of the Data Controller

1.1. Baumann Group a.s., as the operator of the e-shop at www.goldu.cz, acts as the data controller in relation to the processing of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 (“GDPR”).

1.2. The data controller determines the purposes and means of the processing of personal data.

2. General Information on the Processing of Personal Data

2.1. Personal data are accessible only to authorized persons of the data controller who are bound by confidentiality obligations and have been duly instructed regarding the principles of personal data protection and processing security.

2.2. The controller uses only such processors as provide sufficient guarantees for the protection of personal data.

2.3. Personal data are transferred only by appropriate secure means.

2.4. The controller is not obliged to appoint a Data Protection Officer pursuant to Article 37 GDPR.

2.5. As a standard practice, the controller does not transfer personal data to third countries or international organizations unless required for the performance of a contract, by the service used, or by law. In such a case, the controller shall proceed in accordance with the GDPR.

2.6. The controller does not carry out automated individual decision-making or profiling within the meaning of Article 22 GDPR.

3. Personal Data Processed, Period of Processing, and Purpose of Processing

3.1. Communication by E-mail or Chat
The controller processes first name, surname, e-mail address, where applicable telephone number, and other data provided in the communication for the purpose of handling the client’s inquiry or request, for the period necessary to deal with the relevant communication and, where applicable, for the period necessary to protect the legitimate interests of the controller.

3.2. Conclusion and Performance of a Contract
In connection with the conclusion and performance of a purchase agreement, buy-back transaction, or other service, the controller processes in particular first name, surname, address, telephone number, e-mail address, and other data necessary for the implementation of the contractual relationship, for the duration of the contractual relationship and subsequently for the period required by law.

3.3. Verification of Identity
For the purpose of verifying the client’s identity, the controller may process identification data from an identity document to the extent necessary for the performance of a contract, the protection of the legitimate interests of the controller, or compliance with a legal obligation, in particular under AML regulations. The controller does not make copies of identity documents unless required by law.

3.4. Persons Authorized to Collect Goods
If the client authorizes another person to collect the goods, the controller processes the first name, surname, and where applicable other necessary identification and contact details of such person for the purpose of handing over the goods and protecting the controller’s rights.

3.5. Price Alert Service
In connection with the Price Alert service, the controller processes the client’s e-mail address and, where applicable, telephone number for the purpose of sending the requested notification, for the period necessary to handle the specific request or until the request is withdrawn.

3.6. Marketing
The controller may process the client’s first name, surname, and e-mail address for the purpose of sending commercial communications, either on the basis of consent or, where permitted by law, within the scope of the controller’s legitimate interest. Such processing takes place until consent is withdrawn, an objection is raised, or the subscription is cancelled.

3.7. Cookies and Similar Technologies
The controller may process data obtained through cookies and similar technologies to the extent corresponding to the client’s settings, consent, and the settings of the internet browser or website.

3.8. In certain cases, the provision of personal data is necessary for the conclusion and performance of a contract or for compliance with a legal obligation of the controller. Failure to provide the requested data may constitute grounds for not concluding the contract or not providing the requested performance.

4. Legal Basis for the Processing of Personal Data

4.1. The controller processes personal data in particular on the basis of:

a) the performance of a contract or measures taken prior to entering into a contract at the client’s request,

b) compliance with a legal obligation applicable to the controller, in particular under Act No. 253/2008 Coll., as amended,

c) the legitimate interest of the controller, in particular for the protection of property, direct marketing, or ensuring the security of the website,

d) the client’s consent, in particular for the sending of commercial communications or the use of certain types of cookies.

5. Legitimate Interest of the Controller

5.1. Protection of Property and Safety of Persons
The controller’s premises may be monitored by a CCTV system with recording for the purpose of protecting the controller’s property and the safety of persons. Recordings are retained for the period strictly necessary, usually for no longer than 72 hours, unless a specific case requires longer retention for the protection of the controller’s rights.

5.2. Direct Marketing
Subject to the conditions laid down by law, the controller may process the client’s e-mail address obtained in connection with the sale of goods or services for the purpose of sending commercial communications concerning its own similar products or services, until the client objects or unsubscribes.

5.3. Cookies
The controller uses technical cookies as well as analytical or marketing cookies in accordance with the user’s consent settings. The client may change the cookie settings at any time through the internet browser or through the settings available on the website.

6. Recipients of Personal Data

6.1. Recipients of personal data include in particular processors, IT service providers, carriers, accountants, legal or tax advisors, and other entities where necessary for the purpose of processing.

6.2. Personal data are provided to recipients only to the extent necessary and always by appropriate secure means.

7. Client’s Rights in Relation to Personal Data

7.1. The client has in particular the following rights:

a) the right of access to personal data,
b) the right to rectification of inaccurate or incomplete personal data,
c) the right to erasure of personal data where the conditions set out in the GDPR are met,
d) the right to restriction of processing,
e) the right to data portability, provided that the processing is based on consent or a contract and is carried out by automated means,
f) the right to withdraw consent at any time where processing is based on consent,
g) the right to object to processing where the legal basis is the legitimate interest of the controller,
h) the right to lodge a complaint with a supervisory authority.

7.2. The supervisory authority in the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.gov.cz.

8. Right to Object

8.1. The client has the right to object at any time to the processing of personal data carried out by the controller on the basis of its legitimate interest.

8.2. The client also has the right to object at any time to the processing of personal data for direct marketing purposes. In such a case, the controller shall cease processing the personal data for this purpose without undue delay.

9. Principles of Personal Data Processing

9.1. In the processing of personal data, the controller complies with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

9.2. The controller adopts appropriate technical and organizational measures to protect personal data against unauthorized access, misuse, loss, or other unauthorized processing.

10. Final Provisions

10.1. The controller is entitled to amend or supplement these principles of personal data processing. The new version shall always be published on the company’s website.

10.2. By submitting an order or otherwise providing personal data, the client confirms that they had the opportunity to review these principles of personal data processing in advance.

These principles of personal data processing become effective on 29 March 2026.

Baumann Group a.s.