Privacy Policy

1. Data controller

As the controller of personal data (the “controller”), we process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

2. Data Protection Officer (DPO)

The controller is not required to appoint a data protection officer under Article 37 GDPR. The controller is not a public authority, does not process special categories of personal data on a large scale, and does not carry out systematic monitoring of individuals to an extent that would establish an obligation to appoint a DPO. A DPO has therefore not been appointed.

Please send questions about the processing of personal data to office@atavus.cz.

3. Purposes and legal bases of processing

We process your personal data exclusively for the purposes listed below and on the basis of the corresponding legal bases under Article 6 GDPR:

Consent is used only to send materials that you voluntarily request. Subsequent pre-contractual communication initiated at your request relies on Article 6(1)(b) GDPR. Withdrawal of consent does not end processing supported by another legal basis, in particular pre-contractual steps, a legal obligation, or the protection of legal rights.

4. Categories of personal data processed

Through the contact form we process the following categories of personal data:

• Identification data: first and last name
• Contact data: e-mail address, phone number (optional)
• Communication data: selected type of inquiry and message content (optional)
• Technical records: submission date and time and IP address, used for security, abuse prevention and server logs

We do not process any special categories of personal data within the meaning of Article 9 GDPR (health data, biometric data, political opinions, etc.).

5. Recipients and processors of personal data

We disclose your personal data only to the extent necessary and on the basis of a written data-processing agreement under Article 28 GDPR, to the following categories of recipients:

We disclose personal data to public authorities (the Czech National Bank, the Office for Personal Data Protection, courts, AML authorities) only to the extent and on the basis provided for by law.

6. Transfer of personal data to third countries

The controller does not currently transfer personal data to third countries outside the European Economic Area (EEA) or to international organisations. The web fonts and all static assets are hosted locally (self-hosted) on server infrastructure in the EU; the website does not load any external CDN. Should a transfer to a third country take place in the future, it will be carried out solely on the basis of an adequacy decision or appropriate safeguards under Article 46 GDPR.

7. Retention period for personal data

After the retention period expires, personal data is securely deleted or anonymised.

8. Your rights as a data subject

As a data subject you have the following rights under GDPR:

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we process your personal data, and a copy of that data along with information on how it is processed.

Right to rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate personal data or the completion of incomplete data.

Right to erasure / the “right to be forgotten” (Art. 17 GDPR)

Subject to the statutory conditions, you have the right to have your personal data erased · in particular if you withdraw your consent or the data is no longer needed for the purpose for which it was collected.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data, for example if you contest its accuracy or the lawfulness of the processing.

Right to data portability (Art. 20 GDPR)

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of a legitimate interest, you have the right to object. We will stop the processing unless we can demonstrate compelling legitimate grounds for continuing it.

Right to withdraw consent

You may withdraw consent to receive the requested materials at any time · without affecting the lawfulness of processing before the withdrawal · by e-mail at office@atavus.cz. Withdrawal does not affect processing based on pre-contractual steps, a legal obligation, or a legitimate interest.

Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data violates the GDPR or Act No. 110/2019 Coll., you have the right to lodge a complaint with the Office for Personal Data Protection:

Please submit any request to exercise your rights by e-mail at office@atavus.cz. We will respond to your request without undue delay, and no later than one month after receiving it.

9. Automated decision-making and profiling

The controller does not carry out automated decision-making or profiling within the meaning of Article 22 GDPR. All decisions concerning investors are made by human staff.

10. Cookies and local storage

Information on cookies and how consent is managed can be found in a separate document: Cookie Policy.

11. Changes to this Privacy Policy

This policy may be updated from time to time in line with changes in legislation or in the way personal data is processed. The date of the last update is always shown at the top of the document. In the event of a material change, we will inform you via the website or by e-mail.

12. Controller contact details

For questions about the processing of personal data or to exercise your rights, please contact: