PERSONAL DATA PROTECTION POLICY

I. General Provisions

1. The controller pursuant to Article 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) is Maveka Event s.r.o., Company ID No.: 22381015, registered office at U Dubu 547, Štípa, 763 14 Zlín, Czech Republic (hereinafter the “Controller”).

2. Contact details of the Controller:
   address: U Dubu 547, Štípa, 763 14 Zlín
   email: shop@geo.guru
   phone: +420 725 125 140

3. Personal data means any information relating to an identified or identifiable natural person pursuant to Article 4(1) GDPR.

4. The Controller has not appointed a Data Protection Officer pursuant to Article 37 GDPR, as it is not legally required to do so.

---

II. Sources and Categories of Personal Data

1. The Controller processes personal data that you have provided or personal data obtained in connection with the performance of your order.

2. The Controller processes identification and contact data and data necessary for the performance of a contract.

---

III. Legal Basis and Purpose of Processing

1. The legal basis for processing is:

• performance of a contract pursuant to Article 6(1)(b) GDPR;

• legitimate interest of the Controller in direct marketing pursuant to Article 6(1)(f) GDPR in conjunction with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services;

• your consent pursuant to Article 6(1)(a) GDPR.

2. The purpose of processing is:

• processing of your order and performance of contractual rights and obligations;

• sending commercial communications and marketing activities.

3. The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

---

IV. Data Retention Period

1. The Controller retains personal data:

• for the period necessary to perform contractual rights and obligations and to assert claims arising therefrom, for a maximum of 15 years after termination of the contractual relationship;

• for the duration of consent for marketing purposes.

2. After the retention period expires, personal data shall be deleted.

---

V. Recipients of Personal Data

1. Recipients include:

• persons involved in delivery of goods and payment processing;

• e-shop service provider (Shoptet);

• marketing service providers (Google, Meta).

2. Personal data may be transferred to third countries in connection with the use of Google and Meta services, in accordance with Articles 45 et seq. GDPR, based on adequacy decisions or Standard Contractual Clauses.

---

VI. Your Rights

Under GDPR you have the right to:

• access personal data (Art. 15);

• rectification (Art. 16);

• erasure (Art. 17);

• restriction of processing (Art. 18);

• data portability (Art. 20);

• object to processing (Art. 21);

• withdraw consent at any time.

You also have the right to lodge a complaint with the Czech Data Protection Authority.

---

VII. Data Security

The Controller has implemented appropriate technical and organisational measures to secure personal data.

---

VIII. Final Provisions

These Terms enter into force on 14 February 2026.