Privacy Policy

Information on Kostera's Processing of Personal Data.

Last updated: 12 August 2026

Information on the processing of personal data

Jaroslav Kostera, J.K.FOOD s.r.o. respects the privacy of its customers, business partners, cooperation prospects, website visitors and other persons whose personal data it processes.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Act No. 110/2019 Coll. on the processing of personal data, and other applicable laws.

1. Data controller

The controller of personal data is:

Jaroslav Kostera, J.K.FOOD s.r.o. Company ID (IČO): 27780384 Registered office: Větřkovice 243, 747 43 Větřkovice

E-mail: kostera@kostera.cz Phone: +420 556 310 205

For matters relating to personal data protection and for exercising your rights, you may contact us primarily via the e-mail address above.

Contact details of a Data Protection Officer (DPO) are provided only if a DPO has been formally appointed under Article 37 GDPR. The company currently has not appointed a Data Protection Officer.

2. What personal data we process

Depending on how you communicate with us and your relationship with the company, we may process in particular:

  • identification data, such as name, surname, company name or job title;
  • contact data, in particular e-mail address, telephone number and address;
  • data stated in an enquiry, order, contract or other mutual communication;
  • data needed to manage a business and contractual relationship;
  • data required to fulfil accounting, tax and other legal obligations;
  • technical data arising from use of the website, where processed via the website;
  • data provided by a job applicant in a recruitment process.

Please do not send special categories of personal data via ordinary contact forms unless it is necessary.

3. Purposes and legal bases of processing

Enquiries, questions and communication

We process personal data to receive and handle your enquiry or request, prepare an offer and related communication.

The legal basis is in particular taking steps prior to entering into a contract at the request of the data subject under Article 6(1)(b) GDPR, or the controller’s legitimate interest under Article 6(1)(f) GDPR in proper communication with customers and business partners.

Orders and contractual relationships

We process customer and partner data to conclude and perform contracts, record orders, deliver goods or services and related communication.

The legal basis is in particular Article 6(1)(b) GDPR.

Accounting, tax and other legal obligations

Some data must be retained and processed under accounting, tax and other legal rules.

The legal basis is Article 6(1)(c) GDPR – compliance with a legal obligation.

Protection of legal claims

We may retain data to the extent necessary to protect our rights, handle complaints, disputes or establish, exercise or defend legal claims.

The legal basis is the controller’s legitimate interest under Article 6(1)(f) GDPR.

Recruitment

If you send a CV or other data in connection with a specific job offer, we use it to assess your application and run the recruitment process.

If we were to retain data for future job offers, we would require an appropriate legal basis, typically a separate consent.

Marketing communication

We send electronic commercial communications only under the conditions set by applicable law.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Contact forms

If you submit a contact form on the website, we process the data you provide, in particular name, e-mail, phone number and message content.

We use the data only as needed to handle your enquiry, request or other requested communication, or for further negotiations on a contractual relationship.

We will not automatically use contact-form data to send marketing communications merely because you contacted us via the form.

5. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected.

Data from ordinary enquiries that do not lead to a contract are kept for the time needed to handle them and a reasonable period thereafter, in particular to evidence the communication.

Data related to contracts are kept for the duration of the contractual relationship and afterwards for the time needed to protect legal claims.

Accounting, tax and similar documents are kept for periods required by law.

Recruitment data are kept for the time needed to run the process; for future recruitment only if we have an appropriate legal basis.

Data processed on the basis of consent are processed at most until consent is withdrawn, unless another legal ground applies.

6. Recipients of personal data

Personal data may be disclosed to the extent necessary in particular to:

  • providers of hosting and IT services, website operators, e-mail and communication providers, accounting and tax advisers, legal advisers and other suppliers who support the company’s operations.

Personal data may also be provided to public authorities where required by law or necessary to protect our rights.

Suppliers who process personal data on our behalf must ensure appropriate protection.

7. Transfers outside the European Economic Area

If personal data are transferred outside the EEA in connection with the website, analytics, communication or other technology services, this is done only under the conditions of Chapter V GDPR.

Information on specific services used on the website and any transfers to third countries must reflect the actual technical setup and is described in more detail in cookie information and consent settings.

8. Cookies and similar technologies

The website may use technical cookies necessary for proper and secure operation.

Analytical, marketing and other non-essential cookies are used only in accordance with the law and, where consent is required, only after consent is given.

Users must be able to refuse consent and later easily change or withdraw it via Cookie settings.

Detailed information on cookies used, their purpose, providers and validity must be available in cookie settings or separate cookie information.

9. Obligation to provide personal data

Providing data via an ordinary contact form is voluntary. Without data needed to contact you or handle your request, we may be unable to respond.

In a contractual relationship, providing some data may be necessary to conclude or perform the contract.

In other cases, the obligation to process certain data may follow directly from law.

10. Automated decision-making

The controller does not make decisions based solely on automated processing of personal data, including profiling, that would produce legal effects concerning the data subject or similarly significantly affect them, unless expressly stated otherwise for a specific service.

11. Your rights

Under the conditions set by the GDPR you have in particular the right to:

  • request access to your personal data;
  • request rectification of inaccurate or incomplete data;
  • request erasure of personal data where legal conditions are met;
  • request restriction of processing;
  • object to processing based on legitimate interest;
  • receive your personal data and request portability where provided by the GDPR;
  • withdraw consent at any time where processing is based on consent;
  • lodge a complaint with a supervisory authority.

You may send requests concerning your rights to kostera@kostera.cz.

We respond without undue delay and within the time limits set by the GDPR.

12. Right to lodge a complaint

If you believe that processing of your personal data infringes the law, you may lodge a complaint with:

The Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27 170 00 Prague 7 Czech Republic

This is without prejudice to your right to go to court.

13. Security of personal data

We take appropriate technical and organisational measures corresponding to the nature and scope of the data processed in order to protect personal data against unauthorised access, loss, misuse, alteration or unauthorised disclosure.

14. Changes to this information

We may update this information in particular when the way we process personal data, the services we use or the law changes.