The operator of website at https://www.topos.eu/ and the controller of personal data processed through this website is the company TOPOS a.s., ID No. 613 25 155, Tax ID No. CZ61325155, with registered office at Královská 777, 407 77 Šluknov, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Ústí nad Labem, Section B, Insert 581 (hereinafter referred to as the “Company”, “Controller”, “we” and/or “us”).
The contact details of the Controller are as follows:
Address: TOPOS a.s., Královská 777, 407 77 Šluknov, Česká republika
Email: topos@topos.eu
Phone: +420 412 354 444
The protection of personal data is regulated by the act no. 110/2019 Coll., on personal data processing, as amended (the “Act”) and the Regulation (EU) 2016/679 of the European parliament and of the Council, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “Regulation” or “GDPR”). When controlling and processing personal data (“personal data”) we apply the GDPR, the Act and other related legislation.
Particular or more detailed information on the processing of personal data for specific purposes may be contained in documents intended for those purposes, in which case the information contained in those documents shall prevail and this general information shall only supplement it.
We collect data directly from you through our forms, and automatically through cookies and similar technologies where you have consented. Providing data in our forms is voluntary, but we cannot respond to your request without the required fields.
We do not use your data for automated decision-making or profiling that produces legal effects for you.
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
Answering enquiries sent through the Contact form | Name, company, email, phone (optional), message, product of interest | Steps taken at your request before a contract (Article 6(1)(b) of GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) of GDPR) | 3 years from last contact, or longer if a contract follows. |
| Handling spare parts requests sent through the Parts form | Name, email, phone (optional), equipment name, model, job number, part number, urgency | Performance of a contract or pre-contractual steps (Article 6(1)(b) of the GDPR) | For the duration of the customer relationship and statutory retention periods. |
| Recruitment and selection (selecting employees, negotiating an employment or other contract) | Your name and surname, contact details such as address, phone number and e-mail address, education and/or other information provided in your CV | Performance of a contract or pre-contractual steps (Article 6(1)(b) of the GDPR) | For the duration of the selection process for the position, but no longer than 6 months after we receive your CV, unless you consent to us archiving your CV for a longer period. |
| Concluding business contracts, fulfilling orders | Identification and contact details in contracts | Article 6(1)(b) of the GDPR | For the duration of the contract and statutory retention periods. |
| Direct marketing | Contact details (telephone number, e-mail address) | Our legitimate interest to keep business relationships with our customers (Article 6(1)(f) of the GDPR) | Until objection is raised, no longer than 2 years from last contact. |
| Cookies for different purposes (see our Cookies policy/Cookies declaration) | See our Cookies policy/Cookies declaration | See our Cookies policy/Cookies declaration | See our Cookies policy/Cookies declaration. |
| Website security and operation | IP address, server logs | Our legitimate interest in running a secure website (Article 6(1)(f) of the GDPR) | Up to 90 days. |
| Meeting legal obligations and defending legal claims | Data relevant to the matter | Legal obligation (Article 6(1)(c) of the GDPR) and legitimate interest (Art. 6(1)(f) of the GDPR) | As required by law or until the claim is resolved. |
We usually do not process special categories of personal data and personal data relating to criminal convictions and offenses. In certain cases of processing of personal data, a data subject’s consent, fulfillment of legal obligations or legitimate interest could be applied as legal ground for data processing as well, i.e., according to Article 6(1)(a), (c) and (f) of the GDPR.
We do not use your data for automated decision-making or profiling that produces legal effects for you.
Your personal data is processed in scope described above as necessary for the mentioned purposes.
We obtain personal data directly from the data subjects through our forms or other means, or from other persons, including our (current or former) customers, potential customers, business partners, cooperating entities and individuals, employees as well as their representatives or other persons acting on their behalf. We also obtain personal data from publicly accessible sources or public authorities when providing services to our customers.
Providing data in our forms is voluntary, but we cannot respond to your request without the required fields.
We collect data also automatically through cookies and similar technologies where you have consented.
Consent to the processing of personal data is granted voluntarily and may be withdrawn at any time free of charge in person at the Controller‘s address, in written by letter sent to the Controller‘s address or by a message to the e-mail address mentioned above in contact details.
From the day when the withdrawal of consent is notified to the Controller, personal data may be processed only to the extent corresponding to the legal reason for processing, i.e. in particular for the performance of legal obligations or for the purposes of protecting the rights and legal claims of the Controller.
The period for which the Controller may process personal data is determined on the basis of the purpose of processing personal data. The length of this period is always specified in the wording of the consent, if it is required. In the case of the period specified in the consent, if required, the period for processing specified in the consent applies. When the processing is based on a data subject’s consent, the data will be processed for as long as there is valid consent for the processing.
Other personal data are processed for the necessary time and to the extent necessary to achieve the relevant purpose. The Controller processes the personal data for the above purposes in accordance with the Regulation and the Act.
We share personal data only as needed for the purposes above. The data is accessible to the management, employees and contractual partners of the Controller, which need them for fulfilling legal obligations, for providing the services and/or for performing the business activities. Where relevant the data are shared within our group, namely with the company from Topos Group in the USA (TOPOS MONDIAL CORP., reg. no. 23-1618497, with registered office at 600 Queen Street, 19464 Pottstown, Pennsylvania, USA).
The term contractual partners means providers that, based on commercial arrangements with the Company, participate in the provision of services to the customers. The term also means providers of services in favour of the Company or any of its branches in order to fulfil contractual and legal obligations (such as tax advisors, accountants, IT service providers, servicing organizations and all other entities from the Company’s group). It includes for example website hosting (WP Engine), form processing (Gravity Forms), cookie consent management (CookieHub) ), and email or CRM provider.
Based on the applicable legislation or requests of public authorities, the data may also be accessible to public authorities. lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the authority in your EU country of residence.
Personal data may be transferred within the EU. Some providers may process data in the USA. In case of transfers to third countries (outside the EU), the transfer of personal data shall be subject to appropriate safeguards (e.g., the EU-US Data Privacy Framework for certified recipients, or the European Commission’s Standard Contractual Clauses).
To collect and store analytics data and other information, when the data subjects visit the Company’s website, the Company is using various technologies, including cookies.
We use necessary cookies to run the website for which consent is not required. All other cookies, including analytics and advertising cookies, are set only after you give consent in our cookie banner.
You can change or withdraw your consent at any time through the Cookie settings link in the website footer. A full list of cookies is available in our Cookies Policy and in the Cookie banner / Cookie declaration.
The Company is using Google Analytics and other web analytics services to compile analytics data and reports on visitor usage of the Company’ s website and to improve the Company’s services. The overview of Google Analytics is available on the website of Google Analytics and it is possible to opt-out through the browser.
You can find more information about use and processing of cookies on our website in Cookies Policy.
The data subjects may exercise the following rights provided by the GDPR by contacting the Company via e-mail at mentioned above in contact details:
If we, upon the request of a data subject, erase his/her personal data from our database, we will keep only the information that may be necessary for protecting our legitimate interests as defined above or for public authorities.
If we are required to transfer data to another controller, rectify data or provide access to personal data, we may first require further information in order to verify the identity of the data subject.
If a data subject is of the opinion that his/her rights related to the protection of his/her personal data were breached, he/she may submit a complaint to the supervisory authority in the Czech Republic, which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Phone number: +420 234 665 111 (switchboard); E-mail: posta@uoou.gov.cz; Data mail box ID: qkbaa2n, website: https://uoou.gov.cz/.
In case of questions or requests regarding the processing of personal data and the exercise of their rights, the data subject may contact the Company in writing at the e-mail address or at its registered seat or by phone at the phone number as mentioned above in contact details of the Controller.
We keep the data and information provided confidential, in particular in accordance with the relevant laws and contractual arrangements. We do not trade the personal data.
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls, and agreements with our service providers.
We may update this Privacy Policy from time to time. The version published on this page, with its last updated date, applies.
Last updated: 8 October 2026
