Orrery Import/Export Agency s.r.o.

Last updated: 15 September 2026

1. Who we are

This Privacy Policy explains how Orrery Import/Export Agency s.r.o. (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit our website or interact with us in connection with our management consulting services.

Data controller:
Orrery Import/Export Agency s.r.o.
Registered at Municipal Court of Prague under file number C 268365
Registered office: Všetatská 20/13, Miškovice, 196 00 Praha 9, Czech Republic
Company ID (IČO): 05651581

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable Czech data protection legislation.

2. What personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

Website visitors

  • Technical data (IP address, browser type, device information, operating system)
  • Usage data (pages visited, time spent, referring URL)
  • Cookie and similar technology data (see our separate Cookie Policy)
  • Data submitted via contact forms (name, email address, phone number, company name, message content)

Clients and prospective clients

  • Identification and contact details (name, job title, company, email, phone, postal address)
  • Contractual and billing information
  • Communication history and notes related to our consulting services
  • Any other information you voluntarily provide during the engagement

Other

  • Data related to newsletter subscriptions or event registrations (if applicable)
  • Data necessary for compliance with legal obligations

We do not intentionally collect special categories of personal data (sensitive data) unless you voluntarily provide them and we have a valid legal basis to process them.

3. How we collect personal data

We collect personal data:

  • Directly from you (contact forms, emails, phone calls, contracts, meetings)
  • Automatically when you visit our website (via cookies and similar technologies)
  • From publicly available sources or third parties only where lawful and necessary for our services

4. Purposes and legal bases for processing

We process your personal data for the following purposes and on the following legal bases (Article 6 GDPR):

PurposeLegal basis
Responding to enquiries and providing information about our servicesLegitimate interest (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b))
Performing and managing consulting contractsPerformance of a contract (Art. 6(1)(b))
Operating, securing and improving our websiteLegitimate interest (Art. 6(1)(f))
Analytics and website performance measurementConsent (Art. 6(1)(a)) where required, otherwise legitimate interest
Marketing communications (e.g. newsletter)Consent (Art. 6(1)(a)) or legitimate interest where applicable
Compliance with legal obligations (accounting, tax, etc.)Legal obligation (Art. 6(1)(c))
Establishing, exercising or defending legal claimsLegitimate interest (Art. 6(1)(f))

Where we rely on legitimate interest, we have balanced our interests against your rights and freedoms.

5. Who we share your data with

We may share personal data with:

  • Service providers acting as processors on our behalf (e.g. website hosting, IT support, email providers, analytics providers), under appropriate data processing agreements
  • Professional advisers (lawyers, accountants) where necessary
  • Public authorities when required by law
  • Other third parties only with your consent or where we have another valid legal basis

We do not sell your personal data.

6. International data transfers

Your personal data is primarily processed within the European Economic Area (EEA).
If any transfer outside the EEA occurs (for example through certain service providers), we ensure appropriate safeguards are in place, such as:

  • Adequacy decisions of the European Commission, or
  • Standard Contractual Clauses (SCCs) approved by the European Commission, together with any necessary additional measures.

7. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

  • Website enquiry data: typically up to 2–3 years after the last contact, unless a longer period is needed
  • Client contractual and billing data: for the duration of the contract plus the statutory retention periods under Czech accounting and tax law (generally 5–10 years)
  • Cookie and consent data: according to the periods stated in our Cookie Policy
  • Marketing consent data: until you withdraw consent or the consent becomes obsolete

After the retention period expires, data is securely deleted or anonymised.

8. Your rights under GDPR

You have the following rights regarding your personal data:

  • Right of access – to obtain confirmation whether we process your data and to receive a copy
  • Right to rectification – to correct inaccurate or incomplete data
  • Right to erasure (“right to be forgotten”) – in certain circumstances
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent at any time (where processing is based on consent), without affecting the lawfulness of processing before withdrawal
  • Right to lodge a complaint with a supervisory authority

To exercise your rights, please contact us using the details below. We will respond within one month (extendable in complex cases).

Supervisory authority in the Czech Republic:
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7
Website: https://www.uoou.cz

9. Cookies and similar technologies

Our website uses cookies and similar technologies. For detailed information about the cookies we use, their purposes, and how you can manage your preferences, please see our separate Cookie Policy.

10. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction. These measures are regularly reviewed and updated according to the level of risk.

11. Children’s data

Our website and services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us so we can delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be published on this page with an updated “Last updated” date. Significant changes will be communicated by appropriate means (e.g. website notice or email where relevant).

13. Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Orrery Import/Export Agency s.r.o.
Všetatská 20/13, Miškovice, 196 00 Praha 9
Czech Republic
Email: orrery@orrery.cz
Company ID (IČO): 05651581