Privacy Policy (GDPR)

1. The controller and contact details

The controller is ADAGET s.r.o., Company No. 21471606, VAT No. CZ21471606, registered office Svatopluka Čecha 2672/100, Královo Pole, 612 00 Brno, Czech Republic, registered with the Regional Court in Brno under file no. C 139070, managing director Adam Dostál, data box fdd98tu.

Data protection contact: podpora@gutiva.cz · +420 773 469 469. The controller's contact person for data protection is managing director Adam Dostál (podpora@gutiva.cz). Given the scope and nature of the processing, the controller has not appointed a separate data protection officer (Art. 37 GDPR); the obligations under the GDPR are discharged by the contact person named above.

Gutiva is a wellness service (not a medical device). Even so, we treat data that may reveal something about health as special category data under Art. 9 GDPR.

2. What data, why and on what legal basis

Performance of the contract (order, loan and return of the device, reports): identification and contact details, order details — Art. 6(1)(b) GDPR.
Payments, accounting, tax: billing and transaction data — Art. 6(1)(b) and (c) GDPR in conjunction with Act No. 235/2004 Coll. (VAT) and Act No. 563/1991 Coll. (accounting).
Delivery and reverse logistics: name, address, phone — Art. 6(1)(b).
Reports based on digestion data collected during the audit: data that may reveal something about health (special category, Art. 9) — explicit consent under Art. 9(2)(a) (see art. 3).
Communication, enquiries, complaints: contact details and content — Art. 6(1)(b) and (f).
Commercial communications / newsletter: e-mail, name — consent, or legitimate interest under Act No. 480/2004 Coll.
Protection of legal claims: relevant data — legitimate interest, Art. 6(1)(f).

Providing data for the performance of the contract is a contractual requirement; without it the service cannot be provided.

3. Digestion data = special category data (Art. 9 GDPR) and its further use

The audit data from which the reports are built may constitute health data — special category data under Art. 9 GDPR. We process it solely on the basis of EXPLICIT CONSENT under Art. 9(2)(a) GDPR, given separately and independently before processing begins.

Consent for this special category data is SEPARATE from and independent of consent to the terms and conditions. It is voluntary; without it the reports cannot be produced. It can be withdrawn at any time (without affecting the lawfulness of earlier processing); we then end the processing and erase the data in identifiable form.

This data is made available only to the necessary circle of people (in particular the controller's own specialists who evaluate the data) and is protected by enhanced measures (access management, confidentiality, encryption — see art. 7).

Anonymisation and model training (for information, Art. 22 GDPR)

Once the device has been returned and the report delivered, we anonymise the digestion data — we remove every identifier that would allow it to be linked to a specific person. Anonymised data (which is no longer personal data within the meaning of the GDPR) is retained and used for research, statistical purposes and model training (including machine learning models and neural networks). These models serve to improve the quality of the report for future users.

Training takes place solely on fully anonymised data with no link to any individual customer. We do not carry out automated decision-making with legal or similarly significant effects on the data subject (Art. 22 GDPR); preparing the report involves human assessment by the controller's specialist.

4. Recipients and processors, transfers outside the EU

The data is evaluated exclusively by the controller using its own resources (employees and internal collaborators of ADAGET s.r.o.); we do not pass the data to any external “expert” or third party for evaluation. Accounting and tax administration are likewise handled internally by the controller.

The data may be made available to the following processors on the basis of agreements under Art. 28 GDPR — strictly to the extent necessary for the given purpose:

Website and application hosting: WEDOS Internet, a.s., Company No. 28115708, Hluboká nad Vltavou, Czech Republic (EU).
Payment gateway: Comgate a.s., Company No. 27924505, Hradec Králové, Czech Republic (EU). Payment details (card numbers) are processed directly by Comgate — the controller has no access to them.
Device carrier: Packeta Česká republika s.r.o. (Zásilkovna), or General Logistics Systems Czech Republic s.r.o. (GLS) — at the customer's choice. All in the Czech Republic (EU).
Tool for transactional and commercial e-mail: Resend, Inc., USA — the transfer is covered by standard contractual clauses under Art. 46 GDPR and by a data processing agreement (DPA).
Public authorities in cases required by law.

Transfers outside the EU/EEA: the only processor outside the EU is Resend, Inc. (USA), for e-mail communication. The European Commission's standard contractual clauses (SCCs) and a data processing agreement are in place for this transfer. We do NOT send special category data (reports, digestion data) through Resend — the customer accesses the report through a secured interface.

5. Retention periods

We keep data only for as long as necessary for the purpose of the processing:

Invoices and tax documents: 10 years under Section 35 of Act No. 235/2004 Coll. (VAT) and Section 31 of Act No. 563/1991 Coll. (accounting).
Contract data (order, complaint records, contract-related communication): 3 years from the end of the contractual relationship (the general limitation period under Section 629 of the Civil Code).
Marketing data (newsletter, contact form outside an order): until consent is withdrawn, but no longer than 14 days after the last contact if no contract is concluded.
Special category digestion data in identifiable form: for the duration of the audit and until the report is completed; the data is then anonymised once the device has been returned and the report delivered.
Anonymised data (no longer personal data): retained long term for research, statistics and model training — with no way of linking it back to a specific person.
Data for the defence of legal claims (legitimate interest): for the duration of the claim, no longer than 4 years.

Once the relevant period expires, we erase the data or irreversibly anonymise it.

6. Your rights

Access to your data (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21).
Withdrawal of consent at any time (including consent for special category data under art. 3), without affecting the lawfulness of earlier processing. Withdrawals can be sent to podpora@gutiva.cz.
The right not to be subject to a decision based solely on automated processing (Art. 22). Training models on anonymised data does not interfere with this right, because anonymised data is not personal data and does not relate to you personally.
The right to lodge a complaint with a supervisory authority.

You can exercise your rights at podpora@gutiva.cz; we will respond without undue delay, within 1 month at the latest (extendable by 2 months).

Supervisory authority: Úřad pro ochranu osobních údajů (the Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, e-mail posta@uoou.gov.cz, uoou.gov.cz — you have the right to lodge a complaint.

7. Security and cookies

We have adopted appropriate technical and organisational measures reflecting the sensitive nature of the data: TLS encryption of all communication between the device, the app and the server (data leaving the end device for the cloud is always encrypted); access management and separated roles; confidentiality obligations for the controller's employees and collaborators; regular backups; and the recording and handling of security incidents. In the event of a security breach we proceed under Art. 33 and 34 GDPR — we notify the supervisory authority without undue delay (within 72 hours) and, where relevant, the data subjects concerned.

The website uses cookies — details are in a separate Cookie Policy.

GDPR in brief

Who: ADAGET s.r.o., contact podpora@gutiva.cz.
What: name, contact details, address, order, payment and — for the report — digestion data (special category data).
Why: to loan the device, produce the reports, take payment, deliver and communicate.
Special category data only with your separate explicit consent — withdrawable at any time.
To whom: evaluation is done exclusively by ADAGET. External processors are used only for hosting, payments, delivery and e-mail — we do not sell data.
How long: depending on the purpose — invoices 10 years, contract data 3 years, marketing 14 days; special category data is anonymised once the report is complete.
Anonymised data goes on to train our models (with no link to you).
Rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint to the Czech Office for Personal Data Protection (uoou.gov.cz).
Wellness, not medicine: the reports are an informative wellness output.