COOKIE POLICY

Document prepared in accordance with GDPR (EU) 2016/679, Act No. 480/2004 Coll. and Act No. 127/2005 Coll.

Art. 1 – Identity and Contact Details of the Controller

PBS GROUP, a.s. operates the website pbs.cz and, in doing so, uses cookies and similar tracking technologies. This document governs the use of cookies on pbs.cz and describes the technologies we employ, the purposes for which they are used, the legal bases on which processing is carried out, and your rights under Regulation (EU) 2016/679 (GDPR), Act No. 480/2004 Coll., and Act No. 127/2005 Coll.

The Controller has appointed a Data Protection Officer (DPO); for any inquiries related to the personal data processing contact us at gdpr@pbs.cz.

Art. 2 – What Are Cookies and Similar Technologies?

Cookies are small text files that a website stores in your browser or device when you visit it. They serve various purposes – from ensuring basic website functionality to measuring traffic and displaying personalised advertisements.

In addition to conventional cookies, we also use:

• Pixel tags (web beacons) – invisible 1×1 px images embedded in pages or e-mails that track their opening and interaction.
• Session recording – technology that records mouse movements, clicks, and interactions with forms for the purpose of analysing user behaviour (Microsoft Clarity). Form fields containing personal data are automatically masked.
• Local Storage / Session Storage – storing data in the browser either persistently or for the duration of the session.
• Cross-channel tracking – linking website behaviour with e-mail interactions (Brevo).

Depending on the selected cookie categories and the specific technology used, we may process in particular: online identifiers (e.g. cookie IDs), IP addresses (to the extent transmitted to the service provider), device and browser data (device type, operating system, language, screen resolution), website usage data (pages visited, time spent on page, clicks, form submissions, traffic source), and technical data necessary for session management and website security. In the case of session recording, form fields containing personal data are masked.

Art. 3 – Cookie Categories

3.1 Strictly Necessary Cookies

These cookies are essential for the proper functioning of the website. Without them, the website could not operate. Their storage does not require your consent, as it is necessary for ensuring the basic functionality and security of the website (session management, protection against CSRF attacks, storage of your cookie preferences).

Legal basis: legitimate interests pursuant to Art. 6(1)(f) GDPR.

3.2 Analytics Cookies

These cookies collect information about the manner in which visitors use the website – which pages they visit, how long they spend on them, and what errors occur. They help us improve the website. This category also includes session recording (Microsoft Clarity), which records mouse movements and interactions with content.

Tools used: Google Analytics 4, Microsoft Clarity (heatmaps, interaction analysis).

Analytics cookies are activated only with your consent pursuant to Art. 6(1)(a) GDPR.

3.3 Marketing Cookies

These cookies serve to track visitors across websites for the purpose of displaying relevant and personalised advertisements. They are set through our website by third parties (Google, Meta, Seznam) and are combined with other information those parties hold about you.

Tools used: Google Ads, Seznam Sklik, Meta Pixel (Facebook), LinkedIn Insight Tag, Brevo.

Marketing cookies are activated only with your express consent pursuant to Art. 6(1)(a) GDPR.

Art. 4 – Overview of All Cookies and Tracking Technologies

The following table provides an overview of the cookies and tracking technologies used on pbs.cz. The table is updated on an ongoing basis. Abbreviations: DPF = EUUS Data Privacy Framework; SCCs = Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Role of recipients / providers: Depending on the particular service, the listed providers may act as (i) our processors (processing for our purposes and pursuant to our instructions), (ii) independent controllers (processing for the providers own purposes, typically in the area of online advertising and measurement), or (iii) joint controllers (see Art. 8 Meta Platforms). Details regarding the role of individual providers and their own processing purposes are set out in their respective privacy policies.

Google Tag Manager is a technical tool for managing scripts and does not itself store cookies or process personal data.

Art. 5 – Legal Bases for Processing

The processing of personal data through cookies and tracking technologies is carried out on the following legal bases:

Legal basis under Act No. 127/2005 Coll.: The storing of cookies on the user’s terminal equipment is governed by Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications. That provision requires prior informed consent for all cookies that are not strictly necessary for the provision of an explicitly requested electronic communications service. Act No. 480/2004 Coll. on Certain Information Society Services supplements the rules governing the sending of commercial electronic communications.

Art. 6 – Profiling

The website pbs.cz engages in profiling within the meaning of Art. 4(4) GDPR, i.e. the automated processing of personal data for the purpose of evaluating or predicting the preferences, interests, or behaviour of a natural person. Profiling occurs in the following contexts:

• Google Analytics 4: Building user cohorts and analysing the customer journey based on website behaviour.
• Google Ads: Assigning users to advertising audiences (remarketing audiences) based on pages visited and actions taken.
• Meta Pixel: Building Custom Audiences and Lookalike Audiences; profiling also takes place across other websites and applications within the Meta network.
• Microsoft Clarity: Behavioural analysis through session recording and heatmaps (recording of mouse movements, clicks, and scrolling).
• LinkedIn Insight Tag: Building advertising audiences and tracking conversions from LinkedIn campaigns; profiling also takes place across websites on which the Insight Tag is implemented.
• Brevo: Cross-channel profiling combining website behaviour with responses to e-mail communications.

Profiling takes place exclusively on the basis of your consent. You have the right to withdraw your consent at any time and to object to profiling pursuant to Arts. 21 and 22 GDPR. Profiling does not take place for the purpose of making automated decisions with legal or similarly significant effects.

Art. 7 – Transfers of Personal Data to Third Countries

When analytics and marketing cookies are used, personal data is transferred to the USA and other countries outside the European Economic Area. Overview of recipients and legal transfer mechanisms:

The EU–US Data Privacy Framework (DPF) was adopted by the European Commission on 10 July 2023 as providing an adequate level of protection for personal data transferred to the USA to organisations certified under that framework. PBS GROUP, a.s. regularly verifies the validity of its providers’ certifications at www.dataprivacyframework.gov.

Art. 8 – Joint Controllership (Meta Platforms)

In connection with the use of the Meta Pixel tool on pbs.cz, PBS GROUP, a.s. and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are joint controllers within the meaning of Art. 26 GDPR.

This follows from the judgment of the Court of Justice of the European Union in Case C-210/16 (Wirtschaftsakademie Schleswig-Holstein) and the subsequent decision-making practice of the EDPB. Joint controllership covers the processing of personal data for the purposes of targeted advertising, traffic analysis, and the building of advertising audiences.

Allocation of responsibilities:

• PBS GROUP, a.s. is responsible for: implementing Meta Pixel on the website, obtaining user consent, and providing information in the Cookie Policy and in the Privacy Policy.
• Meta Platforms Ireland Ltd. is responsible for: processing the received data for Meta’s own advertising purposes, and ensuring the rights of data subjects vis-à-vis Meta.

Data subjects’ rights may be exercised against PBS GROUP, a.s. (gdpr@pbs.cz) or against Meta Platforms Ireland Ltd. via the portal: www.facebook.com/help/contact/540977946302970. The terms of joint controllership are governed by the Data Processing Addendum concluded within the Meta Business Center.

Art. 9 – Retention Periods for Personal Data

The precise retention period for each individual technology is set out in the table in Art. 4. As a general rule:

• Strictly necessary cookies: for the duration of the session or a maximum of 12 months.
• Analytics cookies (GA4): 13 months from the date of last access.
• Session recording (Microsoft Clarity): session recordings for a period of 13 months.
• Marketing cookies: 3 months to 2 years, depending on the specific provider (see the table in Art. 4).
• Records of granted consents: 3 years (for the purpose of demonstrating consent pursuant to Art. 7(1) GDPR).

Upon expiry of the retention period, data is automatically anonymised or deleted. The storage, transmission, and deletion of data held by third parties (Google, Meta, Microsoft, Seznam, LinkedIn, Brevo) are governed by their respective privacy policies.

Art. 10 – How to Grant and Withdraw Consent?

10.1 Granting Consent

Upon your first visit to pbs.cz, a cookie banner will appear offering three options:

• Accept all – consent to all cookie categories.
• Reject all – refusal of all non-essential cookies with a single click.
• Manage preferences – opens detailed settings with three categories (Strictly Necessary / Analytics / Marketing).

Consent is always voluntary. Declining non-essential cookies has no effect on the availability of the website or its basic functions. The cookie banner contains no dark patterns – the buttons are visually equivalent and no toggles are pre-activated.

10.2 Withdrawing Consent

Consent may be withdrawn at any time as easily as it was granted:

• By clicking on the Cookie Settings button in the footer of the website.
• By sending an e-mail to gdpr@pbs.cz.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal (Art. 7(3) GDPR). Following withdrawal of consent, the relevant cookies will be deleted and tracking scripts will be deactivated.

10.3 Browser Settings

Cookies may also be managed through your web browser settings. Disabling cookies in your browser may affect the functionality of the website. Information on managing cookies can be found in the help section of the relevant browser.

Art. 11 – Your Rights as a Data Subject

In connection with the processing of personal data through cookies, you may in particular exercise:

• the right of access to personal data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability (where applicable);
• the right to object to processing (in particular where processing is based on legitimate interests); and
• the right to withdraw consent at any time (see Art. 10).

You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (ÚOOU), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

Requests for the exercise of rights should be submitted to gdpr@pbs.cz. We will respond without undue delay and at the latest within one month.

Art. 12 – Updates to the Cookie Policy

This page may be updated periodically in response to changes in the technical implementation of the website, amendments to applicable legislation, or developments in the decision-making practice of supervisory authorities. Users will be notified of material changes via the cookie banner or by e-mail.

This document governs the use of cookies on the website www.pbs.cz and is issued by the Controller: PBS GROUP, a.s., Krakovská 583/9, 110 00 Prague 1, Company ID No.: 61057801, info@pbs.cz.

Date of last update: 1 April 2026