PERSONAL DATA PROTECTION AND PROCESSING POLICY (GDPR)

1. Data Controller

The Controller of your personal data is: Adventure Menu s.r.o., registered office: Koubkova 399/10, 120 00 Prague 2, Czech Republic, ID No.: 01632523, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 208491 (the “Controller” or “We”).

We operate the PRO-RATION e-shop on the website www.pro-ration.com.

If you have any questions regarding the processing of your data, you can contact us via e-mail: hello@adventuremenu.com or in writing at the address of our establishment: Sokolská 545, 541 01 Trutnov, Czech Republic.

2. Why and what data do we process?

We process your personal data only for lawful purposes, to the following extent:

A) Order processing and contract performance

• What we process: Name and surname, delivery and billing address, e-mail, telephone number, data on ordered goods, and payment details.
• Legal basis: Performance of the purchase contract pursuant to Art. 6(1)(b) GDPR and fulfillment of legal obligations (accounting and taxes) pursuant to Art. 6(1)(c) GDPR.
• Retention period: For the duration of legal obligations, typically 10 years from the end of the tax period for tax documents.

B) User Account (Registration)

• What we process: Identification data, order history, and login details (password is encrypted).
• Legal basis: Your consent to the creation of the account and performance of the agreement on the provision of the user account service (Art. 6(1)(a) and (b) GDPR).
• Retention period: Until you cancel your account.

C) Marketing Communication (Newsletters)

• What we process: Your e-mail address and name.
• Legal basis:
  • If you are our customer: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in informing you about news and similar goods.
  • If you are not a customer: Your explicit consent (Art. 6(1)(a) GDPR).
• Retention period: Until you unsubscribe (by clicking the link in the e-mail) or withdraw your consent, but no longer than 3 years from the last active contact.

D) Customer support and inquiries

• What we process: Name, e-mail, telephone, and the content of your message.
• Legal basis: Legitimate interest in processing your request or negotiating the conclusion of a contract.
• Retention period: For the time necessary to handle the inquiry, no longer than 1 year.

3. To whom do we transfer data? (Data Recipients)

Your data is safe with us. However, to ensure the operation of the e-shop, we use the services of verified partners (so-called processors) who are bound by data processing agreements and a duty of confidentiality.

We transfer your data to the following categories of recipients:

• E-shop platform operator: Shoptet, a.s., with its registered office at Dvořeckého 628/8, 169 00 Prague 6, ID No.: 28935675 (ensuring the technical operation of the e-shop).
• Carriers: Companies ensuring the delivery of goods (e.g., GLS, Packeta, and others). We transfer to them only the data necessary for delivery (name, address, telephone, e-mail).
• Payment gateways: Payment service providers (e.g., ComGate, GoPay) for processing online payments. The Controller does not have access to sensitive data regarding your card.
• Accounting and tax advisors: For the fulfillment of legal obligations.
• Marketing tools: (e.g., Google Analytics, Leadhub) only if you have granted consent to cookies or marketing.

We do not transfer your personal data to third countries outside the EU, with the exception of cases where we use the services of multinational providers (e.g., Google) who guarantee data protection in accordance with the GDPR.

4. Use of Cookies

Our e-shop uses cookies to ensure website functionality, measure traffic, and target advertising.

• Technical (necessary) cookies: Are necessary for the functioning of the shopping cart and sending the order. They cannot be turned off.
• Analytical and marketing cookies: We use these only with your consent, which you grant via the cookie bar.
• You can change your consent at any time in the website settings.

5. What are your rights?

Under the GDPR regulation, you have the following rights vis-à-vis us:

• Right of access (Art. 15 GDPR): You have the right to know what data we process about you and to obtain a copy thereof.
• Right to rectification (Art. 16 GDPR): If your data is inaccurate, we will correct it.
• Right to erasure (Art. 17 GDPR): If the reason for processing has passed (e.g., you cancel your account and the warranty period has expired), we will delete your data. Note: data that we must archive by law (e.g., invoices) cannot be deleted.
• Right to restriction of processing (Art. 18 GDPR): You can ask us to temporarily “freeze” your data (e.g., until a dispute regarding its accuracy is resolved).
• Right to data portability (Art. 20 GDPR): You can ask us to provide your data in a machine-readable format.
• Right to object (Art. 21 GDPR): If we process data based on legitimate interest (e.g., direct marketing), you can object and we will stop doing so.

To exercise your rights, contact us at hello@adventuremenu.com. We will reply to you within 30 days at the latest.

You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz).

6. Data Security

We declare that we have adopted all suitable technical and organizational measures to secure personal data. The e-shop uses the secured HTTPS protocol (encrypted communication). Access to data is restricted to authorized persons only.

These conditions are valid from March 18, 2026.