PRIVACY POLICY

Last updated: 8 September 2026

This Privacy Policy explains how personal data is processed when you use this website or contact us through it. It is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).

1. WHO IS RESPONSIBLE FOR YOUR DATA

The controller of your personal data is:

MORTAR INVESTMENTS a.s.
Za obecním úřadem 354/7
Krč, 140 00 Prague 4
Czech Republic
Company ID No.: 27442233
VAT No.: CZ27442233

For any question about this policy or about your personal data, write to [email protected].

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR.

2. WHAT WE COLLECT AND WHY

a) When you send us an enquiry through the contact form

We process the data you enter: your name, e-mail address, telephone number (optional), the area of interest you select and the content of your message. We also record the website the enquiry was sent from.

Purpose: to read your enquiry, reply to it and, where relevant, to discuss a possible business relationship.
Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) and, where your enquiry does not lead to a contract, our legitimate interest in responding to business correspondence addressed to us (Article 6(1)(f) GDPR).
Is it required: providing your name, e-mail address and message is necessary for us to be able to reply. Everything else is optional.

b) When you simply visit the website

Our hosting and security provider processes technical data needed to deliver the page and to protect the site against attack and abuse — in particular your IP address, the time of the request, the address requested, and your browser and operating system identification.

Purpose: operating the website, network security, and preventing abuse.
Legal basis: our legitimate interest in a secure and functioning website (Article 6(1)(f) GDPR).

c) Visit statistics

We measure aggregate traffic using Cloudflare Web Analytics. This tool works without cookies and without any identifier stored on your device, and does not build a profile of individual visitors or track them across other websites.

Purpose: to know which pages are read and how the site performs.
Legal basis: our legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR).

3. COOKIES

This website does not use cookies for analytics, advertising or profiling, and does not store any tracking identifier on your device. Our security provider may set a strictly technical cookie where it is necessary to distinguish automated traffic from human visitors and to keep the site available; such a cookie is not used to identify you or to follow you across other websites.

4. WHO ELSE SEES YOUR DATA

We do not sell personal data and we do not share it for anyone else’s marketing purposes. Your data is accessible to our employees and authorised representatives who need it in order to deal with your enquiry, and to the following service providers acting as our processors:

Cloudflare, Inc. — hosting, content delivery, website security and delivery of contact-form messages to our mailboxes.
Google Ireland Limited / Google LLC — the e-mail service on which our mailboxes run (Google Workspace).

We may also disclose personal data where we are required to do so by law, or where it is necessary to establish, exercise or defend legal claims — including in connection with export-control, sanctions and defence-trade obligations to which our business is subject.

5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

The providers named above are established in, or form part of corporate groups established in, the United States, and personal data may therefore be transferred outside the European Economic Area. Such transfers take place on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, or on the basis of Standard Contractual Clauses adopted by the European Commission, together with the additional safeguards agreed with those providers.

6. HOW LONG WE KEEP IT

Enquiries and related correspondence: for up to 3 years from our last communication with you, so that we can follow up and keep a record of what was agreed or offered. If the enquiry leads to a contract, the data is kept for the duration of that relationship and for as long afterwards as accounting, tax and export-control rules require.
Security and server records: for the short period applied by our hosting provider, generally counted in days.
Aggregate visit statistics: retained in aggregate form only; they do not identify you.

When a retention period ends, the data is deleted or irreversibly anonymised.

7. YOUR RIGHTS

Under the GDPR you have the right to:

access the personal data we hold about you and obtain a copy of it;
rectification of inaccurate data and completion of incomplete data;
erasure of your data where one of the grounds in Article 17 GDPR applies;
restriction of processing in the cases set out in Article 18 GDPR;
data portability for data you provided to us and which we process by automated means on the basis of consent or contract;
object at any time to processing based on our legitimate interest, on grounds relating to your particular situation;
withdraw consent at any time, where processing is based on consent — withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, write to [email protected]. We will respond within one month of receiving your request; where a request is complex, that period may be extended by up to two further months, and we will tell you if that happens. We may ask you for information needed to confirm your identity.

8. RIGHT TO LODGE A COMPLAINT

If you believe your personal data is being processed unlawfully, you may lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
www.uoou.cz

You may also lodge a complaint with the supervisory authority of the EU Member State in which you live or work.

9. AUTOMATED DECISION-MAKING

We do not carry out automated decision-making producing legal effects concerning you, and we do not carry out profiling within the meaning of Article 22 GDPR.

10. CHILDREN

This website is aimed at professional, governmental and institutional users. It is not directed at children and we do not knowingly collect personal data relating to them.

11. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our processing or in applicable law. The current version is always available on this page, with the date of the last update shown at the top.