True Brothers Production s.r.o., Company ID: 04974565, registered office at Neklanova 112/9, Vyšehrad, 128 00, Prague 2, registered in the Commercial Register at the Municipal Court in Prague under registration number no. C 255752 (Seller) hereby informs its customers, who are data subjects according to the legislation on personal data protection, about the processing of their Personal Data, in accordance with Article 13 of Regulation 2016/679 of the European Parliament and of the Council of the EU. By the controller of personal data, they regulate the rules related to the protection of personal data. In connection with the conclusion of a contract (hereinafter referred to as the “Contract”) between the Seller and another natural or legal person (hereinafter referred to as the “Buyer”) through the means of distance communication, namely on the Seller’s platform operated on the website https://www.imagomundi.cz and through the web interface in order to purchase the offered goods and services, personal data (hereinafter referred to as “personal data”) are processed. The data is processed under the same conditions if the contract is concluded by an agreement via e-mail communication based on the buyer’s request, or by an agreement negotiated on the basis of the buyer’s request through the web form or through the cross-platform WhatsApp Messenger application.

Cookies

In HTTPS, a cookie refers to a small amount of data that the WWW server sends to the browser, which is then stored on your computer. Each time you visit the same server, the browser sends this data back to the server. Cookies are commonly used to distinguish individual users, store user preferences, etc.

The seller uses cookies to improve the functionality of their website and to better understand how visitors use the site and services. The storage of cookies on the buyer’s computer makes it easier for the seller to personalize or improve the buyer’s experience with their site the next time they visit. The seller does not use cookies to collect personal data such as the name of the buyer about everything. It can combine the information in the cookie with the personal data obtained by the buyer in another way (e.g. by filling in the form when placing an order).

Website analytics

We measure the website with PostHog to know how many people visit it, what they look for and what to improve. How much we measure depends on your choice in the “Cookies and analytics” bar: you can allow all, keep essentials only, or use “Choose by purpose” to allow Statistics and Advertising separately. We store your choice in the browser (the im-consent entry in localStorage) so the bar does not appear on every page; this is strictly necessary. You can change it at any time with the “Cookie settings” link in the website footer.

Without consent: anonymous visit counts

If you choose essentials only or have not decided yet, we send PostHog only an anonymous record of a page view, of how fast the page loaded and responded (Web Vitals), of a click on the phone number, e-mail or map, of opening and completing a booking and of a form submission. The record contains the page address without parameters and the domain of the website you came from. It never contains what you wrote in a form.

We do not use cookies or any other browser storage for this, we do not read properties of your device, we do not create any identifier or browser fingerprint and we do not link individual records together. PostHog does not store the IP address and does not derive a location from it. The result is only aggregate visit counts for this website; we do not combine them with other data and do not pass them on to anyone else. This anonymous measurement serves only visit statistics, which is why we do not ask for consent to it.

If you choose “Allow all” in the bar or tick Statistics, PostHog is loaded. It shows us where people click, how far they read, where they leave and how fast the pages load, and we improve the website accordingly. PostHog processes:

pages visited, clicks and how far you scroll,
device type, browser, operating system and window size,
approximate location (country, city) estimated from the IP address; the IP address itself is not stored,
page load speed and errors reported by the page in the browser,
a recording of how you move through the page (movement, scrolling and clicks); page text and ordinary filled-in form fields are visible in the recording; passwords, payment details and access codes remain masked,
a random visitor and session identifier stored in browser storage (ph_* entries in localStorage and sessionStorage); no cookies are used,
for a completed booking, the LetsBook booking number, the amount paid, the cruise length and the number of guests; so that a booking is not counted twice, the browser remembers the last 20 booking numbers (im-rezervace-cisla in localStorage) and the time of the last booking in the tab (im-rezervace-dokoncena in sessionStorage).

We do not link this data to your name, e-mail or phone number. The booking number is used only to avoid counting one booking twice and to know which visits led to a booking.

Legal basis: your consent (Art. 6(1)(a) GDPR). Consent is valid for 12 months.
Retention: page recordings 90 days, other data at most 7 years.
Processor: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data is stored in the EU (Germany).
Transfers outside the EU: PostHog may exceptionally process data in the USA (support, sub-processors). Such transfers are covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
Withdrawing consent: use the “Cookie settings” link in the footer and choose “Essentials only” (or untick Statistics). PostHog entries (ph_*) are then deleted from your browser; only an opt-out flag without any identifier remains. Withdrawal does not affect processing that took place before it.

Together with PostHog, statistics consent also loads Google Analytics 4. We use it for aggregate statistics: where visitors come from, which pages they view and whether they sent an enquiry or opened the booking. Google Analytics processes pages visited, the source of the visit, device and browser type, an approximate location estimated from the IP address (the IP address itself is not stored by Google) and a random visitor identifier in the _ga and _ga_* cookies, valid for 2 years, and for a completed booking also the booking number, the amount paid, the cruise length and the number of guests. Without advertising consent, Google advertising features are switched off (see the next section). We do not link this data to your name, e-mail or phone number.

Legal basis: your consent (Art. 6(1)(a) GDPR). Consent is valid for 12 months.
Retention: visit data for at most 14 months.
Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Transfers outside the EU: Google may process data in the USA (Google LLC). Such transfers are covered by the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.
Withdrawing consent: use the “Cookie settings” link in the footer and choose “Essentials only” (or untick Statistics). The _ga* cookies are then deleted from your browser and measurement stops. Withdrawal does not affect processing that took place before it.

With consent: advertising (Google signals and Google Ads)

If you choose “Allow all” in the bar or tick Advertising, Google Analytics may use Google advertising features. They tell us which ads lead to an enquiry or a booking, and let us show our ads in the Google network to people who have visited the website (remarketing). In addition, the following is processed:

linking your visit to your Google account if you are signed in to Google and have ad personalisation switched on (Google signals); from this Google derives aggregate data on visitors’ age, gender and interests and links your visits across devices,
the Google ad click identifier (gclid) and Google advertising cookies (_gcl_* and cookies on Google domains) if you arrive from an ad,
membership in Google Ads audiences (for example “visited the price list”).

We cannot see individual people in this data: Google gives us only aggregate figures and audiences without names or contact details. We do not sell the data and use it only to measure and improve our own ads.

Legal basis: your consent (Art. 6(1)(a) GDPR). Consent is valid for 12 months.
Retention: visit data in Google Analytics for at most 14 months, audience membership for at most 540 days after the last visit.
Recipient: Google Ireland Limited (address above). For Google signals and ad personalisation Google is an independent controller; how it handles the data is described in its policy at policies.google.com/privacy. You can also switch off ad personalisation directly with Google at myadcenter.google.com.
Transfers outside the EU: as for Google Analytics (EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses).
Withdrawing consent: use the “Cookie settings” link in the footer, “Choose by purpose” and untick Advertising, or choose “Essentials only”. Advertising features are then switched off for your browser. Withdrawal does not affect processing that took place before it.

When you sign up for our news using the form on the website or by ticking the box in an enquiry, we send you an e-mail with a link. Your subscription starts only after you confirm it on the page that link opens. Without confirmation we will not send you any news and will delete your address within 30 days.

What we store: your e-mail address, language, where the sign-up came from, when you signed up and when you confirmed.
Purpose and legal basis: sending news about cruises and events on the boat, based on your consent (Art. 6(1)(a) GDPR and Section 7(2) of Czech Act No. 480/2004 Coll.).
Retention: until you unsubscribe. After that we keep your address and the date you unsubscribed for 3 more years, so that we do not contact you again and can document your choice.
Unsubscribing and withdrawing consent: use the link in any of our e-mails or write to info@imagomundi.cz. Withdrawal does not affect processing carried out before it.
Processor: Cloudflare, Inc., USA (website, form database and sending e-mails). We use the same processor for enquiries sent through the form. Such transfers are covered by EU Standard Contractual Clauses.

From enquiries we keep your name, e-mail and phone number so that we can contact you again with cruise offers, for 10 years after your last enquiry. We send commercial e-mails only if you have consented or have bought from us. You can object to this processing at any time at info@imagomundi.cz.

Protecting forms from bots

The forms on this website are protected by Cloudflare Turnstile. When you start using a form, it checks your browser (technical details about the browser and device and your IP address) to tell people from bots. It does not read what you type into the form. We use the result only to accept or reject the submission.

Purpose and legal basis: protecting the forms and other people’s mailboxes from abuse by bots, our legitimate interest (Art. 6(1)(f) GDPR).
Processor: Cloudflare, Inc., USA. Such transfers are covered by EU Standard Contractual Clauses.

Scope of personal data processing

When cooperating on the basis of a Contract concluded on the basis of an Order on the website https://www.imagomundi.cz/, we process the following Personal Data that you have provided about yourself:

first and last name, incl. titles, if any
billing or delivery address, address of permanent residence and, where applicable, address of residence or other place where you are staying
telephone and e-mail contact
in case of non-cash payment of Goods, bank account identification or similar payment details,
information that you provide about yourself in the course of communication with the advisory services listed on the Website

Your above personal data to the extent necessary to:

the conclusion of the Contract and its performance,
fulfilment of legal obligations of the Seller established on the basis of legislation or administrative acts of public authorities (e.g. issuing tax documents, bookkeeping, etc. ),
the exercise of the legitimate interests of the Seller, such as the storage of personal data for the possible assertion of the Seller’s or the Buyer’s claims in connection with the concluded purchase contract, the maintenance of statistical reports and an internal database for marketing and related analytics-marketing purposes consisting in collecting information on orders made and customer preferences and evaluating them for subsequent marketing, remarketing or related measures, such as addressing and sending commercial and advertising messages.

The Buyer has the opportunity at any time to refuse to receive commercial communications (newsletter) free of charge through the link in the commercial communication or by sending a request to the contact specified in each commercial communication.

The Seller may transfer the provided Personal Data to the entities cooperating with the Controller to fulfill or fulfill the above-mentioned processing purposes, such as providers of accounting, legal, technical, payment, marketing or administrative services, as well as to carriers of Goods and public authorities, if this is provided for by a valid and effective legal regulation or enforceable decision or other act of the administrative authority public power.

Period of processing of personal data

Personal data will be processed by the Seller for the period during which it will provide services or perform services to the Buyer on the basis of a mutual agreement or for the period necessary to fulfill archiving obligations under applicable legislation, such as the Accounting Act, the Law on Archiving and Records or the Law on Value Added Tax

Right of access to personal data, which means that he can request confirmation at any time whether the personal data relating to him are processed or not, and if so, for what purposes, to what extent, to whom they are disclosed, how long they will be processed, whether he has the right to rectification, erasure, restriction of processing or object, from where the personal data were obtained and whether the processing takes place on the basis of personal data data for automated decision-making, including profiling, where appropriate. He also has the right to obtain a copy of his personal data, the first provision of which is free of charge, and a reasonable payment of administrative costs may be required for the subsequent provision.

In the event of unlawful processing of their personal data, the Buyer is entitled to lodge a complaint against such a procedure with the Office for Personal Data Protection or another competent public authority. At the same time, you have the opportunity to object to the processing of personal data to the Seller in accordance with Article 21 of the GDPR. In connection with the protection of personal data or the exercise of subjects’ rights, you may contact the Seller in writing at the registered address of the Seller’s registered office or via e-mail info@imagomundi.cz