Privacy Policy
Last updated: 29 May 2026 — Version 2.0
1. Data Controller
The controller of your personal data is:
SANARA s.r.o.
Registered office: Kunín 30, 742 53 Kunín
Place of business: Frýdecká 851, 739 61 Třinec, Czech Republic
Company ID (IČO): 01817566
VAT ID: CZ01817566 (VAT payer)
Registered: Regional Court in Ostrava, file no. C 56729
Represented by: Ľubomír Magát, executive director
Contact person for data protection: Jakub Nowicki
Tel.: +420 734 548 884
E-mail: atelier@kymera-art.com
Web: kymera-art.com
This page informs you of what personal data we process, why we process it, and what rights you hold. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll. on the processing of personal data.
2. Data We Process
We process exclusively data that you provide to us directly via the contact form at kymera-art.com. Specifically, this includes:
- Full name — so that we know how to address you
- E-mail address — to send you a reply to your enquiry
- Phone number — if you choose to provide it voluntarily, for direct communication
- Message content — the content of your enquiry or question
We do not carry out automated profiling, we do not collect marketing data, we do not use tracking technologies, and we do not process any special categories of personal data.
3. Purposes and Legal Basis for Processing
We process your personal data for the following purposes and on the following legal bases:
a) Pre-contractual negotiations (handling an enquiry)
Purpose: processing an enquiry, preparing a price quotation, communicating with an interested party.
Legal basis: Art. 6(1)(f) GDPR — the legitimate interest of the controller in responding to a person who has contacted the controller directly. You have the right to object at any time (Art. 21 GDPR); we will cease processing without undue delay unless we can demonstrate compelling legitimate grounds for continuing.
Data processed: name, e-mail, phone, message content, work of interest.
Retention period: 6 months from the last communication, unless a contract is concluded.
b) Performance of contract (fulfilment of a commission)
Purpose: conclusion and performance of a purchase agreement or contract for work, production, delivery, installation, invoicing.
Legal basis: Art. 6(1)(b) GDPR — measures taken prior to entering into a contract and performance of a contract to which the data subject is a party.
Data processed: identification, billing, and contact details, delivery address, bank details.
Retention period: for the duration of the contract and for the limitation period of claims.
c) Legal obligation (archiving)
Purpose: maintaining accounts, VAT records, archiving tax documents.
Legal basis: Art. 6(1)(c) GDPR — compliance with a legal obligation under Act No. 563/1991 Coll. on accounting and Act No. 235/2004 Coll. on VAT.
Data processed: invoicing and contractual documents.
Retention period: 10 years from the end of the tax period in which the supply took place (Section 31(2) of Act No. 563/1991 Coll., Section 35(3) of Act No. 235/2004 Coll.).
4. Retention Periods
We retain your data for the period strictly necessary to handle an enquiry and, where applicable, to conclude a contract — generally 12 months from the last contact. Where a purchase agreement for a work is concluded, we archive contractual and invoicing documentation for 10 years from the end of the tax period in which the supply took place (Section 31(2) of Act No. 563/1991 Coll. on accounting, Section 35(3) of Act No. 235/2004 Coll. on VAT). This obligation applies to billing and identification data; the scope of archived data is limited to the minimum necessary to fulfil the legal obligation.
Upon expiry of the applicable period, your data is permanently deleted.
5. Third-Party Transfers and International Transfers
We do not sell, rent, or share your data with third parties for marketing purposes. All sharing is limited to technically necessary operations described below.
Some personal data is processed by processors based outside the European Economic Area, specifically in the United States of America:
Web3Forms (operator: ABLab LLC, USA) — processes data submitted via the contact form. Web3Forms acts as a data processor within the meaning of Art. 28 GDPR. The transfer of data is carried out on the basis of standard contractual clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR and in accordance with the EU–U.S. Data Privacy Framework, to which Web3Forms is subject through its provider. Web3Forms Privacy Policy: web3forms.com/privacy.
Vercel Inc. (USA) — hosting of the kymera-art.com website. Vercel processes technical data of visitors (IP addresses, timestamps, user-agent strings) for the purposes of content delivery and service security. Vercel is certified under the EU–U.S. Data Privacy Framework (European Commission Decision 2023/1795). The transfer of data to the USA is therefore covered by this adequacy decision. Vercel Privacy Policy: vercel.com/legal/privacy-policy.
Data subjects may request a copy of the standard contractual clauses by e-mail to atelier@kymera-art.com.
Further recipients of personal data include: the bank (for processing payments) and public authorities (the tax authority, Czech Social Security Administration (ČSSZ) — for fulfilment of legal obligations). These recipients process data only to the extent necessary and on the basis of their legal authority. Accounting is maintained by the controller personally; no external accountant is involved.
6. Your Rights
As a data subject, you hold the following rights with respect to your personal data:
- Right of access — you may at any time request confirmation that we are processing your data and receive a copy.
- Right to rectification — if your data is inaccurate or incomplete, we will correct it.
- Right to erasure — in cases provided by law, you have the right to request deletion of your data.
- Right to restriction of processing — in certain circumstances, you may request that we process your data only in a restricted manner.
- Right to data portability — where we process your data by automated means on the basis of consent or contract, you have the right to receive it in a machine-readable format.
- Right to object — where processing is based on legitimate interests, you may object at any time; we will cease processing unless we can demonstrate compelling grounds.
- Right to withdraw consent — consent to processing may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise your rights, please contact us at atelier@kymera-art.com or in writing at the controller's address. We will respond within 30 days.
You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (Office for Personal Data Protection — ÚOOÚ) (uoou.cz), Pplk. Sochora 27, 170 00 Prague 7.
7. Security
All communication with the website is encrypted via HTTPS. Personal data is stored solely in e-mail correspondence, accessible exclusively to the controller. We implement appropriate technical and organisational measures commensurate with the nature of the processing and the risk to your rights.
8. Contact
For any questions concerning the processing of your personal data, please contact the controller directly:
SANARA s.r.o. — contact: Jakub Nowicki
atelier@kymera-art.com
+420 734 548 884