How we collect, use and protect your personal data.

This Privacy Policy applies to the processing of personal data by urbiq s.r.o., Company Registration No. 17298822, with its registered office at Plynární 1032/29, Holešovice, 170 00 Prague 7, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 369083 ("urbiq", "we", "us" or "our"). It applies in particular when you use www.urbiq.eu, communicate with us, request or use our services, subscribe to our newsletter, or otherwise interact with us.

urbiq is the controller of your personal data under Regulation (EU) 2016/679 (the "GDPR") and Act No. 110/2019 Coll., on Personal Data Processing.

You can contact us about privacy and personal data at:

• Mailing address: Plynární 1032/29, Holešovice, 170 00 Prague 7, Czech Republic
• Telephone: +420 774 887 950
• E-mail: [email protected]

This Privacy Policy concerns personal data relating to natural persons. It does not apply to information relating solely to legal entities, although information about their representatives and contact persons may constitute personal data.

1. Personal data we process

Depending on how you interact with us, we may process in particular:

• identification data, such as your name, surname, position and organisation;
• contact data, such as your e-mail address, telephone number and mailing address;
• data included in orders, enquiries, requests, contracts and other communications;
• billing, payment and accounting data;
• data needed to provide our services and administer the contractual relationship;
• information about newsletter subscriptions and marketing preferences;
• technical and usage data, such as IP address, browser and device type, operating system, approximate location derived from the IP address, date and time of access, pages viewed, referring page, and cookie or similar identifiers.

Please do not provide personal data that is not necessary for the purpose of your communication with us.

2. Purposes and legal bases of processing

We process personal data only where we have a legal basis. Depending on the circumstances, we process it for the following purposes:

Where processing is based on consent, providing consent is voluntary and you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Where we rely on legitimate interests, you may object to the processing as described below.

3. How we obtain personal data

We usually obtain personal data directly from you, for example when you complete a form, contact us, request an offer, enter into a contract, use our services or subscribe to our newsletter. We may also receive data from your employer or organisation, from our business partners where lawful, or from publicly available sources. Technical data may be collected automatically when you use our website, subject to your cookie choices.

4. Recipients and processors

We do not sell your personal data. We may disclose it only where necessary and lawful, in particular to:

• providers of hosting, IT, cloud, analytics, communication, marketing, accounting, legal and other support services;
• persons involved in providing the service you requested;
• public authorities, courts or other bodies where required by law or necessary to establish, exercise or defend legal claims;
• other recipients with your consent or on another lawful basis.

Service providers processing personal data on our behalf act as processors and are bound by appropriate contractual and confidentiality obligations. We disclose only the data necessary for the relevant purpose.

5. International transfers

Some service providers may process personal data outside the European Economic Area. In such cases, we use an applicable legal transfer mechanism and appropriate safeguards, such as an adequacy decision or standard contractual clauses, unless a statutory exception applies. Information about the safeguards relevant to a particular transfer is available on request.

6. Retention periods

We retain personal data only for as long as necessary for the relevant purpose, including compliance with legal obligations and the establishment, exercise or defence of legal claims. In particular:

• data relating to a contract is retained for the duration of the contractual relationship and afterwards for the applicable limitation and statutory retention periods;
• accounting and tax documents are retained for the periods required by law;
• enquiry data is retained for the period necessary to handle the enquiry and reasonable follow-up;
• data processed on the basis of consent is retained until consent is withdrawn or the stated retention period expires;
• data used for direct marketing is retained until you object, unsubscribe or withdraw consent, as applicable;
• cookie data is retained according to the lifetime stated in the cookie settings or cookie notice.

We may retain limited information where necessary to record and respect an objection, withdrawal of consent or unsubscribe request.

7. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is limited to persons who need the data for their work or for the provision of contracted services.

8. Your rights

Subject to the conditions laid down by the GDPR, you have the right to:

• obtain confirmation whether we process your personal data and request access to it;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• receive data you provided to us in a structured, commonly used and machine-readable format and transmit it to another controller where the right to data portability applies;
• object to processing based on our legitimate interests;
• object at any time to processing for direct marketing, including related profiling;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the supervisory authority.

To exercise your rights, contact us at [email protected]. We may need to verify your identity before fulfilling a request. We respond without undue delay and within the time limits set by the GDPR. Requests are generally handled free of charge, but we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, in accordance with the GDPR.

The Czech supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz.

9. Cookies and similar technologies

Our website may use cookies and similar technologies. Cookies are small files stored on your device or information accessed from it. They may be used to ensure the website works, remember preferences, measure website use and, where enabled, support marketing.

We may use:

• strictly necessary cookies, which are required for the website to function and do not require consent where permitted by law;
• preference cookies, which remember choices you make;
• analytics cookies, which help us understand how visitors use the website;
• marketing cookies, which may be used to measure campaigns or personalise advertising.

Non-essential cookies are used only after you give consent through the cookie settings, where consent is required. You can withdraw or change your consent at any time through the cookie settings. You can also configure your browser to block or delete cookies; however, some website features may then not work properly.

The specific cookies, providers, purposes and retention periods should be listed in the website's current cookie settings or cookie notice.

10. Analytics and advertising services

Subject to your consent where required, the website may use analytics or advertising services, including services provided by Google or Seznam.cz. These providers may collect technical and usage information through cookies or similar technologies and process it in accordance with their own privacy information. The services actually active on the website and the available consent choices should be identified in the cookie settings.

Information about how Google uses data from sites or apps that use its services is available at Google's privacy information for partner sites.

11. Direct marketing

You may unsubscribe from newsletters and other electronic marketing at any time by using the unsubscribe link in the message or by contacting [email protected]. If you object to direct marketing, we will stop using your personal data for that purpose.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing, the website or applicable law. The current version will be published on our website together with its effective date.

Effective date: 17 September 2026