Privacy Policy

Information pursuant to Art. 13 and 14 of Regulation (EU) 2016/679 (GDPR) | website pnhmedia.com and the business activities of PNH LIMITLESS s.r.o.

Version: 1.0 | Effective from: 22 October 2026

English translation for information. In case of any discrepancy, the Czech version prevails.

Art. 1 Who Is the Controller

1.1The controller of personal data is PNH LIMITLESS s.r.o., Company ID (IČO): 30029805, registered office Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 456086 (the "Controller", "we").

1.2The Controller operates the website pnhmedia.com and does business under the trade name "PNH MEDIA". The Slovak company PNH MEDIA s.r.o., Company ID (IČO) 55299504, is a sister company of the Controller controlled by the same shareholder. It is a separate legal entity. For the purposes stated in Art. 1.3 it is a joint controller with us.

1.3Joint controllership with PNH MEDIA s.r.o. For the purposes of handling enquiries (Art. 3.3), managing relationships with clients and their contact persons (Art. 3.5) and B2B commercial communication with prospective clients (Art. 3.6), we use a shared customer relationship management (CRM) system with PNH MEDIA s.r.o., Company ID (IČO) 55299504, and we jointly determine the purposes and means of processing. We are therefore joint controllers under Art. 26 GDPR. The essence of the arrangement between us: PNH LIMITLESS s.r.o. operates the shared CRM and the website pnhmedia.com, fulfils the information obligation towards you through this policy and is your point of contact; each company is responsible for the lawfulness of the processing of data that it enters into the CRM or uses from it; you may exercise your requests and objections with either of them, and the other company will provide the necessary assistance. The other purposes described in this policy are processed only by PNH LIMITLESS s.r.o.

1.4Contact for personal data protection: [email protected], tel. +420 722 221 445, by post to the registered office address. The Controller has not appointed a data protection officer because it is not required to do so under Art. 37 GDPR.

Art. 2 Who This Policy Applies To

2.1This policy describes how we process personal data of:

• visitors to the website pnhmedia.com,
• persons who contact us through the form, email, telephone or social media,
• subscribers to commercial communications (newsletter),
• our clients who are natural persons, and contact persons of our clients and suppliers,
• potential clients whom we approach in the course of B2B business communication,
• applicants for employment and for cooperation (freelancers),
• followers of our social media profiles.

2.2This policy does not apply to personal data that we process on behalf of our clients as a processor (for example data from their advertising accounts, pixels, CRM or e-shops). The relevant client is responsible for this data as controller, and its processing is governed by the Data Processing Agreement, which is Annex No. 1 to our General Terms and Conditions. Information about this processing is provided to data subjects by the client.

Art. 3 Purposes, Legal Bases and Retention Periods

3.1Operation and security of the website

• Data: IP address, date and time of access, URL visited, type of browser and device, error reports.
• Legal basis: legitimate interest in ensuring the operation and security of the website and protecting it from misuse (Art. 6(1)(f) GDPR).
• Retention period: server logs 90 days.

3.2Cookies, analytics and traffic measurement

• Data: cookie identifiers, IP address (shortened for analytics or processed by the tool provider), device and browser information, behaviour on the website (pages visited, clicks, mouse movement, scrolling, length of visit).
• Legal basis: necessary cookies on the basis of legitimate interest in the functioning of the website and in storing your choice (Art. 6(1)(f) GDPR in conjunction with Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications); analytical and marketing cookies and similar technologies solely on the basis of your consent (Art. 6(1)(a) GDPR and Section 89(3) of Act No. 127/2005 Coll., for users from Slovakia Section 109 of Act No. 452/2021 Coll. on Electronic Communications (Slovakia)).
• Retention period: according to the validity period of individual cookies stated in the Cookie Policy; consent is valid for 6 months, after which we will ask you again.
• Tools: Google Analytics 4 and Microsoft Clarity (analytics); Google Ads, Meta Pixel and LinkedIn Insight Tag (conversion measurement, remarketing and ad targeting). We run all tools through Google Tag Manager only after you consent to the relevant category.
• Role of the providers: Google processes Google Analytics 4 data as our processor. For Google Ads, Google acts as an independent controller under its advertising terms. For the collection of data on our website and its transmission via Meta Pixel and LinkedIn Insight Tag, we are joint controllers with Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company respectively, under their joint controller addenda pursuant to Art. 26 GDPR (see judgment of the Court of Justice of the EU C-40/17 Fashion ID). These companies are independently responsible for subsequent processing on their platforms, and you can exercise your rights regarding it directly with them.
• Details: Cookie Policy on the website pnhmedia.com.

3.3Contact form and enquiries

• Data: first name and surname, company name, email, telephone (optional), requested service, project description and other data you give us.
• Legal basis: negotiations on entering into a contract at your request (Art. 6(1)(b) GDPR); if you act on behalf of a company, our legitimate interest in responding to your company's enquiry (Art. 6(1)(f) GDPR).
• Retention period: 12 months from the last communication if no contract is concluded; after that we erase the data. If a contract is concluded, Art. 3.5 applies.

3.4Newsletter and commercial communications

• Data: email, name, company name, data on email opens and link clicks.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Section 7(2) of Act No. 480/2004 Coll., on Certain Information Society Services); for our existing clients we send commercial communications concerning similar services on the basis of legitimate interest in direct marketing (Art. 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.).
• Retention period: until consent is withdrawn or an objection is raised; for existing clients for the duration of the contractual relationship and 2 years after its end. After you unsubscribe, we keep only your email and the date of unsubscribing on a suppression list so that we do not contact you again, for 5 years.
• You can unsubscribe at any time using the link in every email or by writing to [email protected].

3.5Clients and contact persons of clients and suppliers

• Data: first name and surname, job title, business name, Company ID (IČO), VAT ID (DIČ), address, email, telephone, invoicing and payment data, content of communications, minutes of meetings, project materials and deliverables, access roles to accounts.
• Legal basis: performance of a contract where the contracting party is a natural person (Art. 6(1)(b) GDPR); legitimate interest in the proper performance of a contract with a legal entity and in communication with its representatives (Art. 6(1)(f) GDPR); compliance with legal obligations in accounting and tax (Art. 6(1)(c) GDPR).
• Retention period: contractual documentation and communications for the duration of the contract and 4 years after its end, which corresponds to the general three-year limitation period under Section 629(1) of the Civil Code and one year for the delivery of any claim; accounting and tax documents for 10 years from the end of the tax period in which the supply was made (Section 35 of Act No. 235/2004 Coll., on Value Added Tax, Section 31 of Act No. 563/1991 Coll., on Accounting, and the time limits for assessing tax under Act No. 280/2009 Coll., the Tax Code).

3.6Potential clients and B2B business communication

• Data: first name and surname, job title, business name, work email, work telephone, link to a professional profile (for example LinkedIn), company information (industry, website, size), records of communication.
• Source of data: public registers (the Commercial Register, ARES, the Slovak ORSR and RÚZ), company websites, professional social networks, trade fairs and events, referrals.
• Legal basis: our legitimate interest in offering services to businesses whose activity is related to our services (Art. 6(1)(f) GDPR). On request, we will provide you with the legitimate interest assessment.
• Retention period: 12 months from the last contact if you do not respond; after you raise an objection we erase the data and keep only your email and the date of the objection on a suppression list for 5 years.
• You may object to this processing at any time; we will then always stop processing for direct marketing purposes (Art. 21(3) GDPR).

3.7Applicants for employment and cooperation

• Data: first name and surname, contact details, CV, portfolio, education and experience, interview data, desired remuneration, links to professional profiles.
• Legal basis: negotiations on entering into a contract at your request (Art. 6(1)(b) GDPR); keeping you in the applicant database for future positions on the basis of your consent (Art. 6(1)(a) GDPR).
• Retention period: 6 months from the end of the selection procedure (the period in which an unsuccessful applicant may bring claims for unequal treatment); with your consent 2 years in the applicant database. The data of a successful applicant becomes part of the personnel or contractual records.
• We do not request data on health, religion, political opinions or other special categories of data; please do not provide it.

3.8Social media profiles

• Profiles: Instagram (instagram.com/pnh.media), LinkedIn (linkedin.com/company/pnh-media), X (x.com/PNH_MEDIA), Facebook (facebook.com/people/PNH-MEDIA/100087457094100).
• Data: name or nickname, profile photo, content of comments and messages, reactions, profile visit statistics provided by the platform in aggregated form.
• Legal basis: our legitimate interest in presenting ourselves and communicating with followers (Art. 6(1)(f) GDPR).
• Joint controllership: for page statistics we are a joint controller with Meta Platforms Ireland Limited (Facebook, Instagram) and LinkedIn Ireland Unlimited Company on the basis of their joint controllership addenda under Art. 26 GDPR. The relevant platform bears primary responsibility for processing the statistics and for the exercise of your rights in relation to them. The platforms also process data under their own policies.
• Retention period: messages and comments that we keep outside the platform for 12 months from the last communication; on the platform for as long as the content exists or in accordance with the platform's rules.

3.9Protection of legal claims

• Data: data from the categories above that is necessary for the establishment, exercise or defence of legal claims.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention period: for the duration of the dispute or proceedings and until the expiry of the time limits for remedies.

3.10Handling data subjects' requests and consents

• Data: identification and contact data, content of the request and the reply, record of the granting and withdrawal of consent.
• Legal basis: compliance with a legal obligation (Art. 6(1)(c) and Art. 5(2) GDPR).
• Retention period: 3 years from the handling of the request or the withdrawal of consent.

3.11Custom audiences in advertising systems

• Data: email and telephone number, converted into a hashed (irreversibly encrypted) form before upload.
• Purpose: displaying relevant PNH MEDIA advertising to you, or excluding you from advertising, on the Google, Meta and LinkedIn platforms (Customer Match, custom audiences, Matched Audiences).
• Legal basis: your explicit consent given by a separate checkbox (Art. 6(1)(a) GDPR). Without consent, we do not upload your contact data to advertising systems.
• Recipients: Google Ireland Limited, Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company, which compare the hashed data with their users and delete unmatched data under their own terms.
• Retention period: until consent is withdrawn; we remove the data from the audiences no later than 30 days after withdrawal and update the lists at least every 6 months.

3.12We will not process data for a purpose other than that for which it was collected, unless the new purpose is compatible with the original one under Art. 6(4) GDPR or we have a separate legal basis for it.

Art. 4 Where We Obtain Data

4.1We obtain most data directly from you. Data of contact persons may be obtained from their employer or principal (our client or supplier). For potential clients, data comes from the public sources listed in Art. 3.6. Data on website behaviour is obtained from cookies and similar technologies according to your settings.

Art. 5 To Whom We Disclose Data

5.1We make personal data available only to the extent necessary and only to the following categories of recipients:

• processors that provide us with IT, cloud, hosting, communication, invoicing and analytics services and are contractually bound under Art. 28 GDPR,
• our employees and collaborators bound by confidentiality,
• external accounting, tax and legal advisers,
• banks and payment service providers (as independent controllers),
• Advertising Platforms and social networks to the extent set out in Art. 3.2 and 3.8 (as independent or joint controllers),
• public authorities, courts and enforcement officers, where required by law.

5.2List of processors and other recipients

5.3We do not sell personal data and do not pass it to third parties for their own marketing.

Art. 6 Transfers Outside the European Economic Area

6.1Some of our processors have their registered office or infrastructure outside the EEA, in particular in the USA. We carry out transfers only under the conditions of Chapter V GDPR, on the basis of a European Commission adequacy decision (in particular the EU-U.S. Data Privacy Framework for certified recipients) or standard contractual clauses under Commission Implementing Decision (EU) 2021/914, supplemented by a transfer impact assessment. We will provide you with a copy of the relevant safeguards on request.

Art. 7 Automated Decision-Making and Profiling

7.1We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

7.2If you consent to marketing cookies, Advertising Platforms (in particular Google, Meta, LinkedIn) may evaluate your behaviour on our website and show you our advertising according to estimated interests (profiling for ad targeting). You can stop this processing at any time by withdrawing consent in the cookie settings and in the advertising preferences settings of the relevant platform.

7.3We upload contact data of clients and subscribers to Advertising Platforms for ad targeting or exclusion from advertising (custom audiences) only with your explicit consent under Art. 3.11.

Art. 8 Your Rights

8.1You have the right to:

• access your personal data and obtain a copy of the data being processed (Art. 15 GDPR),
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR),
• erasure, where the data is no longer needed, you withdraw consent, you raise a justified objection or the data is processed unlawfully (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• portability of data that we obtained from you on the basis of consent or a contract and process by automated means (Art. 20 GDPR),
• object to processing based on legitimate interest; you may object to processing for direct marketing purposes at any time and we will stop it without further assessment (Art. 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3) GDPR).

8.2You can exercise your rights by email at [email protected] or by post to the registered office address. We will respond without undue delay and no later than 1 month; in complex cases we may extend the period by a further 2 months, and we will inform you of this. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse the request. If we have doubts about your identity, we may ask for additional information.

8.3Complaint to a supervisory authority. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement:

• Czech Republic: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz,
• Slovak Republic: Office for Personal Data Protection of the Slovak Republic, Hraničná 4826/12, 820 07 Bratislava, www.dataprotection.gov.sk.

Art. 9 Children

9.1Our services and website are intended for businesses and adults. We do not knowingly process personal data of persons under 16 years of age. If we find that we have obtained such data, we will erase it.

Art. 10 Security

10.1We have implemented technical and organisational measures appropriate to the risk, in particular encryption in transit, two-factor authentication in all systems, management of access permissions, backups, operation of servers in EU data centres and contractual confidentiality obligations. An overview of the measures is set out in Annex B of the Data Processing Agreement.

Art. 11 Obligation to Provide Data

11.1Providing data for the conclusion and performance of a contract and for compliance with legal obligations is necessary; without it we cannot conclude or perform the contract. Providing data on the basis of consent is voluntary. Optional form fields are marked.

Art. 12 Changes to This Policy

12.1We may update this policy, in particular when the tools we use or legislation change. The current version is always published on the website pnhmedia.com with the effective date. We will inform you of material changes that concern you by email, if we have your contact details.

12.2This policy takes effect on 22 October 2026.