Privacy Policy & Cookie Statement

Personal data processed in connection with this website and the business operations of the HEIRU Group is handled under a joint controllership arrangement (Art. 26 GDPR). The joint data controllers are:

HEIRU CZ s.r.o. (for the Czech Republic)
Registered office: Těšíkova 385, 588 56 Telč, Czech Republic
Company ID: 26069784, VAT ID: CZ26069784
Commercial Register: C 96727 (Regional Court in Brno)
Email: info@heiru.com

and the parent company:

HEIRU A. & R. Heinz GmbH (for Austria and international markets)
Registered office: Parndorfer Straße 11/8, 2460 Bruckneudorf, Austria
FN: 230456 g (Regional Court Eisenstadt), VAT ID: ATU 56899128
Email: office@heiru.com

Essence of the Joint Controller Arrangement (Art. 26(2) GDPR):
Both companies jointly share responsibility for compliance with GDPR obligations, secure IT operations, and fulfilling data subject rights. Operationally, HEIRU CZ s.r.o. primarily handles communications, inquiries, and contracts for the Czech Republic, while HEIRU A. & R. Heinz GmbH handles Austria and German-speaking markets. Data subjects may exercise their GDPR rights with respect to and against either of the joint controllers using the contact information above.

The controllers have not appointed a Data Protection Officer (DPO), as this is not legally required under Art. 37 GDPR. Inquiries regarding data privacy can be sent directly to the email addresses listed above.

We process strictly necessary personal data for specific purposes and under explicit legal bases:

Categories of Processed Data:

• Identification and address data: Full name, title, company name, VAT ID, registered office address.
• Contact details: Email address, telephone number.
• Recruitment and applicant data: Resume/CV, qualifications, education, work experience, and information provided by the candidate.
• Technical and usage data: IP address, access timestamps, browser metadata, cookie preferences.

Purposes and Specific Legal Bases:

• Product inquiries, custom price quotes, and proposal preparation via contact forms: Performance of a contract or taking pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR).
• General inquiries, customer support, and operational questions via contact forms: Legitimate interest in effective communication with clients, partners, and the public (Art. 6(1)(f) GDPR).
• Recruitment and candidate screening (applications and CVs): Taking pre-contractual measures and evaluating applicant suitability prior to entering into an employment contract (Art. 6(1)(b) GDPR).
• Website stability, operation, and IT security: Legitimate interest in securing IT infrastructure against cyber threats (Art. 6(1)(f) GDPR).
• Fulfillment of statutory legal obligations (accounting, tax records following contract conclusion): Compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Optional cookies (analytics/marketing): Your explicit, voluntary consent (Art. 6(1)(a) GDPR).

Managing and Revoking Consent:
You can modify or withdraw your consent at any time by clicking the "Cookie settings" link in the website footer. Declining optional cookies will not restrict your access to core website features.

Where personal data is processed based on legitimate interest (Art. 6(1)(f) GDPR), we pursue the following specific and legitimate purposes:

We retain personal data strictly for the period necessary to fulfill the specified purposes and in compliance with statutory retention obligations:

Our website utilizes cookies and similar technologies in accordance with the choices available in the "Cookie Consent Settings" modal. We classify cookies into three distinct categories:

1. Strictly necessary cookies (Always active):
These cookies are essential for the website to function securely and properly. They cannot be switched off in our systems (Art. 6(1)(f) GDPR).

• heiru_cookie_consent (Provider: HEIRU / 1st party, Purpose: storing and managing your cookie consent preferences, Category: Strictly necessary cookies, Retention: 180 days).
• NEXT_LOCALE (Provider: HEIRU / 1st party, Purpose: retaining your selected language version across browsing sessions, Category: Strictly necessary cookies, Retention: Session / 1 year).

2. Analytics & performance cookies (Consent required):
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. The website currently does not use third-party analytics services (such as Google Analytics). Any future deployment will occur strictly on the basis of your prior explicit consent (Art. 6(1)(a) GDPR).

3. Marketing & targeting cookies (Consent required):
These cookies may be set to build a profile of your interests and show you relevant content or information. The website currently does not use third-party marketing or tracking cookies. Stored exclusively with your prior explicit consent (Art. 6(1)(a) GDPR).

Managing and Revoking Consent:
You can modify or withdraw your consent at any time by clicking the "Cookie settings" link in the website footer. Declining optional cookies will not restrict your access to core website features.

Data is processed solely within the European Economic Area (EEA) by vetted IT and hosting service providers under GDPR-compliant Data Processing Agreements (Art. 28 GDPR). No data is transferred to third countries outside the EEA.

Under the General Data Protection Regulation (GDPR), you hold the following guaranteed rights as a data subject:

Overview of Your Rights:

• Right of Access (Art. 15 GDPR): Right to obtain confirmation as to whether your personal data is processed, and to receive a copy thereof.
• Right to Rectification (Art. 16 GDPR): Right to obtain without undue delay the rectification of inaccurate data or completion of incomplete data.
• Right to Erasure / Right to be Forgotten (Art. 17 GDPR): Right to erasure when data is no longer necessary, consent has been withdrawn, or processing is unlawful.
• Right to Restriction of Processing (Art. 18 GDPR): Right to request restriction of processing under legally defined circumstances.
• Right to Data Portability (Art. 20 GDPR): Right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): Right to object at any time to processing based on legitimate interest (Art. 6(1)(f) GDPR).
• Right to Withdraw Consent (Art. 7(3) GDPR): Consent given for optional cookies can be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

Necessity of Providing Personal Data and Consequences of Failure (Art. 13(2)(e) GDPR):
Providing identification and contact data via forms or job applications is a contractual/pre-contractual requirement. Provision is voluntary; however, without this information, we cannot answer your inquiry, issue a formal price quote, enter into a contract, or process a job application.

Automated Decision-Making and Profiling (Art. 13(2)(f) GDPR):
No automated individual decision-making or profiling within the meaning of Art. 22 GDPR is conducted.

Supervisory Authorities for Complaints:

• Czech Republic: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
• Austria: Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

To exercise your rights, please contact: info@heiru.com or office@heiru.com.