privacy policy

This notice explains how we handle personal data you provide through kornees.cz. It follows Article 13 of Regulation (EU) 2016/679 (“GDPR”), as we collect personal data directly from you. The Czech version of this policy is the authoritative one; this is a courtesy translation.

1. Who is the data controller

The controller is Kornees s.r.o., Company ID 21538832, registered at Ohrazenice 23, 511 01 Ohrazenice, Czechia (“controller”). For anything related to personal data, contact us at [email protected].

The festival branch of the brand is run by the affiliated company Kornees services festival s.r.o., Company ID 19382090, No. 25, 594 51 Řikonín. The controller for data processed via this website is exclusively Kornees s.r.o.

Given the nature and scope of our business, we are not required to appoint a Data Protection Officer (Art. 37 GDPR) and have not done so.

2. What data we process and where it comes from

The website is primarily a brand showcase. We collect personal data in a single place – the job application form:

• name,
• e-mail address,
• phone number,
• the location you are interested in,
• optionally a CV attached as a file (PDF, DOC or DOCX),
• optionally the “about me” text you write yourself.

We receive the data directly from you. Providing it is voluntary; however, without the required fields (name, e-mail, phone and location) we cannot assess your application or contact you. If you attach a CV, you are responsible for the data you include in it. The website does not create user accounts, run an e-shop or otherwise collect personal data on its own.

3. Why we process the data (purpose and legal basis)

We process the application data to assess your job application, contact you and, where relevant, take steps towards concluding an employment or similar contract.

The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), and where applicable our legitimate interest in running and evaluating the recruitment process (Art. 6(1)(f) GDPR). If you would like us to keep your CV for future openings beyond the specific recruitment, we will do so only with your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

4. How long we keep the data

We keep the data for the duration of the recruitment for the chosen position. If you are not selected, we delete the message and any attachment without undue delay after the process ends, at the latest within 6 months, unless you consent to longer storage or longer storage is necessary to establish, exercise or defend legal claims.

5. Who has access to the data

We do not sell your data. It is accessed only by the controller’s staff handling recruitment and by the person in charge of recruitment (a mailbox in the idrs.cz domain). We use the following processors (Art. 28 GDPR):

• Resend (Plus Five Five, Inc., USA) – delivery of the submitted form to the controller by e-mail;
• Cloudflare, Inc. (USA) – hosting and edge infrastructure, plus anonymous aggregate traffic measurement (Cloudflare Web Analytics, no cookies, no profiles; details in our cookie policy).

We have data processing agreements with both processors. Your data is not stored in any database on the website – the form only sends it to the controller by e-mail.

6. Transfers outside the European Union

As Resend and Cloudflare are US companies, data may also be processed in the United States. Both providers are certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR), and both also use the EU standard contractual clauses (Art. 46 GDPR). Transfers therefore take place under appropriate safeguards.

7. Content loaded from Instagram

The homepage shows previews of our Instagram posts. The list of posts is fetched on our server – the Instagram access token never reaches your browser and Instagram stores no cookies on your device. The photos, however, load directly from the Instagram/Facebook content network (scontent.cdninstagram.com) as images. When they are displayed, your IP address and basic technical request data are transmitted to Meta Platforms Ireland Ltd., acting as an independent controller. See Meta’s privacy policy for details.

8. Links to social networks and other services

The website links to external platforms (Instagram, Facebook, TikTok and the Foodora delivery service). If you follow any of these links, those services process your data as independent controllers under their own terms, which we do not control.

9. Automated decision-making

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Your rights

Regarding your personal data, you have the right to:

• access your data (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw consent at any time (Art. 7(3) GDPR).

To exercise your rights, e-mail [email protected]. You also have the right to lodge a complaint with the supervisory authority, the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz (Art. 77 GDPR, Sec. 4 of Czech Act No. 110/2019 Coll.).

11. Effect and changes

We may update this policy as needed; the version published on this page always applies. Effective from 10 July 2026.