Privacy Policy – Information on the Processing of Personal Data
MS Pharm s.r.o.
Dělnická 213/12, 170 00 Prague 7, Czech Republic
Company ID: 04489918 | EU VAT: CZ04489918
E-mail: [email protected] | Web: www.mspharm.eu
Last updated: 16 September 2026
1. Data Controller
The controller of your personal data is MS Pharm s.r.o., with its registered office at Dělnická 213/12, 170 00 Prague 7, Czech Republic, Company ID: 04489918 (hereinafter: “MS Pharm”, “we”, “us”).
The person responsible for personal data matters within MS Pharm is Maciej Szewczyk. If you have any questions regarding the processing of your personal data, or wish to exercise any of your rights described below, you can contact us at [email protected] or in writing at the registered office address above.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. Purposes and Legal Bases for Processing Personal Data
We process personal data for the following purposes:
a) Responding to contact form inquiries
Data processed: name and surname, e-mail address, phone number, message content.
Legal basis: Article 6(1)(b) GDPR – processing is necessary to take steps at the request of the data subject prior to entering into a contract; and/or Article 6(1)(a) GDPR – the data subject’s consent, expressed by ticking the checkbox when submitting the form.
How the data is transmitted: Messages submitted through the contact form are delivered to our mailboxes via an external outbound mail (SMTP) provider. The submitted data is not permanently stored in the website’s database.
Retention period: Data will be retained for the duration of the correspondence and for up to 24 months thereafter. Where processing is based on your consent, the data will be deleted earlier if you withdraw it.
b) Performance of contracts and delivery of services
Data processed: business contact data of representatives and employees of client companies (name, surname, business e-mail, phone number, job title).
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party, or to take steps prior to entering into a contract.
Retention period: For the duration of the contract and for 5 years after its termination, in line with applicable legal obligations.
c) Compliance with legal obligations
Legal basis: Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject, such as accounting and tax obligations.
Retention period: As required by applicable law, for example 5 or 10 years for accounting documentation under Czech law.
d) Website analytics and measurement of traffic
Data processed: IP address (truncated), device and browser information, pages viewed, source of visit, interactions with the website.
Legal basis: Article 6(1)(a) GDPR – your consent, granted through the cookie consent banner. Analytics cookies are not activated before consent is given.
Retention period: Up to 14 months in the analytics tool, in accordance with its data retention settings.
e) Legitimate interests of the controller
For example: direct marketing addressed to existing clients, security of the website and IT infrastructure, and establishment or defence of legal claims.
Legal basis: Article 6(1)(f) GDPR.
Retention period: Until a valid objection is raised or the purpose is no longer applicable.
3. Recipients of Personal Data
Your personal data may be shared with third parties who provide services to us, in particular IT and web hosting providers, content delivery and website security providers, e-mail and communication service providers, analytics providers, and accounting and legal advisors. These entities process the data only on our instructions and to the extent necessary to provide their services. Personal data may also be disclosed to public authorities where required by law. We do not sell your personal data to third parties.
Some of our service providers are established outside the European Economic Area. In such cases, transfers take place on the basis of the European Commission’s adequacy decisions, including the EU–U.S. Data Privacy Framework, or on the basis of Standard Contractual Clauses adopted under Article 46(2)(c) GDPR. You may request further information on these safeguards by contacting us at [email protected].
4. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
Right of access (Art. 15 GDPR) – to obtain confirmation as to whether we process your data and to receive a copy of that data.
Right to rectification (Art. 16 GDPR) – to request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR) – to request deletion of your data in certain circumstances.
Right to restriction of processing (Art. 18 GDPR) – to request that we restrict the processing of your data in certain circumstances.
Right to data portability (Art. 20 GDPR) – where processing is based on consent or contract and carried out by automated means.
Right to object (Art. 21 GDPR) – to object to processing based on legitimate interests, including profiling.
Right to withdraw consent (Art. 7(3) GDPR) – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Consent for cookies can be withdrawn at any time through the cookie settings available on our website.
To exercise any of these rights, please contact us at [email protected].
You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic, the competent authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů – ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
5. Cookies and Website Analytics
Our website uses cookies and similar technologies. When you first visit the website, a consent banner allows you to accept or reject non-essential cookies. Your choice can be changed at any time through the cookie settings available on our website.
Strictly necessary cookies – required for the website to function correctly, including session handling, security and protection against malicious traffic. These cookies do not require consent.
Analytics cookies – used to measure website traffic and understand how visitors use our website. We use Google Analytics 4, implemented through Google Tag Manager. These cookies are activated only after you give your consent, and IP addresses are processed in truncated form.
Detailed information about the individual cookies used on this website is available in our Cookie Policy.
This website is also available under the alias domains mspharm.cz and mspharm.pl, which redirect to www.mspharm.eu. The same cookie and privacy rules apply to all of them.
6. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, in accordance with Article 32 GDPR. These include encrypted transmission of all website traffic (TLS/HTTPS), access control to administrative systems, and regular backups of the website and its database.
7. Automated Decision-Making and Profiling
We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. The analytics tools described in section 5 are used for statistical purposes only and are not used to make decisions about individual visitors.
8. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy. Any changes will be published on this website with an updated “Last updated” date. We encourage you to review this policy periodically.
This Privacy Policy was prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
