Privacy Policy

Controller: Česká zbrojovka a.s., Company ID No. 46345965, with its registered office at Svatopluka Čecha 1283, 688 01 Uherský Brod, Czech Republic, registered in the Commercial Register maintained by the Regional Court in Brno, File No. B 712 (“CZ”, “we” or “us”).

1. Scope

1.1 This Privacy Policy applies exclusively to the processing of personal data of members of the CZ CLUB customer club and, to the extent of Article 8 (cookies), also of visitors, in connection with the platform available at https://club.czfirearms.com/en (the “Platform”).

1.2 Termination of membership. Processing data about your account and membership is necessary to provide CZ CLUB benefits. You can end your membership at any time by cancelling your account. If you cancel your account or request erasure of this data, your membership ends and we can no longer provide you with CZ CLUB benefits. Withdrawing your consent to receiving the newsletter or to cookies does not affect your membership.

2. Overview of processing

2.1 The following table sets out the purposes of processing, the legal basis under Article 6(1) of Regulation (EU) 2016/679 (GDPR), the retention period and whether you are required to provide the data.

Purpose	Categories of data	Legal basis	Retention period	Source	Obligation to provide and consequences of not providing
Account registration and management	Phone number, first name and surname, email address, date of birth (age verification), country, language, account settings, verification codes and login records	Art. 6(1)(b) – performance of a contract	For the duration of the account; erasure within 30 days of account cancellation	You	Necessary to conclude the contract; without it, the account cannot be created
Product registration and management of warranty claims, including the Lifetime Barrel Warranty	Product model, serial number, date and place of purchase, proof of purchase and the data contained in it	Art. 6(1)(b) – performance of a contract and of the warranty obligation	For as long as the product is registered in the account; data needed for warranties for the duration of the warranty, erasure within 30 days of the end of the warranty	You; the dealer, if we verify the proof of purchase; authorised service centres	Registration is voluntary; without it, the extended warranty cannot be claimed.
Keeping a shooting log	Entries you make in the log (e.g. date, place, product, ammunition, number of rounds fired, notes)	Art. 6(1)(b) – performance of a contract	For the duration of the account; erasure within 30 days of account cancellation	You	Voluntary; without entries, the log cannot be kept
Customer support	Contact details, content of the enquiry, communications, account data needed to handle it	Art. 6(1)(b) – contract-related enquiries; Art. 6(1)(f) – other enquiries	5 years from closure of the enquiry	You	Voluntary; without contact details, we cannot respond
Sending service and safety information about products (e.g. safety notices, recalls, important updates)	Name, email address, registered products	Art. 6(1)(c) – where the law requires us to inform owners (in particular Article 35 of Regulation (EU) 2023/988 on general product safety); otherwise Art. 6(1)(f) – legitimate interest	For as long as the product is registered in the account	Our records	Not mandatory; if you object, you may miss important safety information
Security and abuse prevention	IP address, device and browser data, login logs, security events, records of suspected fraudulent warranty claims	Art. 6(1)(f) – legitimate interest	12 months; data on security incidents until they are resolved	Your device (automatically); our systems	Technically necessary; without it, the Platform cannot be used
Compliance with legal obligations	Data required by accounting, tax and consumer protection laws; data requested by public authorities	Art. 6(1)(c) – legal obligation	For the period required by law (e.g. accounting records at least 5 years, tax documents up to 10 years)	Our records	Required by law
Establishment and defence of legal claims; proof of the concluded contract	Data relating to the claim; the accepted version of the terms and the time of acceptance	Art. 6(1)(f) – legitimate interest	Limitation period (usually 3 years)	Our records	Not applicable
Handling of enquiries, claims for defects and warranty claims of US customers by CZ-USA	Contact details, account data, registered products including serial number, proofs of purchase, content of enquiries, claims for defects and warranty claims, communications with customer support	Art. 6(1)(b) – performance of a contract and of the warranty obligation; for other enquiries Art. 6(1)(f) – legitimate interest in having them handled by the seller on the US market	For the duration of the warranty and 4 years after its end or after the claim has been settled; enquiries 3 years from closure	You; our records on the Platform	Voluntary; without it, the enquiry, claim for defects or warranty claim cannot be handled
Newsletter and commercial communications	Name, email address, preferences, open and click-through data (only with your consent)	Art. 6(1)(a) – consent (Section 7(2) of Czech Act No. 480/2004 Coll., on Certain Information Society Services)	Until consent is withdrawn; proof of consent 3 years after withdrawal	You	Voluntary; without consent, you will not receive newsletters
Analytics and marketing	Pseudonymous identifiers, IP address, device and browser data, pages visited, events and behaviour on the Platform	Art. 6(1)(a) – consent given separately for each category of cookies (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications)	According to the cookie list (Article 8.3); data in the analytics tool 14 months	Your device	Voluntary; no consequences

1. Legitimate interests and your right to object

1.1 Where we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), the specific interests are as follows:

▶ Customer support (enquiries not related to the contract): handling your enquiries and keeping records of them.

▶ Service and safety information: protecting the safety of product users and other persons and informing owners about safety notices and recalls.

▶ Security and abuse prevention: protecting the Platform and accounts against attacks and account takeover and preventing fraudulent warranty claims.

▶ Legal claims and proof of contract: establishment, exercise and defence of our legal claims and proof of the content of the contract.

1.2 Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). Send your objection through the Support section on the Platform or by email to info@czub.cz. We will stop the processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

1.3 Direct marketing. Where we process your data for direct marketing purposes, you may object at any time and without giving reasons through the Support section on the Platform or by email to info@czub.cz; we will then no longer process it for that purpose.

2. Serial numbers and firearm ownership data

2.1 Limited range of recipients. Only authorised CZ staff in the areas of warranties, servicing and customer support have access to the serial number, and only to the extent necessary. It is also accessible to the technical operator as our processor, to CZ-USA to the extent set out in Article 5.4, to the authorised service centre handling your specific claim and to public authorities where we are required by law to provide it to them.

2.2 Security measures. We protect the data in particular through role-based access control and other appropriate technical and organisational measures.

2.3 No marketing use. We do not sell serial numbers or pass them on to third parties for marketing purposes.

3. Recipients and data transfers

3.1 Processors. We use the following categories of processors, who may process your data only on our instructions and on the basis of a contract under Art. 28 GDPR. We will disclose the identity of processors not listed in the table below upon request at info@czub.cz:

Role	Provider	Place of processing and safeguard for transfers outside the EEA
Technical operator of the Platform	Moravio s.r.o., Company ID No. 29265266, with its registered office at Kukučínova 799/10, Hulváky, 709 00 Ostrava, Czech Republic	Czech Republic
Sending SMS verification codes	Twilio Ireland Limited, 25–28 North Wall Quay, Dublin 1, Ireland	Ireland; data may also be processed by Twilio group companies in the USA and other countries on the basis of Twilio’s binding corporate rules approved by supervisory authorities (Art. 47 GDPR), the Commission adequacy decision (EU–US Data Privacy Framework; Twilio Inc. is certified) and standard contractual clauses
Sending emails and the newsletter	SFDC Ireland Limited, 3rd and 4th Floor 1 Central Park, Leopardstown, Dublin 18, Ireland	Ireland and the EEA (Salesforce data centre in the EU); data may also be processed by Salesforce group companies outside the EEA, in particular in the USA, on the basis of Salesforce’s binding corporate rules for processors approved by supervisory authorities (Art. 47 GDPR), the Commission adequacy decision (EU–US Data Privacy Framework; Salesforce, Inc. is certified) and standard contractual clauses.
Analytics tools	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics service)	Ireland; data may also be processed by Google LLC in the USA on the basis of the Commission adequacy decision (EU–US Data Privacy Framework; Google LLC is certified), and alternatively on the basis of standard contractual clauses

1.1 Other recipients. Depending on the purpose, recipients of your data may also include: authorised service centres and dealers (handling of claims, verification of proof of purchase); carriers (transport of products for repair); our legal and tax advisers and auditors bound by confidentiality; public authorities where required by law; and, in the event of a transfer of our business, its acquirer.

1.2 Group companies. We may, to the extent necessary, make your data available to companies within the Colt CZ Group SE group, with its registered office at náměstí Republiky 2090/3a, 110 00 Prague 1, Czech Republic, listed at https://www.coltczgroup.com/en/brands-companies, in particular for the purposes of handling warranty claims, product servicing and customer support. Unless otherwise stated in Article 5.4, group companies process your data as our processors, only on our instructions and on the basis of a data processing agreement under Art. 28 GDPR. Some group companies are established outside the European Economic Area (e.g. in the USA); Article 5.5 applies to transfers of data to those companies.

1.3 US customers. Our products are sold in the United States of America by our sister company CZ-USA, with its registered office at 3327 N 7th Street Trfwy, Kansas City, KS 66115, USA, a member of the Colt CZ Group SE group. If you are resident in the USA or purchased a product in the USA, CZ-USA handles your enquiries sent through the Platform and your claims for defects and warranty claims made under the warranty terms, and informs you about safety notices and recalls. For that purpose, it has access only to the data it needs, i.e. your contact details, account data, registered products including serial numbers, proofs of purchase and your communications with customer support. When handling claims for defects and warranty claims, CZ-USA is a joint controller with us under Art. 26 GDPR. When handling other enquiries and providing information about safety notices and recalls, CZ-USA acts as our processor, only on our instructions. Under the arrangement between the joint controllers, we are responsible for operating and protecting the Platform and for providing information under this Privacy Policy, and CZ-USA is responsible for handling your claims for defects and warranty claims. You may exercise your rights with either of us; the easiest way is to write to info@czub.cz and we will coordinate the response. We will provide you with the essence of the arrangement upon request. Data of CZ CLUB members from other countries is not made available to CZ-USA.

Making your data available to CZ-USA constitutes a transfer of personal data to a third country. It takes place on the basis of standard contractual clauses adopted by the European Commission. You can request a copy of the standard contractual clauses through the Support section on the Platform or by email to info@czub.cz.

1.4 Transfers outside the EEA. We transfer data outside the European Economic Area only on the basis of a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on the basis of standard contractual clauses adopted by the Commission, together with supplementary measures where necessary.

The list of recipients certified under the EU–US Data Privacy Framework is available at www.dataprivacyframework.gov. We will provide you with a copy of the standard contractual clauses upon request at info@czub.cz.

2. Automated decision-making and profiling

2.1 We do not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.

2.2 We tailor the content of the newsletter to the types of products you have registered and to your preferences (profiling). We do so only on the basis of your consent to receiving the newsletter. You can withdraw your consent at any time and object to this profiling at any time (Article 3.3).

3. Your rights

3.1 Under the GDPR, you have the following rights:

▶ Access (Art. 15): to know whether we process your data and to obtain a copy of it.

▶ Rectification (Art. 16): to request rectification of inaccurate data and completion of incomplete data.

▶ Erasure (Art. 17): to request erasure of data, for example if it is no longer needed or you withdraw your consent, unless we are required by law to retain it.

▶ Restriction of processing (Art. 18): to request restriction of processing, for example while the accuracy of the data is being verified.

▶ Portability (Art. 20): to receive the data you provided to us on the basis of a contract or consent in a machine-readable format, or to request its transmission to another controller.

▶ Objection (Art. 21): to object to processing based on legitimate interest (Article 3).

▶ Not to be subject to automated decisions (Art. 22): see Article 6.

▶ Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before the withdrawal.

3.2 How to exercise your rights. Write to us at info@czub.cz or to our registered office address.

3.3 Complaint. You have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz/en, or with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement.

3.4 Identity verification and excessive requests. To protect your data, we may reasonably verify your identity before handling a request, usually by logging into your account or through a code sent to your phone number. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on the request (Art. 12(5) and (6) GDPR).

4. Cookies and similar technologies

4.1 Legal basis. We use strictly necessary cookies without your consent because the Platform cannot function without them (Section 89(3) of the Czech Electronic Communications Act). We use all other cookies only with your prior consent; the related processing of personal data is based on Art. 6(1)(a) GDPR.

4.2 Categories.

▶ Strictly necessary: ensure login, security and storage of your cookie choices.

▶ Functional: remember your settings. We use the cookie storing the language you have actively selected only to provide this function; other functional cookies only with your consent. We load embedded third-party content, such as videos or maps, only after you consent.

▶ Analytics: help us understand how the Platform is used. Our analytics tools process pseudonymous identifiers and your IP address. The data is therefore not anonymous.

▶ Marketing: allow us to measure campaigns and show you relevant advertising on other websites. They are set by us or by the third parties listed in the cookie list (Article 8.3).

4.3 The cookie list and cookie settings can be found in the footer of the website https://club.czfirearms.com/en.

4.4 Browser settings. You can also manage cookies in your browser.

5. Security

5.1 We protect your data with appropriate technical and organisational measures, including access control, encryption, backups, security monitoring and staff training. We require the same of our processors.

5.2 If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you of it without undue delay.

6. Changes to this Privacy Policy

6.1 Language versions. This Privacy Policy is issued in Czech and English. In the event of any discrepancy, the language version in which you concluded the contract prevails.

6.2 We update this Privacy Policy when our processing operations or the applicable law change.

6.3 Previous versions are available on request at info@czub.cz.

6.4 Effective date. This Privacy Policy takes effect on 7 October 2026.

7. Additional information for US residents

7.1 Scope. This Article supplements this Privacy Policy for users resident in US states whose consumer privacy laws apply to us (e.g. the California Consumer Privacy Act). For those users, this Article prevails in the event of any conflict.

7.2 Data processed. The categories of personal data we process, their sources, purposes and retention periods are set out in Article 2, and the recipients to whom we disclose them in Article 5. We do not use sensitive personal information to infer characteristics about you.

7.3 Sale and sharing. We do not sell personal information. We use marketing cookies, which may be considered sharing of data for targeted advertising purposes, only with your consent, which you can withdraw at any time in the cookie settings (Article 8); we also honour the Global Privacy Control signal. The Platform is intended for persons aged 18 or over.

7.4 Your rights. To the extent provided by the laws of your state, you have the right to access, correct, delete and port your data, the right to opt out of sale, sharing and targeted advertising, and the right not to be discriminated against for exercising your rights. You can exercise your rights under Article 7.2, we will verify your request under Article 7.4, and an authorised agent may also act on your behalf. If we decline your request, you may appeal to info@czub.cz and then contact the Attorney General of your state.

Effective from October 15, 2026