Privacy policy
Document version: 2026-10-15. The current version is always available on the Website.
How we process the data of people who use the casali-energy.com website: open an account, send enquiries, place orders or write to us.
1. Controller
The data controller is c.a.s.a.l.i. s.r.o., Teslova 1129/2b, Přívoz, 702 00 Ostrava, Czech Republic, Company ID (IČO) 14044811, entered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 92735. For data protection matters write to info@casali-energy.com.
2. Whose data we process
The Website is intended for companies. We process the data of people who, on behalf of a company, open an account, send an enquiry, place an order or correspond with us (contact persons, business owners, purchasing staff). If you give us the data of another person in your company (e.g. the person receiving a delivery), please pass this policy on to them.
3. What data, why and on what basis
| Process | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Company account | e-mail, password (stored only as a cryptographic hash), first and last name, phone, company name, VAT number, address, date of account creation and confirmation, enquiry and order history | running the account, login, order history | Art. 6(1)(b) — account contract |
| Quotation enquiry | company name, VAT number, contact person, phone, e-mail, delivery postcode and country, message, list of products and quantities | preparing an offer including transport, replying | Art. 6(1)(b) — steps prior to entering into a contract |
| Order | company and contact person details, VAT number, Buyer’s PO number, delivery and invoice address, notes, order items, documents (offer, proforma, invoice, payment confirmation), messages concerning the order | performance of the sales contract, delivery, settlement | Art. 6(1)(b) — contract; Art. 6(1)(c) — tax and accounting obligations |
| E-mail correspondence | address, content, attachments | replying, handling the matter | Art. 6(1)(f) — our legitimate interest: communication with customers and prospects |
| Commercial information (newsletter) | e-mail, language, which messages you open and click | sending information on products, prices and availability | Art. 6(1)(a) — consent ticked at registration; may be withdrawn at any time via the link in the message or by e-mail |
| Visit measurement (PostHog and Google Analytics) | PostHog: identifier computed on our server (an irreversible hash of the IP address, the browser name and a key that changes every day), pages visited, language, referring page, campaign parameters in the address (utm); after login the identifier is the e-mail address of the account. Google Analytics 4: identifier from the _ga cookies in your browser, pages visited, language, referring page, browser and device information, approximate location derived from the anonymised IP address | visit statistics, improving the Website, evaluating our mailings | Art. 6(1)(a) — consent given in the consent box on your first visit, separately for each tool; it may be withdrawn at any time via the “Cookie settings” link in the footer |
| Server logs | IP address, date and time, requested page, browser | security, abuse detection, troubleshooting | Art. 6(1)(f) — our legitimate interest |
| Establishing and defending claims | data from the processes above | establishing, exercising or defending legal claims | Art. 6(1)(f) |
Without your consent we do not measure visits: your browser does not connect to any external tool, and our server sends no measurement data. After consent to PostHog, measurement is performed server-side: nothing is stored on your device for statistics, and your IP address is neither stored nor passed to the measurement tool. The key from which we compute the identifier changes every day and the previous one is deleted, so visits are linked within one day, not across days. Campaign parameters from the address are kept on the server for one day at most, under the same hash — not in a file in your browser. The data goes to PostHog on servers in the European Union. After consent to Google Analytics, the page loads the Google script, which sets the _ga cookies in your browser and sends data to Google; the IP address is anonymised and Google’s advertising features are permanently switched off. You can withdraw consent at any time via the “Cookie settings” link in the footer: our server then stops sending events to PostHog, the Google script is not loaded, and the _ga cookies are deleted. Details: Cookie notice.
4. Accounts migrated from the previous version of the shop
If you had an account in the previous version of our shop (casali-energy.com), your account data and order history have been transferred to this Website to keep your service uninterrupted. Passwords are stored only as cryptographic hashes; at first login we may ask you to set a new password.
5. Where the data comes from
You provide the data yourself through the Website’s forms or in correspondence. We may additionally verify company data (name, address, VAT number) in public registers (e.g. VIES, business registers) to confirm business status and the correctness of invoices.
6. Recipients
We pass data only to entities needed for the purposes above and only to the extent necessary:
- the provider hosting our server and e-mail service (servers in the European Union),
- the service used to send commercial information (servers in the European Union) — only if you have consented to the newsletter,
- PostHog — the visit measurement service (servers in the European Union) — only if you have consented to PostHog,
- Google — Google Analytics — only if you have consented to Google Analytics; Google may also process this data in the United States: Google LLC is certified under the EU–US Data Privacy Framework (adequacy decision), and where that framework does not apply Google relies on standard contractual clauses,
- carriers and freight forwarders — consignee details and delivery address, for pricing and performing transport,
- manufacturers and their service centres — in warranty claims, to the extent needed to handle the claim,
- accounting office, bank, legal advisers — for settlements and claims,
- public authorities — where required by law.
Entities processing data on our behalf act under data processing agreements. Apart from Google Analytics (only with your consent, as described above), data is not transferred outside the European Economic Area; should this become necessary in the future, it will take place on the basis of an adequacy decision or standard contractual clauses (Art. 45–46 GDPR). We do not sell data.
7. Retention
- account: until deleted at your request, then until the limitation periods for claims expire;
- enquiries and correspondence without an order: up to 3 years from the last contact;
- orders, invoices and accounting documents: for the period required by tax and accounting law, up to 10 years from the end of the year in which the document was issued;
- newsletter consent: until withdrawn; we keep a record of the consent and its withdrawal for evidence purposes;
- visit measurement data: up to 24 months; the
_gacookies in your browser: up to 2 years, and deleted immediately when you withdraw consent; - server logs: up to 90 days, longer only while investigating a security incident.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise your rights write to info@casali-energy.com. You also have the right to lodge a complaint with a supervisory authority: in the Czech Republic this is the Úřad pro ochranu osobních údajů (Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz); you may also contact the authority in your own country of residence.
9. Voluntary provision of data
Providing data is voluntary, but without the data marked as required we cannot open an account, prepare a quotation or fulfil an order. Newsletter consent is independent of using the Website.
10. Automated decisions
We do not take decisions based solely on automated processing, including profiling, that would produce legal effects for you. Prices on the Website depend on the product and the quantity, not on who you are.
11. Security
The connection to the Website is encrypted (TLS). Passwords are stored only as cryptographic hashes. Only people who need it to handle your matter have access to the data.
12. Cookies
The Website uses cookies necessary for its operation (session, cart, the currency you chose, your saved choice from the consent box) and — only with your consent — Google Analytics cookies. Details and withdrawal of consent: Cookie notice.
13. Changes
We update this policy when the scope of the Website’s services or the law changes. The current version is always available on the Website, with the version date at the top of the page.