Privacy Policy

Last updated: 10 November 2026

This Privacy Policy explains how Universal Scientific Technologies s.r.o. (“UST”, “we”, “us”) processes personal data under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.

It applies to:

  • visitors of our website ust.cz,
  • contact persons of our customers, suppliers, distributors and other business partners,
  • anyone who contacts us by e-mail, phone or other means.

1. Controller

Universal Scientific Technologies s.r.o.
U Jatek 19
392 01 Soběslav
CZECH REPUBLIC

Company ID: 28155319
VAT No.: CZ28155319
Registered in the Commercial Register kept by the Regional Court
in České Budějovice, Section C, Insert 20687

For any question about personal data, contact us at info@ust.cz or by post at the address above.

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy matters are handled directly by the company management through the contact details above.

2.1 Business communication and contracts

Data Purpose Legal basis
Name, job title, company, business e-mail, phone, postal address, content of correspondence Responding to enquiries, preparing quotations Steps prior to entering into a contract (Art. 6(1)(b) GDPR); legitimate interest in communicating with business partners (Art. 6(1)(f) GDPR)
The above plus order, delivery, invoicing and payment details Performance of contracts, delivery of products and services, technical support, warranty and service Performance of a contract (Art. 6(1)(b) GDPR); legitimate interest where the contract is concluded with the organisation the person represents (Art. 6(1)(f) GDPR)
Invoices and accounting records containing personal data Compliance with accounting and tax obligations Legal obligation (Art. 6(1)(c) GDPR)
Data relevant to a dispute Establishment, exercise or defence of legal claims Legitimate interest (Art. 6(1)(f) GDPR)

When you act on behalf of an organisation, we may receive your business contact details from your colleagues, from your employer or from public sources such as company websites and public registers.

2.2 Website visitors

Server logs. When you visit our website, the web server automatically records technical data: IP address, date and time of access, requested page, referring page, and browser and operating system identification. We use this data to deliver the website and to keep it secure and running (legitimate interest, Art. 6(1)(f) GDPR). Logs are not used to identify visitors.

Google Analytics. Our website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and similar technologies to collect information about how visitors use the website, such as pages visited, time spent, approximate location (country/city), device and browser type, and referring website. We use this information in aggregated form to understand the use of the website and to improve it. Google Analytics is loaded and its cookies are set only if you give your consent in the cookie banner (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll.). Without consent, no data is sent to Google Analytics. Google Analytics 4 does not store full IP addresses. Data may be transferred to Google LLC in the USA (see section 4). More information: Google Privacy Policy and How Google uses information from sites that use its services.

You can withdraw or change your consent at any time via the Cookie settings link at the bottom of every page. When you withdraw consent, analytics stops and the Google Analytics cookies are deleted. Your choice (consent or refusal) is stored in your browser’s local storage for 12 months, after which we ask again. This record is strictly necessary to respect your choice.

Third-party content. To display the website, your browser loads some content directly from third-party servers. Those providers necessarily receive your IP address and browser information:

  • Font icons are loaded from the jsDelivr CDN.
  • The map on our About page is loaded from OpenStreetMap tile servers, operated by the OpenStreetMap Foundation (privacy policy).

External links. Our website links to our profiles on GitHub, Facebook and LinkedIn and to other external websites. Once you follow such a link, the privacy policy of the respective operator applies.

We do not use the website to make automated decisions about you or to create profiles for advertising.

2.3 Data processed in our products and on behalf of customers

Our instruments primarily record physical measurement data (e.g. radiation, meteorological or positional data) that normally does not relate to identifiable persons. Where we process personal data on behalf of a customer, for example during servicing, data evaluation or hosting of measured data, we do so as a processor according to the customer’s instructions and a data processing agreement under Article 28 GDPR. In that case, the customer is the controller and its privacy notice applies.

Personal data that customers provide to us, or that we otherwise receive or handle on their behalf, is used only for the purposes agreed with the customer and in accordance with all data protection obligations under our contract with that customer.

2.4 Use of artificial intelligence

To support our internal work, we use AI-based tools provided by Anthropic PBC (USA). We use them in compliance with the GDPR and Regulation (EU) 2024/1689 (Artificial Intelligence Act). We do not enter personal data or confidential information of our customers and business partners into AI services unless this is permitted by the respective contract and the service provides adequate data protection guarantees. We do not use AI for automated decision-making about individuals.

3. Recipients of personal data

We do not sell personal data. We disclose it only to the extent necessary to:

  • IT infrastructure providers: our web and e-mail servers are operated on virtual servers provided by vpsFree.cz (Prague, Czech Republic); this data stays in the EU,
  • providers of AI-based tools: Anthropic PBC (USA), see section 2.4,
  • analytics and content delivery providers named in section 2.2 (Google, jsDelivr, OpenStreetMap Foundation),
  • carriers and couriers, for the delivery of products,
  • banks and payment service providers, for processing payments,
  • accountants, tax advisors, auditors and legal advisors, who are bound by confidentiality,
  • public authorities, where required by law (e.g. tax or customs authorities, courts).

Our processors process personal data only according to our instructions and under contractual terms required by Article 28 GDPR.

4. Transfers outside the EU/EEA

We store and process personal data primarily in the Czech Republic. Personal data may be transferred to third countries only when a third-party service described above is used, in particular to Google LLC and Anthropic PBC in the USA. Such transfers are based on the European Commission adequacy decision for the EU–US Data Privacy Framework, where the recipient is certified under it, or on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

5. How long we keep personal data

  • Enquiries and correspondence not leading to a contract: up to 3 years from the last communication.
  • Contract-related data: for the duration of the contractual relationship and then for the limitation period for possible claims, usually 3 years and in some cases up to 10 years.
  • Invoices and accounting records: 10 years from the end of the tax period in which the transaction took place, as required by Czech tax and accounting laws.
  • Server logs: 30 days.
  • Google Analytics data: 14 months.

After these periods, we delete or anonymise the data.

6. Security of personal data

We apply administrative, technical and physical safeguards appropriate to the risk to protect the confidentiality, integrity and availability of personal data and to prevent unauthorised access, use or disclosure. These include in particular access control limited to authorised staff, encrypted connections (HTTPS/TLS) for our website and e-mail, regular updates of our systems, and backups. Our employees and contractors are bound by confidentiality.

Our information security practices are guided by international best practice, in particular the ISO/IEC 27000 family of standards.

The same safeguards apply to other sensitive information entrusted to us by customers and business partners, such as intellectual property, technical documentation and non-public business data. When personal data or such information is no longer needed, we delete or securely dispose of it.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Czech Office for Personal Data Protection within 72 hours of becoming aware of it and, where required, inform you without undue delay (Art. 33 and 34 GDPR). Any security incident affecting personal data or confidential information of a customer is reported to that customer immediately, in accordance with our contract with them.

7. Your rights

Under the GDPR, you have the right to:

  • access your personal data and obtain a copy (Art. 15),
  • rectification of inaccurate or incomplete data (Art. 16),
  • erasure (“right to be forgotten”) (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interest, including direct marketing, at any time (Art. 21),
  • withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise your rights, contact us at info@ust.cz. We will respond without undue delay and in any event within one month; this period may be extended by two further months where necessary (Art. 12(3) GDPR). We may ask you to verify your identity. Exercising your rights is free of charge.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

8. Is providing personal data mandatory?

Providing personal data is not a statutory requirement. However, without contact and invoicing details, we cannot respond to your enquiry, conclude or perform a contract, or meet our legal obligations.

9. Automated decision-making

We do not use automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

10. Changes to this Privacy Policy

We may update this Privacy Policy, for example when our services or legal requirements change. The current version is always available at this address, and the date of the last update is shown at the top of the page.