Introductory provisions

This document sets out the terms of use of the website catalogues123.co.za and of the Kaufino mobile application for the Android and iOS systems (hereinafter jointly the "service") and the privacy policy within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the "GDPR").

The operator of the service is:

• Company name: Business Animals s.r.o.
• Registered office: Na Poříčí 1067/25, Nové Město, 110 00 Praha 1, Czech Republic
• Company ID (IČ): 02734699
• VAT ID (DIČ): CZ02734699
• Contact e-mail: info[at]vimvic.cz

The Kaufino mobile application is operated uniformly in all countries and its publisher, and the controller of the personal data processed in the application, including account data and participation in competitions, is:

• Company name: Adsalva s.r.o.
• Registered office: Na Poříčí 1067/25, Nové Město, 110 00 Praha 1, Czech Republic
• Company ID (IČ): 03786986
• VAT ID (DIČ): CZ03786986

Where the operator of the website is a company other than the publisher of the application, both process personal data independently, each for its own purposes set out below.

The service provides information on discounts, promotional offers and leaflets of supermarkets, smaller shops and other retailers. Both the website and the application may be used without registration and without entering any contact details. Registration is entirely voluntary and makes supplementary features available (an account, favourite shops across devices, participation in competitions).

The operator may engage further processors to process personal data where this is necessary to ensure the operation of the service.

Terms of use

1. Description of the service

The service provides an overview of leaflets, promotions and offers of third parties. The operator is not the seller of the goods displayed, does not conclude purchase contracts and is not liable for the accuracy, availability or validity of the offers of individual shops.

2. Rights and obligations of users

The user undertakes to use the service in accordance with legal regulations and not to interfere with its operation. The user is responsible for the accuracy of the data they enter themselves, in particular the e-mail address.

3. Account in the mobile application

1. An account is created by verifying an e-mail address with a numeric code which the operator sends to the address entered. The code is valid for 10 minutes and may be entered no more than five times.
2. The account is not tied to a password. The device maintains the sign-in by means of a login token valid for 180 days, which is extended by use. No more than 10 devices may be active at the same time.
3. One e-mail address corresponds to one identity. The same identity serves both the account and participation in competitions.
4. The account may be cancelled at any time directly in the application or on the page catalogues123.co.zaaccount-deletion. The procedure and the scope of the erasure are identical in both cases and are described below.

4. Rights and obligations of the operator

The operator reserves the right to modify the scope and form of the service at any time, to limit its availability or to discontinue it. The operator is entitled to disable an account that is being misused.

5. Protection of copyright

The content of the service, including logos and images of leaflets, is protected by copyright and by the rights of third parties. Use going beyond ordinary browsing requires the consent of the entitled person.

6. Liability for damage

The operator is not liable for damage arising from the use of the service, in particular for acts taken in reliance on a third party's offer.

7. Changes to the terms

The operator is entitled to amend this document. The current wording is always available in the service.

Protection of personal data (Privacy Policy)

1. What data are processed?

On the website:

• Technical data: IP address, cookies and device data.
• Location data: approximate location based on the IP address or the user's choice of city.
• Voluntarily provided data: e-mail address.

In the mobile application:

• Account data: e-mail address, the time of its verification, the time the account was created, the selected country and language, the list of favourite shops linked to the account.
• Marketing consent: whether it was granted, the time it was granted, the time of any withdrawal and the identification of the version of the text under which it was granted. A record is kept of both the granting and the withdrawal.
• Verification data: e-mail address, the hash of the verification code, the installation identifier and the IP address from which the code was requested. They serve for verification and for limiting the number of attempts. The code itself is not stored, only its one-way hash is stored.
• Device data for notifications: anonymous installation identifier, the registration token of the Firebase Cloud Messaging service, platform, application version, language, country, the list of favourite shops and information on whether notifications are enabled. The installation identifier is not derived from any device identifier and ceases to exist when the application is uninstalled or its data are deleted.
• Application usage data: the shops and leaflets displayed, the leaflet pages browsed, switching between sections, the opening of a notification, the result of a request for system permissions and the text entered into the search. These data are processed only where consent has been granted (see point 3).
• Technical crash data: the type of error, the state of the application at the moment of the crash and the technical parameters of the device. Only where consent has been granted.
• Location: on first launch the application may request access to location solely in order to pre-fill the country. Only the country code is derived from the location; the coordinates are neither transmitted nor stored. The permission may be refused and the country selected manually.
• Feedback: a rating and free text, if the user submits them. It is linked to the installation identifier, not to the account.
• Interface operational logs: IP address, identification of the application and the parameters of the call. E-mail addresses, codes and tokens are masked in the logs.

On the iOS system, the application requests the App Tracking Transparency permission. It processes the device advertising identifier only if the user allows the request; otherwise, it displays only non-personalised ads.

2. Purposes of processing

• Operation of the service: displaying content according to the selected country and language, maintaining the account, synchronising favourite shops between devices.
• Notifications: sending notifications to the device about new leaflets (primarily from favourite shops, but also from other shops in the user's country), about competitions in the application and about other news of the service, according to favourite shops, country and language, usually several times a day. Notifications can be switched off at any time in the device settings (also reachable from the “More” section of the application); on Android, individual types of notifications can also be switched off separately (e.g. “Prizes”).
• Competitions: recording participation and handing over any prize.
• Security: verification of the e-mail address and limitation of the misuse of verification codes.
• Analytics: measuring the use of the service and improving its features.
• Error reporting: detecting and removing crashes of the application.
• Advertising: displaying advertising messages, and where consent is given also personalised ones.
• Measurement of advertising campaigns: evaluation of application installations and of selected actions within it.
• Marketing communications: sending leaflets, promotions and offers by e-mail, only on the basis of separate consent.

3. Legal basis and consent

• Performance of a contract / operation of the service: maintaining the account, favourite shops, sending notifications under point 2 and participation in a competition.
• Legitimate interest: technically necessary cookies, interface operational logs, protection against the misuse of verification codes.
• Consent: analytics, crash reporting, personalised advertising and the sending of marketing communications by e-mail.

In the European Economic Area and in the United Kingdom, before commencing analytics, crash reporting and the display of advertising, the application displays a consent request by means of the Google User Messaging Platform tool. These tools are not launched until consent has been granted. The decision may be changed at any time in the "More" section of the application.

Outside these territories the consent request is not displayed and the tools referred to are active from the launch of the application. The user may restrict them in the settings of their device, in particular by limiting the advertising identifier and refusing the permission to send notifications.

More information about interest-based advertising and the options to opt out of it is available at www.youronlinechoices.eu.

An exception is the measurement of application installations for advertising campaigns (Meta). This is launched already on the first launch of the application, that is, before the consent request can be displayed. This measurement does not use the device advertising identifier: it remains switched off and is switched on only if the user grants consent to advertising. The installation is therefore counted but is not linked to the user's profile.

Marketing consent is entirely voluntary, is not a condition for the creation of an account or for participation in a competition, and may be withdrawn at any time by means of the switch in the "More" section or by the unsubscribe link in every marketing e-mail. Withdrawal has no effect on the existence of the account or on earlier participation in competitions.

4. Sharing data with third parties

The operator uses the following processors and recipients:

• Google Ireland Limited — Google Analytics and Google Ads on the website; in the application Google Analytics for Firebase (analytics), Firebase Cloud Messaging (delivery of notifications), Firebase Remote Config (remote configuration and testing of the form of the application) and Google AdMob (advertising banners in the shop and leaflet detail, personalised where consent is given).
• Meta Platforms Ireland Limited — measurement of application installations and of selected actions for the purposes of advertising campaigns and the display of ads in the application (Meta Audience Network via Google AdMob, personalised where consent is given); on the website Facebook Pixel.
• Functional Software, Inc. (Sentry) — reporting of crashes and errors of the application.
• Microsoft Ireland Operations Limited — Microsoft Clarity on the website.

The operator will provide a complete list of processors upon a request sent to info[at]vimvic.cz.

Transfers outside the EEA: the recipients referred to may process personal data also outside the European Economic Area, in particular in the United States of America. The transfer takes place on the basis of standard contractual clauses approved by the European Commission, or on the basis of an adequacy decision.

5. Data retention periods

• Account data (e-mail address, time of verification, marketing consent, favourite shops) — for the duration of the existence of the account. After its cancellation they are deleted or anonymised in the manner described in point 6.
• Verification records including the IP address — 30 days.
• Interface operational logs including the IP address — 30 days.
• Login tokens — no longer than 180 days from last use; after cancellation of the account 30 days.
• Device data for notifications (including the registration token) — no longer than 12 months from the last launch of the application on the given device. Thereafter the registration is deleted together with the history of delivered notifications.
• Participation in competitions — see point 6.
• Cookies — for the period stated in the cookie settings or until consent is withdrawn.

6. Cancellation of the account

The account may be cancelled in the application in the "More" section or on the page catalogues123.co.zaaccount-deletion. In both cases the operator sends a confirmation link, or a code, to the address being verified; a link sent from the website is valid for 24 hours.

Upon cancellation of the account the operator irreversibly deletes:

• the list of favourite shops linked to the account,
• the records of the granting and withdrawal of marketing consent,
• all verification records relating to the given e-mail address.

The operator further anonymises the e-mail address, disconnects the device identifiers and invalidates all login tokens. After anonymisation the original e-mail address is again free for a new registration.

The history of participation in competitions is not deleted, only anonymised. It retains the country, the date of participation, the ranking and the information on whether it was a win. The e-mail address is irreversibly overwritten, the device identifier removed and all verification records deleted, so that the record of participation can no longer be assigned to a specific person.

The reason why these records are retained is the operator's obligation to demonstrate the fairness of the competition and the prizes awarded: the ranking of participants determines to whom the prize fell, and its subsequent alteration would make it impossible to demonstrate the win. Because after anonymisation they are no longer personal data, these records are not limited in time. For the duration of the account, the records of participation are kept together with it.

7. Rights of users

• the right of access to personal data,
• the right to rectification of inaccurate data,
• the right to erasure ("the right to be forgotten"),
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing,
• the right to withdraw consent granted at any time, without this affecting the lawfulness of prior processing,
• the right to lodge a complaint with a supervisory authority.

The operator's own supervisory authority is Úřad pro ochranu osobních údajů (the Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz. A complaint may also be lodged with the data protection authority in the user's country of residence — for example with the Information Regulator in South Africa, inforegulator.org.za, or with the Office of the Privacy Commissioner of Canada, priv.gc.ca.

8. Children

The service is not intended for children under 16 years of age and the operator does not knowingly collect personal data from them. If the operator finds that an account was created by a child under 16 years of age without the consent of a legal guardian, it will cancel the account.

9. Contact details

Please send questions concerning the processing of personal data and the exercise of rights to info[at]vimvic.cz.

Cookie usage policy (Cookies Policy)

1. What are cookies?

Cookies are small text files stored on the user's device when visiting a website. They allow the pages to function, the use of the pages to be analysed and the content and advertising to be adapted. The mobile application does not use cookies; a similar role is performed in it by the installation identifier and the consent settings described above.

2. What types of cookies are used?

• Necessary cookies — ensure the basic functionality of the pages, do not require consent.
• Analytical cookies — serve to analyse user behaviour, require consent.
• Advertising cookies — enable the personalisation of advertising, require consent.

3. Who has access to the data?

Google, Meta and Microsoft to the extent stated in the Protection of personal data part, point 4.

4. How can cookies be managed?

On the first visit by means of the "Privacy and cookie settings" bar, at any time later by the same link in the footer of the pages, and further in the settings of the browser.

5. Cookie retention periods

Temporary cookies for the duration of the visit, permanent cookies for the period stated in the cookie settings or until they are removed by the user.

Final provisions

This document takes effect on 10 November 2026 and replaces the wording effective from 1 October 2026.

The operator reserves the right to change the content of this document. The current wording is always available in the service. Questions may be sent to info[at]vimvic.cz.