PRIVACY NOTICE
Dear clients and parties interested in our products,
as of 25. 5. 2018 the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also known under abbreviation GDPR (hereafter “GDPR”).
GDPR does not apply to processing personal data performed by a natural person during solely personal or household activities. This concerns art. 2 (2) c) of GDPR.
We would like to notify you according to art. 6 of GDPR about what personal data of natural persons we will collect and what legislation is in our opinion applicable in accordance with GDPR.
1) COMPLIANCE WITH A LEGAL OBLIGATION ACCORDING OT THE APPLIABLE LEGISLATION:
– article 6 (1) c) of GDPR
• Act no. 563/1992 Coll., on Accounting
• Act no. 235/2004 Coll. on Value Added Tax
• Act no. 112/2016 Coll. on Electronic Registration of Sales
• Act no. 586/1992 Coll. on Income Tax
• Act no. 353/2003 Coll. on Consumer Taxes
• Act no. 280/2009 Coll., Tax Procedure Code
• Act no. 254/2004 Coll. on Limitation of Cash Payments
• Act no. 253/2008 Coll. on Certain Measures against Money Laundering and Terrorism Financing
This list of legislative enactments may not be exhaustive. If a legislative enactment imposes an obligation to collect certain data, we are obliged to collect the data.
The personal data collected will most definitely include name, surname, company seat – address of residence, including ZIP code, VAT no., which contains means to identify one’s national identification number.
Archiving period is governed by the regulation Q TOP 5.1 Documents and records management applicable to such legal enactments, is usually 5 to 10 years.
2) LEGITIMATE INTEREST OF THE CONTROLLER
– art. 6 (1) f) of GDPR
2.1 Natural persons representing your company
Within our activities we may record personal data of other natural persons, your employees or co-workers, which you have provided or will provide to us. These include natural persons, who are contact points and with whom we are supposed to work directly or to whom we are supposed to provide our products or services directly.
This data includes in particular name, surname, telephone, address, email; you determine the scope of such data yourselves and you should carefully consider, which data of such persons you will provide to us.
We will collect data about such persons for the time of our cooperation with you. If our cooperation is terminated, we will keep the data for a period of additional 5 years for the purpose of contacting you in case of need.
2.2 Monitoring your business activity – natural persons
Within our activities we will monitor data associated with your purchase history of products and services in terms of both volume and time in order to be able to better accommodate your needs and thus to better steer our business in the right direction.
We will collect the data for the time of our cooperation with you. If our cooperation is terminated, we will keep the data for a period of additional 5 years.
2.3 Telephone
Within the frame of our legitimate interest we record telephone numbers of natural persons to be able to contact you in case of any complications arising in relation to use of our services or sale of our products. The reason is also to be able to verify the identity of the caller.
We will collect the data for the time of cooperation with you. If our cooperation is terminated, we will keep the data for a period of additional 5 years.
2.4 Cookies
We use cookies to be able to track preferences of visitors on the website and to optimize the website accordingly. Cookies are small “files” stored on your hard drive. These files facilitate navigation and secure a high standard of website user comfort. Cookies may be used to ascertain, whether you have previously visited the website from your computer. Only cookies stored on your computer will be identified. You may deactivate the use of cookies in your Internet browser.
3) PROCESSING OF PERSONAL DATA WITHOUT YOUR CONSENT
– article 6 (1) b) of GDPR
Processing of personal data without your consent takes place in the following situations:
3.1 Concluding and performing an agreement or negotiating an agreement
In order to be able to negotiate our cooperation and conclude an agreement, we need to process certain personal data of yours. This situation enables us to use the data only for the purpose of negotiating and concluding agreements.
3.2 Sending offers
If we have concluded an agreement together, we will send you offers based on our legitimate interest.
3.3 Product seminars
3.4 Protection of our rights
- Prevention of fraudulent conduct
- Prevention of damage to our property
- Enforcement of claims, litigation of legal and other disputes
We will collect the data for the time of our cooperation with you. If our cooperation is terminated, we will keep the data for a period of additional 5 years.
4) PROCESSING OF PERSONAL DATA BASED ON YOUR CONSENT
– article 6 (1) a) of GDPR
Processing of your personal data based on your consent is voluntary. If you do not grant your consent, the contract performance will not be affected in any way.
4.1 Other specified collections subject to your consent:
- Development and expansion of our products
- Client care – activities not subject to contract performance that cannot be considered as our legitimate interest
5) MANNER OF PROCESSING
We process personal data mainly in electronic form in designated information systems of our company. Your data is processed by our employees and also by third parties – processors, with whom we entered into written agreements guaranteeing the same level of protection of privacy as is provided by us.
6) INTEGRITY AND CONFIDENTIALITY
Processing of your personal data takes place mainly in electronic form. All systems are regularly tested and secured against accidental data leakage. All employees of 2 JCP a.s. that work with your data are thoroughly trained according to our internal regulations.
All documents in paper form are secured and the staff members are also trained in how to handle such materials.
7) TRANSFER OF PERSONAL DATA TO ABROAD
Your personal data are processed only in the necessary extent in particular in the Czech Republic and also in other states of the European Union (EU) and outside the EU. Our group supplies products to customers also outside the EU. An integral part of the works is also documentation, which may contain your personal data in order to prove compliance of the product with the applicable legislation and other regulations. In countries where compliance with GDPR is not yet proven this standard is stipulated contractually.
8) RIGHT TO INFORMATION
We point out that according to GDPR, in particular the whole chapter II thereof, you as the data subject have rights. Some of the fundamental rights are:
- Right TO WITHDRAW CONSENT – article 7 of GDPR
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
- INFORMATION AND ACCESS TO PERSONAL DATA – article 13 of GDPR
The right to information means that you have the right to receive information about how we process personal data. You will learn this information in this notification or we gladly provide it upon request.
- RIGHT OF DATA SUBJECT TO ACCESS PERSONAL DATA – article 15 of GDPR
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and such information.
- RIGHT TO RECTIFICATION – article 16 of GDPR
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
- RIGHT TO ERASURE (‘RIGHT TO BE FORGOTTEN’) – article 17 of GDPR
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.
- RIGHT TO RESTRICTION OF PROCESSING – article 18 of GDPR
The data subject shall have the right to obtain from the controller restriction of processing in the stipulated cases.
- NOTIFICATION OBLIGATION REGARDING RECTIFICATION OR ERASURE OF PERSONAL DATA OR RESTRICTION OF PROCESSING – article 19 of GDPR
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
- RIGHT TO DATA PORTABILITY – article 20 of GDPR
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller according to the said article.
- RIGHT TO OBJECT – article 21 of GDPR
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
- RIGHT NOT TO BE SUBJECT TO ANY AUTOMATED INDIVIDUAL DECISION-MAKING BASED SOLELY ON AUTOMATED PROCESSING – article 22 of GDPR
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
- RIGHT TO LODGE A COMPLAINT WITH THE PERSONAL DATA PROTECTION OFFICE – article 77 of GDPR
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The text includes simplified citations from GDPR.