GDPR

MEMORANDUM ON THE PROCESSING OF PERSONAL DATA

BY TECHO, a.s.

 

(A) INTRODUCTION

1. Basic information on the processing of personal data

1.1

TECHO, a.s., registered address U továren 770/1b, Hostivař, 102 00 Praha 10, reg. No.: 49240056 (the “Company” or “we”) as the controller of your personal data issues this memorandum on the processing of personal data (the “Memorandum”).

1.2

The purpose of this Memorandum is to inform you as a data subject (hereinafter “you”) about the processing of your personal data by the Company and about your rights connected with this processing.

1.3

This Memorandum can be amended by the Company. The current wording of this Memorandum can be found at www.techo.cz

2. Contact information

If you have any questions concerning the processing of your data and its protection, please contact us by phone: 267 290 111 or email: privacy@techo.cz.

3. Definitions

3.1

Unless the context of this Memorandum dictates otherwise, terms used in this Memorandum shall have the following meaning:

 

“cookies”

 

 

 

 

 

 

 

 

 

“hash”

 

 

personal data

 

  means text (data) files containing small amounts of information (data) which when visiting websites are saved on the user’s computer, mobile phone or other device. Then on every subsequent visit to the website cookies are sent back to the website (or other site), which recognises the cookies and enables the website to recognise the user’s computer, phone or other device;

 

  means the digital fingerprint of the particular website user behaviour contained in cookies;

  means information about you, which is covered in more detail in part C, article 6 of this Memorandum;

recipient

means a natural or legal person, public authority, agency or other body that your personal data is provided to;

 

controller

means the entity that determines the purposes and means of the processing of personal data. In the case of your personal data within the scope set out in this Memorandum, the controller of your personal data is the Company;

 

data subject

means an individual in relation to whom we process personal data – i.e. you, in particular if you are a business partner, employee, job applicant or visitor to our website.

 

third country

 

„website users“

 

 

“the Company’s website”

means a country other than a member state of the EU, Norway, Iceland and Lichtenstein;

means an individual who visits the Company’s website;

means www.techo.cz; www.techo.com

 

 

processing” or “processing personal data

means any operation performed on personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

 

processor” or “processor of personal data

means a natural or legal person, public authority, agency or other body that processes personal data for the Company (e.g. accounting or law firms).

 

       

(B) COMPLIANCE WITH LEGAL REGULATIONS AND BASIC PRINCIPLES FOR PROCESSING

4. Compliance with legal regulations

Protection of your personal data is our priority and when processing your personal data we observe all obligations and requirements placed on us by applicable legal regulations in the area of the protection of personal data.

5. Basic principles for processing personal data

In the processing of personal data we are guided by the following basic principles:

Legality, correctness and transparency

We will process your personal data in a correct, transparent and legal method.

Purpose limitation

We collect (and process) your personal data only for specified, explicit and legitimate purposes and we don’t further process your data in a manner that is incompatible with those purposes.

Data minimisation

We process your personal data only to an extent that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy

We only process accurate personal data and where necessary we update your personal data.

Storage limitation

We process (store) your personal data only for a period that is necessary with regard to the purposes for which your personal data is processed, or for the period prescribed by applicable legal regulations.

Integrity and confidentiality

We process your personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Accountability

We take responsibility for ensuring compliance with the above principles and for processing your personal data in compliance with applicable legal regulations.

(C) SCOPE OF PROCESSING PERSONAL DATA

6. Personal data (types of personal data)

In relation to your status with respect to our company we can process the following personal data (categories of personal data):

Identification data

Information serving to identify your person, in particular academic title, first name, surname, date of birth, tax number, job title etc.;

Contact data, including electronic

Information serving for contacting and communication with you, in particular telephone number, email address, home address or temporary address, other contact address;

Authentication data

Data serving to authenticate your identity, in particular login name and password (in the case of user logging on to the Company website), also car registration number (if driving through the gateway to the Company carpark);

Payment data

Data for the making of payments, in particular bank account no., payment card information, or data relating to other means of payment (e.g. PayPal);

Data on legal claims

Information on your legal claims in relation to the Company and claims of the Company on you arising from contractual or non-contractual relationships between you and the Company, such as, for example, information on a claim for compensation from the Company or information of a claim the Company has, such as a contractual penalty or due to non-payment for goods;

Audio-visual data

Data in the form of audio-visual records, in particular photographs or video records (e.g. from a Company event);

Information on credit worthiness

Information about your credit rating, financial position, payment record, if these are important for a contractual relationship you have with the company;

Contractual data

Data on products and/or services supplied to you by the Company, related requirements, complaints, claims, service requirements incl. information on your communications with the Company and other associated information;

Professional profile data

Information on your level of education and professional qualifications, in particular information contained in your curriculum vitae;

IP address

Information on the device you use to access the website;

Hash

Information contained in cookies relating to your browsing behaviour on websites;

 (D) PROCESSING PERSONAL DATA

7. Sources of processed personal data

We obtain your personal data from several sources. The primary source of your personal data is you yourself (e.g. when we conclude an agreement with you on the supply of goods and/or services and for this purpose you provide us with your identification or payment data). Another source of your personal data are publically accessible sources such as the internet, including social networks (e.g. LinkedIn). We also obtain your personal data from public records and registers (e.g. the Commercial Register or the Trade Licence Register). We can also receive your personal data from third parties, for example your employer, if it is our customer or supplier.

8. Lawful bases and purposes for processing personal data

8.1

We process your personal data on the basis of the following legal reasons: (i) for the fulfilment of agreements you have concluded with the Company, (ii) for the fulfilment of legal obligations incumbent on the Company arising from legal regulations, (iii) the legitimate interests of the Company, (iv) your consent to the processing of your personal data if you have given it to us, and (v) in exceptional situations we can also process your personal data for the reason of protecting your vital interests or the vital interests of other persons.

8.2

We process your personal data only for the purposes stated in this article. If in the future we are to process your data for a purpose other than the purposes stated here, we will inform you in advance by updating this Memorandum, or by another suitable method.

8.3 The processing of personal data in the fulfilment of a contract between the Company and you

If you have concluded an agreement with us then this will be a basis for us to process your personal data. Without processing your personal data it would not be possible to conclude the agreement in question and subsequently carry out the agreement.    

8.4 The processing of personal data to fulfil a legal obligation

We can also process your personal data if such processing is required of us by legal regulations, for example in relation to the tax authority or as part of archiving.

Using this lawful basis we can process your personal data for the following purposes: 

Tax issues

In this case personal data is processed for tax purposes, i.e. for the preparation, processing and submitting of tax returns, tax declarations and other tax statements, communication with the applicable public authorities and fulfilment of all obligations set out in tax regulations.

Accounting

The processing of personal data for the purpose of maintaining accounting records and accounting audits, fulfilling registration and filing obligations, the fulfilment of reporting  obligations, communication with public authorities and fulfilment of other obligations set out in accounting regulations.

Claims

This relates to the processing of personal data for the purpose of resolving claims concerning the Company’s products and services delivered to third parties, associated communication and record keeping.

Archiving

This relates to the processing of personal data in order to fulfil archiving obligations prescribed by the applicable legal regulations, in particular the Act on Archiving and Records Management, as well as tax and accounting regulations.

Audits

The processing of personal data for the purpose of enabling performance of statutory audits at the Company, e.g. accounting and tax audits etc.

Cooperation with public authorities

Processing of public data for the purpose of providing obligatory information to public authorities, e.g. authorities active in criminal prosecutions, financial authorities etc. providing it is part of information that we are obliged to provide to these bodies.

 

8.5 Processing of personal data on the basis of legitimate interest

We can also process your personal data on the basis of a legitimate interest of the Company, provided that your legitimate interests and/or the basic rights and freedoms requiring protection of personal data don’t take priority over the legitimate interests of the Company.

We process your personal data under this lawful basis for the following purposes:

Effective administration of the Company

In this case personal data is processed for the purpose of ensuring the effective functioning of the Company including the internal communication within the Company, retention of information materials (business cards, catalogues, Commercial Register extracts) and internal Company records etc.

This legitimate interest of the Company is the interest to operate and be managed effectively.

Promotion of the Company

Processing of personal data for the purpose of presentation of the Company on the internet, including social networks (e.g. LinkedIn, Instagram, Facebook) and presentations in printed media or with business partners of the Company. As part of these presentations, for example, we inform about our mutual clients or suppliers. This also covers data contained in reference letters. Your personal data for this purpose is processed in a limited scope.

The legitimate interest of the Company here is the interest to promote and increase visibility and reputation among the public.

Communication and relationships with business partners of the Company

This relates to the processing of personal data for the purpose of communication with business partners of the Company and does not directly concern the fulfilment of contractual obligations incl. sending invitations and greetings to partners etc.

This legitimate interest of the Company is the interest for maintaining effective relationships with business partners.

Protection of the lawful interests of the Company

This refers to the processing of personal data in connection with protection of the lawful claims and right to the protected interests of the Company, whether this relates to the Company making claims against you or a third party, or cases where the Company is defending against claims made by you or a third party, and this can be out of court, or through a judicial process.

Here the legitimate interest of the Company is the interest of the company to protect its rights and interests by exercising rights/claims against third parties and ensuring defence against claims made against the Company.

Safety and security

This is the processing of personal data for the purpose of ensuring security in the Company incl. IT and network security and protection of the Company’s property and the property of other persons. For this purpose the Company leases security systems and a security camera system without making recordings (covering the public spaces in the Company premises and the gate into the site).

The legitimate interest of the Company here is the protection of the Company’s property and that of other persons, and ensuring the safety of persons on the Company premises.

Insurance

This is the processing of personal data for the purposes of making insurance claims, whether in connection with insurance events caused by or affecting you. 

The legitimate interest here is the interest to make insurance claims with an insurance company.  

Recording events

This covers the processing of personal data for the purpose of creating audio-visual records of free-time events of the Company, which you attend, and their subsequent use in presentation of the Company on the internet or within the Company; events of the type TechoCon (a conference for industry professionals) and other social events (Christmas, anniversaries), university visits etc.

The legitimate interest of the Company to create a friendly environment and also the interest of promoting the Company and raising its profile with the public.

Recruitment of new employees

We process your personal data for the purposes of recruiting new employees – i.e. the receipt, processing and filing of CVs, the selecting of candidates, conducting interviews, making job offers and communication with job applicants throughout the recruitment process. This includes maintaining a database of job applicants, which will include personal data on unsuccessful applicants for employment with the Company, but who might be contacted in the future with a new offer of employment.

The legitimate interest of the Company here is the recruitment of new employees and the filling of vacant positions to ensure the effective operation of the Company.

8.6 Processing personal data on the basis of your consent

We can also process your personal data on the basis of your consent to its processing. In such case we process the personal data in question only for the purpose that you have provided your consent to.  

We process your personal data on the basis of your consent in the case of certain cookies. You can find further information on cookies on the Company website – cookies notification.

The provision of your consent to the processing of personal data is voluntary and you have the right at any time to withdraw your consent.

9. Recipient of personal data  

Under this purpose your personal data is provided to third parties who are designated recipients of personal data. These are companies (or individuals) with which the Company cooperates, such as business partners or when using the services of these companies, or a part of fulfilling legal obligations.

10. Transferring personal data to third countries

In certain circumstances we transfer your personal data to third countries (countries outside the EU), e.g. when arranging delivery of our products and services to or through foreign partners.

11. Period for the retention (processing) of personal data

We process your personal data only for a period necessary with respect to the purpose for which it is processed.

 (E) YOUR RIGHTS

12. General information

This part of the Memorandum contains information on your rights connected with the processing of personal data by the Company or for the Company.

13. The right to withdraw consent to the processing of personal data

13.1

If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time.

13.2

You can withdraw your consent in full or in part in relation to just some of your personal data or just certain purposes for processing.

14. Right of access to personal data

14.1

You have the right to receive from the Company confirmation of whether we process your personal data or not.

14.2

In the event that your personal data is processed by us you have the right to access your personal data and the right to the provision of information contained in this Memorandum.

15. Right to amend and add to personal data

You have the right to request us to amend inaccurate data relating to you without undue delay. With regard to the purposes for processing you also have the right to add to incomplete information and provide a supplementary declaration.

16. The right to request deletion of personal data (“right to be forgotten”)

16.1  

You have a right to demand that, without delay, we delete your personal data in the event that:

  • (a) your personal data is no longer needed for the purpose for which the company collected or processed it;
  • (b) you withdraw your consent to processing, if we process your personal data on the basis of your consent, and there are no other lawful grounds for processing your personal data;
  • (c) you raise objections to the processing of your personal data and at the same time there are no other prevailing legitimate grounds for processing;
  • (d) the data was on our part processed illegally; or
  • (e) your personal data must be deleted to fulfil legal obligations set out in applicable legal regulations that we are bound by.

16.2

In the event of exercising the right to deletion of data and fulfilment of the conditions for deletion, we will without delay delete your personal data unless we require your personal data for the fulfilment of legal obligations, for accounting, for the exercising or defending of legal claims or for archiving purposes.

17. The right to limited processing

17.1

You have a right to request that we restrict the processing of your data in the following cases:

  • (a) if you challenge the accuracy of your personal data, and for the period necessary to verify the accuracy of your personal data;
  • (b) if the processing of your personal data is illegal but you don’t decide to delete your personal data, but instead demand the limiting of its use;
  • (c) your personal data is no longer required by us for processing, but you require it for the purpose of the exercising or defending your legal claims; or
  • (d) you raise objections against processing for a period until it is verified whether our legitimate reasons prevail over your legitimate reasons.

17.2

In the event that the processing of your personal data is restricted at your request then, with the exception of storing, your personal data can only be processed with your approval or for the purpose of accounting, exercising or defending legal claims, for protecting the rights of other persons or legal entities, or for an important public interest.

17.3

In the event that the processing of your personal data is restricted at your request you will be informed of any lifting of the restriction to processing.

 

18. Right to portability of data

You have the right to request that we transfer your personal data (which you provided to us) to another processor (a company you designate), but only in the following cases:

  • (a) the processing of your personal data is based on your consent or on the fulfilment of an agreement between the Company and yourself and (at the same time)
  • (b) processing by the Company is automated.

19. The right to raise an objection

For reasons connected with your specific situation and on the grounds of your legitimate interests, you have the right to raise an objection at any time to the processing of your personal data.

20. Right to compensation

You have a right to compensation from the Company for all (tangible and intangible) damage that has been caused you by breach of an obligation of the Company in the area of processing and protecting personal data, and the Company is obliged to compensate you for such damage suffered. The Company is also responsible for damage caused to you by processors who received your personal data from the Company.

21. The right to submit a complaint to a regulating body

In the event of doubts regarding the legality of processing of your personal data, or if the Company does not comply with your Request concerning your personal data, you have the right to turn to the Office for Personal Data Protection as the body supervising compliance in the area or protecting personal data.

22. The right to judicial protection

In the event of doubts regarding the legality of processing of your personal data, or in the case of determining a breach of your rights in connection with the processing of your personal data, you have the right to effective judicial protection.

(F) METHOD FOR EXERCISING RIGHTS OF DATA SUBJECTS AND PROCESSING REQUESTS FROM DATA SUBJECTS 

23. Method of exercising rights of data subjects

You can make a request regarding exercising any of your rights in connection with the processing of personal data by the Company (a “Request(i)”) by phone: 267 290 111 or email: privacy@techo.cz.

24. Processing requests from data subjects

A Request is processed free of charge

Unless explicitly stated otherwise in this Memorandum, the processing of your Request and adoption of any subsequent measures will be performed without charge.

Request contents

From your Request it must be clear precisely what you are requesting from the Company. The Company might request clarification of the Request or its reasoning.

Receipt of a Request from a data subject

If your Request is submitted by email, receipt of the Request will be acknowledged without delay by the Company by email or other suitable method. 

A clearly unfounded or disproportionate Request

A clearly unfounded Request (e.g. a repeated request) can result in the levying of an appropriate administration charge or rejection.

Processing of a Request from a data subject

Requests are processed without undue delay, and in any case within one month of receipt. In exceptional cases (in particular with regard to complexity or total number of Requests being processed) this deadline can be extended by a maximum of an additional two months. We will inform you of an exceptional extended deadline within one month of receiving your Request, along with reasons for this extension.

We will also inform you in the case of refusal of your Request, including about the possibility of lodging a complaint with the supervisory authority and/or a request for protection through the courts.

(G) CONCLUSION

We hope that the information set out in this Memorandum is clear to you and that you have been sufficiently informed about your rights and our obligations with respect to processing of your personal data. If, however, any of the information in this Memorandum is unclear to you or you would like to ask about any relevant information concerning the processing of personal data please don’t hesitate to contact the Company by phone: 267 290 111 or email: privacy@techo.cz.