PROCESSING OF PERSONAL DATA
Introduction – processing of personal data
The operator of accommodation facilities named ABC Student & Home (www.abcstudenthome.cz) Ing. Vlastimil Konečný, born 10. 1. 1961, permanently living at Popovická 931, 664 42 Modřice (hereinafter referred to as the “Company”), declares that all personal data obtained in the course of the Company’s activities as an accommodation provider (hereinafter referred to as “personal data”) is handled in accordance with valid and effective legal regulation concerning personal data protection, particularly Act No. 101/2000 Coll, on the protection of personal data, and Regulation (EU) 2016/679 of the European Parliament and the Council from 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC.
The company also informs the entities from which it obtains personal details during its activities, i.e. its customers – natural persons, suppliers – natural persons or other entities (hereinafter only “data subject”), about the personal data it collects about them, and about how this data is further used or processed, where personal data according to the relevant legislation means all information about an identified or identifiable natural person.
1) The company obtains the following personal data from the data subject:
- the name or name/surname of physical persons (including academic titles), their identification number, their tax identification number, their date of birth, the postal address of their place of residence or office, their email address, or their billing or delivery address, their phone number, their bank details, and the number of their personal identification document or travel document.
- other data on the data subject obtained on the basis of the contract in question – data on purchased goods and services, data on current orders and complaints lodged, their payment discipline, the address at which the service was provided.
- data from correspondence between the Company and the data subject.
- personal data captured on camera recordings from the Company´s business premises and other premises (the appearance and movements of the data subject).
- electronic data from visits to the Company´ website (the IP address of the visitor, pages opened on our website, http response code, identification of the visitor´s browser).
- electronic contact addresses of persons who have subscribed to commercial correspondence or agreed to other forms of direct marketing.
2) The company processes personal data for any of the following purposes:
- the performance of obligations on the basis of the given contract concluded between the Company and the data subject, including order processing and other pre-contractual acts leading to the conclusion of the relevant contract or resulting from it, where the reason for the processing of personal data is the need to process the personal data required for the performance of the given contract.
- correspondence between the company and the data subject in connection with a contract concluded between the Company and the data subject.
- the protection and security of the Company, its systems or its customers, the detection and prevention of fraud, or the resolution of possible disputes between the Company and data subjects.
- the fulfilment of the Company´s legal obligations.
- commercial correspondence (marketing offers) – commercial messages from the Company sent to the data subject via email.
Commercial correspondence, unless the data subject´s electronic contact details have been obtained in connection with the sale of a product or service provided by the Company, or the correspondence concerns an offer of similar goods or services, may be sent by the Company only with the data subject´s consent to the processing of their personal data. Consent to the processing of personal data is provided by the data subject for a period of 4 years, unless otherwise stated in the consent declaration form or until the consent is revoked; the consent declaration form is also kept for this period by the Company.
This commercial correspondence, as well as the consent provided, may be revoked by the data subject at any time, via the link placed in each email, or by contacting the Company – in person, by post, by telephone or by email. In such a case, the data subject’s personal data will no longer be processed by the Company and commercial correspondence will no longer be sent to the data subject by the Company.
3) Recipients of personal data – transfer of personal data to third parties
The personal data of the data subject may only be passed on to third parties or otherwise provided if this is necessary for the performance of the contract concluded between the Company and the data subject, based on the legitimate interest of the Company or the fulfilment of its legal obligations, or if the data subject has stated their consent in advance. Personal data can be passed on by the Company to the following third parties:
- carriers providing the transport of correspondence between the Company and the data subject,
- providers of maintenance to the Company´s information system, the Company´s network administrators, providers of maintenance to the Company’s security camera system, providers of web hosting and email services, providers of cloud services,
- payment service providers for the purpose of processing payments on the basis of a relevant contract concluded between the Company and the data subject, or payment gateway providers,
- providers of services related to the relevant contract concluded between the Company and the data subject,
- third parties who keep the Company´s accounts or process relevant accounting documents,
- legal representatives and courts in connection with the possible enforcement of the Company´s claims, or other public bodies or institutions (the Police of the Czech Republic, etc.),
- other persons according to the needs and instructions of the data subject.
If third parties use the data for their legitimate interests, the Company is not responsible for such processing. This processing is governed by the principles for the processing of personal data used by the given third party. Third parties, with the exception of state (public) authorities or institutions, are contractually obliged to the Company to comply with the principles of personal data processing in accordance with the relevant legal regulations.
4) Period of personal data processing
The company processes and stores personal data for the time necessary to fulfil all rights and duties arising from the relevant contract concluded between it and the data subject, or arising from the data subject´s consent to the processing of personal data (marketing purposes), or from legal regulations or the legitimate claims of the Company. After this period, personal data will be handled in accordance with the applicable legislation, in particular Act No. 101/2000 Coll. on personal data protection, and Regulation (EU) 2016/679 of the European Parliament and the Council from 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR Regulation).
The company therefore processes (keeps) personal data for the period of:
- the duration of the relevant contract concluded between the Company and the data subject, and for a further period of three years (statutory general limitation period) after its termination, in order to resolve any disputes that may arise between the Company and the data subject,
- always for the period during which it is obliged to keep the relevant data in accordance with generally binding regulations: the Company therefore archives accounting documents for a period of 5 years from the date of their issue, beginning at the end of the accounting period to which they are related, unless required otherwise by law,
- consent to the processing of personal data for the period for which the consent is granted, or until revoked by the data subject,
- correspondence between the Company and the data subject for a period of three years from the date of its commencement,
- camera recordings from security cameras for a maximum period of 3 weeks from their acquisition.
In other cases, the processing time (and keeping) of personal data is governed by the purpose of its processing or is defined by legal regulations regarding personal data protection.
Personal data is always kept only for a time which is strictly necessary to fulfil the purpose for which it is being processed.
5) The rights of data subjects
- The data subject has the right to access their personal data, i.e. they may at any time request free information from the Company on the processing of their personal data, i.e. information on whether their personal data is being processed, what data is involved, and how it is being processed.
- In the event that the data subject believes that the processing of personal data is being performed by the Company in a manner which violates the principles of personal data protection and the legal conditions of personal data protection, they may request an explanation or request the Company to rectify the situation. They can, in particular, request corrections, additions, restrictions on the processing of their personal data, or the destruction or blocking of personal data.
- The data subject has the right to have their personal data deleted, which corresponds to the Company´s obligation to destroy personal data that it processes about the data subject if the requisite conditions are met and simultaneously if the data subject so requests. Personal data will be destroyed, inter alia, if it is no longer needed for its specified purpose or if its storage is unacceptable for other reasons stipulated by law.
- The data subject may revoke their consent to the processing of their personal data which they granted to the Company at any time. If the data subject revokes the consent which they granted to the processing of personal data, their personal data will be deleted or anonymised; however, this does not apply to such personal data which the Company needs to fulfil the contract concluded between the Company and the data subject, to fulfil its legal obligations or to protect its legitimate interests.
- The data subject has the right to the portability of their personal data, so the data subject has the option to obtain personal data provided to the Company in a common and machine-readable format. This data may then be transferred by the data subject to another data administrator or, if technically possible, the data subject can ask for their data to be transferred between administrators.
In the event that the data subject is in any way dissatisfied with the processing of their personal data by the Company, they may communicate their objections to the Company or contact the Office for Personal Data Protection.
More information on the rights of data subjects is available at the website of the Office for Personal Data Protection – https://www.uoou.cz/6-prava-subjektu-udaj/d-27276.
