(hereinafter referred to as "Principles")
This document contains basic information about handling personal information in our company.
In this text you will learn these pieces of information above all:
If you need explanation of any part of the text and if you need an advice or discuss further
processing of your personal data, you may contact us at any time by e-mail email@example.com.
1.1 These Principles are being prepared in accordance with Regulation of the European
Parliament and of the Council (EU) 2016/679 of 27/April/2016 - protection of individuals
with regard to processing of personal data and free movement of such data and with regard
to cancellation of Directive 95/46/ES (hereinafter referred to as GDPR Directive).
1.2 These Principles are aimed to provide Data Subjects with basic information about
processing of personal data.
1.3 The needs of these principles mean the following:
1.4 Administrator of the Personal Data hereby informs of the manner and scope
of processing the Personal Data, including the extent of your rights related to processing
of Personal Data.
1.5 Administrator is a printing company specializing in production of self-adhesive labels,
running own business for this purpose. Within this activity, the Personal Data is being processed
by the Administrator:
1.6. Personal data is not processed by any other subject. The personal data processed shall be accessible only by the Administrator.
2.1 The data subject acknowledges that processing of personal data by the Administrator shall begin with the particular order.
2.2 If the Data Subject fails to provide the Personal Data, it is not possible to conclude the contract with the Administrator or it is also not possible to provide the Administrator with performance resulting there from. In this context, the Personal Data is necessary to provide a particular Product of the Administrator.
2.3 Providing Personal Data to the Administrator is generally meant as contractual and legal requirement. Regarding provision of Personal Data for marketing purposes, which does not represent the performance of the contractual and legal obligations of the Administrator, the Data Subject shall be asked for consent. If you did not give the Administrator your permission to process Personal Data for marketing purposes, this does not mean that the Administrator would refuse to provide his services as a result.
2.4 The Data Subject is only required to provide the Administrator with true and accurate Personal Data.
2.5 The Administrator shall make all his effort to avoid unauthorized processing of the Personal Data.
2.6 Personal Data is and will be processed in written and electronic form in a non-automated manner.
3.1 The Administrator processes Personal Data for the following purposes:
Purpose of Personal Data Processing
Legal Title of Processing of Personal Data
Conclusion and subsequent performance of the contractual obligation between the Administrator and You, and the other resulting legal obligations, such as the time for archiving documents.
Fulfilment and conclusion of the contract (Article 6 (1) (b) of the GDPR Regulation), fulfilment of legal obligation (Article 6 (1) (c) of the GDPR Regulation) - for instance Act No. 563/1991 Coll. - accounting; Act No. 89/1999 Coll. - Civil Code; Act No. 235/2004 Coll. - value added tax, etc.
4.1 The Personal Data will be processed during the negotiation for conclusion of the contract between the Administrator and the Data Subject, for the purpose of concluding the contract, as well as for duration of the contractual relationship or for the period stipulated in the agreement.
4.2 In case of concluding the contract under the Business Terms and Conditions of the Administrator, the Personal Data will be processed and stored for the next 60 months in case of any dispute concerning the relationship between the Administrator and the Data Subject in order to protect the legitimate interests of the Administrator.
4.3 In order to fulfil the statutory obligation to archive the accounting documents pursuant to Act No. 563/1991 Coll. (Accounting), as amended, the Personal Data will be further processed and stored for up to 10 years starting from the year following the year in which the contract was concluded between the Administrator and Data Subject.
4.4 After the deadlines specified in this article, the Administrator will safely dispose of the Personal Data.
5.1 Your Personal Data shall be processed by the Administrator
6.1 The Administrator shall always use your Personal Data in such the manner that processing is done correctly and safely. The rights for the Data Subject are guaranteed to you and you can claim them with the Administrator.
6.2 The Data Subject may perform his rights by filling in and sending the form provided for that right. These forms are available in our company upon request. Send the completed form to e-mail: firstname.lastname@example.org.
6.3 Any comments and other information about the measures taken shall be provided to the Data Subject as soon as possible, not later than one month after submission of the request. This deadline can be extended by up to two months, given the complexity and number of applications. The Administrator will keep the Data Subject informed of any possible extension and the reasons thereof.
6.4 The Administrator shall perform the rights for free.
6.5 A reasonable fee, taking into account the administrative costs associated with provision of the information requested, may be charged if the application is obviously unreasonable or inappropriate, in particular for its repetition.
6.6 Should the Data Subject believe that the Administrator carries out processing of his/her Personal Data in violation of protection of his/her private and personal life or in violation of applicable laws, especially if Personal Data is inaccurate with regard to the purpose of processing, then the Data Subject may do the following:
6.7 Right of Access:
The Data Subject has the right to obtain from the Administrator confirmation for whether or not the Personal Data relating to him/her is processed. When the Personal Data is being processed, the Data Subject is entitled to access this data and the following information (which is part of these principles of protection of personal data and information document):
6.8 Right for Correction:
The Data Subject is entitled to require the Administrator to correct inaccurate Personal Data without undue delay. Taking into account the purposes of processing, the Data Subject is entitled to supplement incomplete Personal Data, including an additional statement.
6.9 Right of Deletion:
The Data Subject is entitled to require the Administrator to delete his/her Personal Data without undue delay and the Administrator is obliged to delete the Personal Data without undue delay if one of the following reasons is given:
After the Personal Data Processing time period has elapsed, the Administrator shall delete the Personal Data Administrator always and automatically. The Data Subject may always contact the Administrator with request for deletion. Upon receipt of such request, the Administrator will assess legitimacy of the Data Subject's right (the Administrator may have legal obligations or legitimate interest in the processing of the Personal Data on the basis of which he may further process the Personal Data) and will inform the Data Subject of its handling.
6.10 Right to limit processing:
The Data Subject is entitled to require the Administrator to restrict processing of his/her Personal Data in any of the following cases:
If such processing has been restricted, the Personal Data may be processed only with consent of the Data Subject (except for storage purposes), or due to the purpose of determining, enforcing or defending the legal rights, due to the protection of the rights of another natural or legal person or due to any important public interest of the European Union or a Member State.
If the limitation of processing of the Personal Data of the Data Subject is to be cancelled, the Administrator shall inform the Data Subject thereof in advance.
6.11 Right of portability:
The Data Subject is entitled to obtain Personal Data concerning him/her and provided to the Administrator, while in a structured and commonly used and machine-readable format; the Data Subject is also entitled to pass this data to another Administrator and the Administrator to whom the Personal Data has been provided must not impede such action, if having the following conditions:
When exercising this right, the Data Subject may require the Administrator to pass the Personal Data directly by one Administrator to the other Administrator, if it is technically feasible.
This right cannot be exercised if the processing is necessary for performance of a task carried out in the public interest or in the exercise of public authority to which the Administrator is entrusted.
6.12 Right to objection:
The Data Subject is entitled to make objection at any time against processing of his/her Personal Data processed on the basis of the public interest and the exercise of public authority or on the basis of legitimate interests of the Administrator, including the act of profiling. The Administrator does not process the Personal Data unless he/she can prove that there are serious legitimate reasons for processing which outweigh the interests or rights and freedoms of the Data Subject, or the reasons for determination, exercise or defence of legal claims.
If Personal Data is processed for direct marketing purposes, the Data Subject is entitled to make objection at any time against processing of Personal Data for this marketing, which includes profiling as far as this concerns direct marketing.
If the Personal Data of the Data Subject is processed for purposes of scientific or historical research or for statistical purposes, the Data Subject is entitled to make objection due to reasons relating to his/her particular situation against processing of his/her Personal Data. This is not the case if the processing is necessary to fulfil a task carried out due to public interest.
As required by the GDPR Regulation, this right was explicitly mentioned and is specified clearly and separately from any other information.
6.13 The right not to be subject to automated decision making, including the act of profiling:
The Data Subject is entitled not to be involved in any decision based solely on automated processing, including the act of profiling which affects him/her in legal manner or has significant consequences to him/her.
The right cannot be used in cases where the decision is:
When processing of Personal Data is based on a contract or explicit consent, the Data Administrator shall take appropriate measures to protect the rights and freedoms and legitimate interests of the Data Subject, at least the right to human intervention by the Administrator, the right to express own views, the right to obtain an explanation of the decision made and the right to make objection to the decision.
6.14 Right to file a complaint at the Supervisory Authority:
The Data Subject is entitled to file a complaint at some of the supervisory authorities, particularly in the Member State of his habitual residence, place of employment or the place where the alleged violation occurred, if the Data Subject believes that the GDPR Regulation was violated by processing of his/her Personal Data.
The Supervisory Authority in the Czech Republic is the Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Praha 7, phone: +420 234 665 111 (centre) or e-mail email@example.com. For more information visit https://www.uoou.cz/.
7.1 Processing of Personal Data does not include the process of profiling.
7.2 Processing of Personal Data does not include the process automated decision-making.
8.1 Any legal relationships arising in connection with processing of Personal Data are governed by the law of the Czech Republic, regardless to where the access to them was implemented from. The relevant Czech courts are competent to solve any disputes arising in connection with protection of privacy between the Data Subject and the Administrator.
8.2 Data Subjects who provide their Personal Data for the purpose of concluding a contract with the Administrator or provide consent to process their Personal Data do so voluntarily, on their own behalf; they are not forced or controlled by the Administrator.
8.3 The Administrator may modify or amend the text of the Principles. The Administrator shall inform the Data Subjects of any of such changes by issuing new Personal Data Processing Principles at least 30 days prior to the effective date of the changes.
8.4 These Principles are effective as of 25. 5. 2018.