Privacy policy

Basic information about the processing of personal data and contacts SANDO MORAVA s.r.o., with its registered office at Za Pilou 114, 783 14 Bohuňovice, Company ID (IČO): 09689753, VAT ID (DIČ): CZ09689753 (hereinafter also referred to as the "Intermediary" or the "controller"), hereby, within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the "GDPR" or the "Regulation"), in its position as controller or processor of personal data pursuant to the GDPR, informs all visitors of this website, its business partners, potential employees and clients about the processing of their personal data. The information contained in this document supplements the information provided to customers in the contract being concluded. Personal data are: 1) identification data - i.e. name, surname, username, hash, password; 2) contact data: telephone number, email address, delivery and billing address; 3) data in your account, newsletter settings, etc.; 4) data about your orders: data entered by you such as services and payment for services, etc.; 5) data about your behaviour on the website. Identity and contact details of the controller SANDO MORAVA s.r.o., with its registered office at Za Pilou 114, 783 14 Bohuňovice, Company ID (IČO): 09689753, VAT ID (DIČ): CZ09689753, tel. no. +420 736 147 188, email: info@sando-morava.cz Purposes of processing personal data, legal titles, legitimate interests and other information The purposes of processing personal data, as well as information about the legal titles, legitimate interests and information that personal data are processed solely on the basis of the free and active consent of the client, are always contained in the concluded contract or in the terms and conditions published on the Intermediary's website. Personal data are also processed for the purpose of fulfilling the Intermediary's legal obligations arising from the Tax Code or other legal regulation, and for other purposes which pursue the legitimate interest of the Intermediary, namely: 1) communication with potential clients, in particular by email and other suitable means. For this purpose, personal data (contact details, personal data and information about the outcome of dealings with these persons) may be processed for an indefinite period (until the right to erasure is exercised). 2) for the purpose of fraud prevention, control of the established technological processes, on the grounds of the Intermediary's legitimate interest. Personal data, contact data, accounting data and information about the services provided are processed. 3) recruitment of new employees who provide the Intermediary with their personal data during the job interview. The data of unsuccessful candidates are retained for a maximum of 6 months for the purpose of their possible use, consisting in approaching them with another job offer / participation in another or repeated selection procedure to fill a job position, unless the parties agree otherwise. For the purpose of possibly proving compliance with the prohibition of discrimination and the obligation of equal treatment under the Employment Act during the selection procedure, and on the basis of the Intermediary's legitimate interest, personal data may be processed for a period of 3 calendar years from the year in which the selection procedure was concluded, and in the case of ongoing administrative, judicial or other proceedings, for the entire duration of the proceedings. 4) direct marketing, which means the processing of personal data of existing customers for the purpose of directly approaching them with a business offer or research on the basis of the Intermediary's legitimate interest. The Intermediary notes that if a customer raises an objection to direct marketing in relation to a particular service, the Intermediary will no longer process the customer's personal data for this purpose in any way, and will likewise cease approaching the customer / sending business offers. 5) the exercise and enforcement of legal claims in the context of complaints, court disputes and enforcement of decisions. For this purpose, personal data may be processed for a period of 3 years from the termination of the contractual relationship and, if administrative or judicial proceedings are commenced, then for the entire duration of such proceedings. Personal data, contact data, accounting data and information about the services provided are processed. Our legitimate interests here are the protection of legal claims and the control of the proper provision of our services. 6) fulfilment of the contract with suppliers of goods and services of the Intermediary. For this purpose, personal data are processed for the duration of the contractual relationship, on the basis of the fulfilment of the contract with these suppliers. After this period, the Intermediary further retains this data on the basis of a legitimate interest for the purpose of protecting legal claims, internal records and control, for a period of 4 years (the limitation period of 3 years and one year after its expiry) with regard to claims raised at the end of the limitation period. In the event that judicial, administrative or other proceedings are commenced, the Intermediary processes your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of the limitation period after their conclusion. The legitimate interests here are the protection of legal claims and the control of the proper provision of services. In the area of accounting and taxes, personal data may be processed for up to 10 years from the end of the taxation period in which the transaction took place, on the grounds of fulfilling the legal obligations laid down by the Accounting Act or the Value Added Tax Act. 7) the provision of services to clients and to those who are the recipients thereof. For this purpose, personal data may be processed for the duration of the contractual relationship, on the basis of performance under the concluded contract. Personal data, contact data, accounting data and information about the services provided are processed. After this period, personal data are further retained on the basis of a legitimate interest for the purpose of protecting legal claims and internal records and control, for a period of 4 years (the limitation period of 3 years and one year after its expiry) with regard to claims raised at the end of the limitation period. In the event that judicial, administrative or other proceedings are commenced, the Intermediary processes your personal data to the extent necessary for the entire duration of such proceedings and the remaining part of the limitation period after their conclusion. The legitimate interests here are the protection of legal claims and the control of the proper provision of our services. 8) dissemination of information, news and other business communications via email messages, on the basis of the Intermediary's legitimate interest, whereby the personal and contact data of existing clients are processed. Personal data may be processed for an indefinite period until the moment when the contract between the Intermediary and the client is terminated. 9) in connection with the services provided by the Intermediary, the personal data of third parties are retained. The Intermediary processes in particular identification data, contact data and information related to the services provided by the Intermediary. For this purpose, personal data may be processed for a period of 5 years from the termination of the contractual relationship with our client. See more on this in the Provision of Services section. 10) persons subscribed to the receipt of news and other business communications, on the basis of prior consent. Identification and contact personal data are processed in accordance with Act No. 420/2004 Coll. For this purpose, personal data may be processed for an indefinite period until the moment when the recipient unsubscribes. 11) fulfilment of legal obligations is the reason why we process your identification and contact data and data about orders. Decisive in this matter are in particular Act No. 89/2012 Coll., the Civil Code, Act No. 634/1992 Coll., on Consumer Protection, Act No. 235/2004 Coll., on Value Added Tax, and Act No. 563/1991 Coll., on Accounting. For these purposes, the Intermediary uses personal data for the period required by the relevant legal regulation, for a maximum of 10 years, unless a legal regulation stipulates a longer period in the future. 12) the Intermediary also processes personal data on the basis of a legitimate interest for the purpose of obtaining information on the basis of which the Intermediary's services will be improved in the future and for the provision of tailored offers and targeted advertising, which may be displayed to you on the Website. Security All processed personal data are secured by appropriate organisational and technical measures. Security procedures and technical and physical restrictions on access to and use of personal data on the Intermediary's servers are also used. Access to personal data is available only to authorised personnel who work with the data. Recipients of personal data Recipients of personal data are natural or legal persons, or a public authority, agency or other body to which personal data are disclosed. However, public authorities which may obtain personal data in the framework of a particular inquiry in accordance with the law of a Member State are not regarded as recipients; the processing of those personal data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing. The Intermediary applies the highest possible standard of personal data security. Only when strictly necessary does it share, to the necessary extent, personal data with its contractual partners - lawyers, IT services, etc. However, with all these entities the Intermediary first concludes a personal data processing agreement, which guarantees that the personal data will be handled with respect, with maximum protection against misuse and further dissemination, and only to the necessary extent. The Intermediary transfers personal data to the following recipients, who have concluded the relevant personal data processing agreement, for the fulfilment of the necessary purposes under the GDPR: A. Entities that may process your personal data for the purposes of contract performance: Your personal data may also be transferred by the Intermediary to other entities acting in the role of controller, namely to all service providers involved in the provision of the services you have purchased. B. Entities that may process your personal data for the purposes of providing delivery and accounting services: C. Entities that may process your personal data for the purposes of protecting the property and legally protected interests of the controller, and protecting the life and health of employees and clients: D. Entities that occasionally process personal data for the purposes of marketing or improving the quality of services: Google Analytics and Facebook Pixel E. Entities that occasionally process personal data for purposes related to the exercise of labour-law obligations: Period for which personal data are stored The basic period for which personal data are stored is always specified in the contract concluded between the client and the Intermediary. Unless expressly stated otherwise, • the personal data of potential clients who provided their personal data but did not conclude a contract are stored for a period of 1 year, for record-keeping purposes; • for record-keeping purposes, the personal data of clients are stored for a period of 5 years from the moment the effectiveness of the contract terminates. Other data retained All other information and personal data that clients provide about other natural persons with whom they cooperate, or whose data are necessary for the performance of the contractual relationship, are also retained. The client is obliged to inform these persons in a similar manner about the transfer of their personal data by the Intermediary. The INTERMEDIARY once again emphasises that you may SIMPLY WITHDRAW YOUR CONSENTS to the provision and processing of personal data by notifying SANDO MORAVA s.r.o., or info@sando-morava.cz. Use these methods to also send any OBJECTIONS you may have to the processing of personal data. Your rights 1. Under the conditions laid down in the GDPR you have • the right of access to your personal data pursuant to Article 15 of the GDPR. You thus have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, the right of access to those personal data and to the following information: - the purposes of the processing; - the categories of personal data concerned; - the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; - the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period; - the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or restriction of processing thereof and/or to object to such processing; - the right to lodge a complaint with a supervisory authority, see below; - all available information about the source of the personal data, where they are not collected from the data subject; - the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. • the right to rectification of personal data pursuant to Article 16 of the GDPR. You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. • the right to erasure of personal data pursuant to Article 17 of the GDPR, in particular where: - the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; - the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), and where there is no other legal ground for the processing; - the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); - the personal data have been unlawfully processed; - the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; - the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). • the right to object to processing pursuant to Article 21 of the GDPR; In all cases of processing of personal data by the Intermediary, the client has the right to object to such processing. The objection is subsequently assessed, and if there are appropriate legal grounds for it, it will be granted. Above all, you have the right to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f), including profiling based on those provisions. The Intermediary shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. • the right to data portability pursuant to Article 20 of the GDPR. In particular, you have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and b) the processing is carried out by automated means. • the right to obtain information about a breach of the security of your personal data under the conditions laid down in Article 34 of the GDPR. • the right to withdraw consent to processing in writing or electronically at the address or email of the controller stated in these conditions, also pursuant to Article 7 of the GDPR. • the right to lodge a complaint with a supervisory authority under the conditions laid down in Article 77 of the GDPR, if you believe that the processing of your personal data infringes the obligations laid down in the GDPR. • the right to restriction of processing pursuant to Article 18 of the GDPR. You have the right to obtain from the controller restriction of processing in any of the following cases: - the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data; - the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; - the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; - the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject. 2. To supplement the right to lodge a complaint with a supervisory authority, the Intermediary states that you have the right to lodge a complaint with the Office for Personal Data Protection in the event that you believe that your right to the protection of personal data has been infringed, either at the address of its registered office Pplk. Sochora 27, Prague 7, postal code 170 00, by email, or by any other means that the Office for Personal Data Protection will accept. Further information about the Office can be found on the website www.uoou.cz. Final provisions 1. By submitting an order from the online order form, you confirm that you are familiar with the conditions for the protection of personal data and that you accept them in their entirety. 2. You agree to these conditions by ticking the consent box via the online form. By ticking the consent box, you confirm that you are familiar with the conditions for the protection of personal data and that you accept them in their entirety. 3. The controller is entitled to change these conditions. It will publish the new version of the conditions for the protection of personal data on its website, or send you the new version of these conditions to the email address you provided to the controller. 4. Further information about your rights can be found on the website of the Office for Personal Data Protection (ÚOOÚ): https://www.uoou.cz/6-prava-subjektu-udaj/d-27276. 5. Should you have any questions, do not hesitate to contact the Intermediary at the email info@sando-morava.cz, or by post at the address of its registered office. 6. Personal data are stored on a server with data storage located in the EU.