LUWEX, a.s.

INFORMATION ON THE PERSONAL DATA PROCESSING

according to Articles 12, 13 and 14 of the GDPR (hereinafter as the “Information”)

The information describes how the controller Luwex, a.s., with its registered office at Stará Spojovací 2418/6, 19000 Praha 9, Czech Republic ID number: 00138207, registered with the Commercial Register of the City Court in Prague, process personal data obtained through the contact form on the website www.luwex.cz/covid-19. If something from this Information is unclear or incomprehensible to you, we will be happy to explain any term or part to you. We process personal data in accordance with the requirements of the GDPR, Act no. 18/2018 Coll. on the protection of personal data and on the amendment of certain laws as amended and other generally binding legal regulations.

1. BASIC TERMS

a. Personal data – any information concerning an identified or identifiable natural person, such as name, surname, name of the district / company, city, e-mail address, telephone number, customer additional comments, etc.

b. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC (General Data Protection Regulation).

c. Data subject – a natural person to whom personal data relate.

d. Personal data processing – the activity or processing operations that the controller or processor carries out with personal data.

e. Controller – a natural person or legal entity that determines the purpose and means of personal data processing.

f. Purpose of personal data processing – a clearly defined or established intention to personal data process, which is linked to a certain activity.

g. Legitimate interest – the interest of the controller or of a third party which implies the need to process personal data if it does not outweigh the interests or fundamental rights and freedoms of the data subject.

h. Recipient – a natural or legal person, public authority, agency or other subject to which personal data are provided.

i. Client – a natural person to whom we provide a service.

2. PERSONAL DATA CONTROLLER

The joint controllers of personal data are:

3. PURPOSES AND LEGAL BASIS OF PROCESSING

4. LEGAL INTERESTS OF THE CONTROLLER OR A THIRD PARTY

5. BENEFICIARIES AND TRANSFER TO A THIRD COUNTRY

The data obtained through the web form shall not be made available by the joint controllers to any recipients and shall not be transferred to a third country or to an international organization.

6. STORAGE PERIOD

We store personal data in a form that allows identification for a maximum period of time that is necessary to achieve the purpose for which the personal data are processed. The data will be kept for the duration of the contractual relationship with the controller until the expiry of the limitation periods from the contractual relationship or until the end of the settlement of the demand, in the event that the contractual relationship is not concluded.

7. RIGHTS OF THE DATA SUBJECT

The data subjects have the following rights:

a. Information on the personal data processing

The content of the information includes in particular the identity and contact details of the controller, processing purposes, categories of personal data concerned, recipient or categories of recipients of personal data, information on personal data transfers to third countries, storage period, authorized controllers, list of your rights, possibility to contact Office for Personal Data Protection of the Czech Republic, source of processed personal data, information on whether and how automated decision-making and profiling occurs.

b. Right of access to personal data

You have the right to confirmation whether or not personal data are being processed and, if so, you have the right to access information on the purposes of the processing, the categories of personal data concerned, recipients or categories of recipients, storage period of personal data, information on your right to submit complaint to the Office for Personal Data Protection of the Czech Republic, information on the source of personal data, information on whether there is automated decision-making and profiling, information and guarantees in case of transfer of personal data to a third country or international organization. You have the right to be provided with a copy of the personal data processed.

c. Right of correction

The data subject has the right to correction incorrect personal data. With regard to the purpose of the processing, the data subject has the right to supplementation incomplete personal data, including by providing a supplementary declaration.

d. Right to erase (right to be forgotten)

In some cases, stipulated by law, we are obliged to delete the personal data of the data subject. However, each such request is subject to an individual assessment of whether the conditions are met, because, as the controller, we may be bound by a legal obligation or we may process personal data on the basis of a legitimate interest. If our legitimate interest (or the legitimate interest of a third party) outweighs the interests of the data subject, we are entitled to further process the personal data for the purpose in question.

e. Right to restriction of the processing

The data subject may request the controller to restrict the processing of personal data if any of the following situations occurs:

– the data subject has denied the accuracy of the personal data for the time necessary for the controller to verify the accuracy of the personal data;

– the processing of personal data is unlawful, but the data subject refuses to delete the data and instead requests a restriction on their use;

– the controller no longer needs the personal data for the purposes of processing, but requests the data subject to determine, enforce or defend legal claims;

– the data subject has objected to the processing of personal data in specific situations under the GDPR (public interest task, legitimate interest of the controller or profiling), until it is verified that the legitimate interests of the controller outweigh the legitimate interests of the data subject.

f. Right to data portability

If the data subject requests that we transfer his personal data to another controller, we shall transfer the personal data in the appropriate format, unless we are prevented from doing so by any legal or other significant obstacles, to the designated entity.

g. The right to object to automated individual decision-making

The data subject may at any time object to the processing of personal data by the controller for the purposes of direct marketing carried out on the basis of a legitimate interest of the controller and whenever we process personal data on the basis of a legitimate interest or public interest, including profiling.

h. Consent-based processing (right to withdraw consent)

Where the processing is based on the consent of the data subject within the meaning of Article 6 (1), 1 letter (a) of the GDPR or Article 9 (1); 1 letter a) of the GDPR, the data subjects have the right to withdraw their consent at any time. Such withdrawal of consent shall not affect the lawfulness of processing based on the consent given prior to its withdrawal.

i. The right to submit a proposal, complaint, complaint to the supervisory body

The data subjects may at any time file a proposal, initiative or complaint regarding the processing of personal data with the supervisory body, which is the Office for Personal Data Protection of the Czech Republic, with its registered office at Pplk. Sochora 27 170 00 Praha 7, Czech Republic, tel. no.: +420 234 665 800, website: www.uoou.cz.

Deadline for reply

We will provide a statement and, if necessary, information on the measures taken as soon as possible, but no later than within one month. We are entitled to extend the deadline by two months if necessary and due to the complexity and number of applications. We will inform the data subject about the extension of the deadline, including the reason.

Contact point

The individual rights may be exercised by the data subjects with the controller by e-mail address: info@luwex.cz or in writing to the correspondence address: Stará Spojovací 2418/6, 190 00 Praha 9, Czech Republic.

We provide all notices and statements about the exercised rights free of charge. However, if the request is manifestly unfounded or disproportionate, in particular because it is repeated, we are entitled to charge a reasonable fee taking into account the administrative costs or to refuse to act on the request. In the case of repeated applications for copies of processed personal data, we reserve the right to charge a reasonable fee for administrative costs.

8. PROVISION OF PERSONAL DATA

The provision of personal data to the web form is voluntary, and therefore the provision of data to us as the controller, as we are a private entity, is not a legal requirement. If you are interested in concluding a contract with us, the provision of personal data may be necessary for the conclusion of a contract. In this case, the provision is a contractual requirement. The data subject is not obliged to provide his personal data, he provides it voluntarily. Refusal to provide personal data does not have negative consequences for the data subject.

9. AUTOMATED DECISION-MAKING AND PROFILING

The controller does not use the so-called automated individual decision-making, including profiling.

10. PROCESSING FOR ANOTHER PURPOSE

When processing, we respect the principle of limiting the purpose limitation, it means that we process data only on the basis of a specified, explicitly stated and legitimate purpose, except in the case of processing for a compatible purpose. Processing for another purpose may also be based on the consent of the person concerned, European Union law or the law of Czech Republic. To find out whether another purpose is compatible with the purpose for which the personal data were originally obtained, before processing, we perform the so-called compatibility test, in which we take into account:

a. any link between the purposes for which the personal data were obtained and the purposes of the intended further processing;

b. the circumstances in which the personal data were obtained, in particular as regards the relationship between the data subjects and the controller;

c. the nature of the personal data, in particular whether specific categories of personal data are processed pursuant to Article 9 of the GDPR or personal data relating to the criminalization of criminal offenses and offenses pursuant to Article 10 of the GDPR;

d. the possible consequences of the intended further processing for the persons concerned;

e. the existence of adequate safeguards, which may include encryption or pseudonymisation.

11. OVERVIEW OF SELECTED LEGISLATION IN THE FIELD OF PERSONAL DATA PROTECTION

– Charter of Fundamental Rights of the European Union (Article 8);

– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC (General Data Protection Regulation);

– Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (consolidated version);

– Act no. 351/2011 Coll. on electronic communications, as amended;

– Constitution of the Czech Republic;

– Act no. 18/2018 Coll. on the protection of personal data and on the amendment of certain laws as amended;

– Decree Office for Personal Data Protection of the Czech Republic on the procedure for assessing the impact on personal data protection.

12. CHANGES TO THE RULES FOR THE PROCESSING OF PERSONAL DATA

We are entitled to change the wording of these rules for the processing of personal data, especially in the case of the need to incorporate legislative changes or changes in the purpose and means of processing. In the event that there are changes in the rules of personal data processing that would be capable of affecting the rights of the data subjects, we will notify them in a suitable manner in good time.

This document is regularly updated.

Last update: 17.03.2021

© Copyright 2020 Luwex, a.s.