The principles of the company STAVOS Brno, a.s. applying to the processing and protection of personal data

The company STAVOS Brno, a.s. (hereinafter merely the “Company”) has adopted these principles for the processing of personal data in connection with Regulation (EU) No. 2016/67 of the European Parliament and of the Council (the General Data Protection Regulation, also known as GDPR) coming into force.

Their aim is to provide all natural persons whose personal data we process (data subject or subjects) with a clear and comprehensive account of the personal data processed, information about the purpose for which we process it, the legal grounds for this processing and the period for which we process this personal data, to whom and why we communicate this data, and, first and foremost, to provide natural persons with a clear account of their rights and the procedures they can use to exercise these rights in respect of the Company or the public authorities.

 

1. Whose personal data do we process?

We process the personal data of:

• our customers, i.e. persons who have closed a contract of purchase or a contract for work or a similar business contract with our Company,
• potential customers, i.e. persons with whom our Company is engaged in negotiations for the purpose of the preparation of a contract (an order, client changes and requirements, the assessment of defects), even though no contract has yet been closed (our Company processes the personal data of potential customers even in cases in which negotiations on the closure of a contract are terminated before it is closed and no business transaction is executed), and other persons who are to participate in any contract closed,
• contractual partners and suppliers who provide us with services, perform work or individual parts of a work for us, or supply us with their products,
• job applicants who have contacted us and expressed an interest in employment at our Company,
• parties interested in our Company, i.e. persons who have contacted us by e-mail or telephone, who have asked us a question on our website, or who have entered into communication with us using other electronic services,
• subscribers to our newsletters or offers, i.e. people who have signed up to receive our newsletters or offers or have requested that we send them an offer.

The Company processes the personal data of the aforementioned natural persons (also known as data subjects under the GDPR) as a personal data administrator, as it chooses the purposes and means of processing itself and is responsible for the processing it performs being in accordance with the principles and procedures of the GDPR.

 

2. What personal data do we process?

• identification data: enabling us to identify the person with whom we are communicating or to whom we are providing services, for example: forename and surname, and, in the case of our customers and contractual partners and suppliers, also their place of residence, registered office or place of business, date of birth, company registration number, VAT number, name of business company, etc.,
• contact data: enabling us to contact you, in particular e-mail address, telephone number, mobile phone number, IP address, etc.,
• data that you create by your activity: we obtain this personal data on the basis of communication with you and the provision of our services,
• personal data arising from the contractual relationship established and the provision of services (data on contracts closed, type of work performed or completed, payment history, amendments to contracts, client changes, complaints relating to defects, etc.),
• personal data obtained on the basis of communication between our Company and a natural person (IP address, written records of personal communication, written and electronic communication, etc.),
• data from an internet browser – in the event that a natural person allows cookies on their web browser, our Company obtains analytical data about the behaviour of this natural person on the internet (more-detailed information about cookies is always provided on the website).

 

3. What legal reason do we have for processing your personal data?

Since our Company collects the personal data given above, it has the status of a personal data administrator and is obliged to comply with the valid legal regulations when processing it, in particular EU Regulation 2016/679 – General Data Protection Regulation (GDPR).

We are authorised to process the personal data you provide without your consent, because its processing is essential to:

1. the fulfilment of a contract to which the customer or business partner is a contracting party or the performance of measures taken before the closing of a contract or the drawing up of an offer at the customer’s request or in relation to a customer order,
2. the fulfilment of a legal obligation of the Company (e.g. accounting and tax regulations, building regulations, obligations arising from the law on public procurement or obligations arising from the law on consumer protection, etc.),
3. the Company’s legitimate interests – in particular the purposes of keeping records of existing customers, records of contractual relationships with customers and business partners, tax and accounting records, handling complaints, client changes and claims, preventing unlawful conduct towards customers, debt collection, offering other Company products to the customer.

When the Company sends commercial communications to data subjects, we comply with the provisions of Act No. 480/2004 Sb. on certain information society services.

 

4. The extent and period of personal data processing

We always process your personal data only to the extent strictly necessary according to the type of services we provide you or according to the nature of business relationships with business partners and to the extent stipulated by the legal regulations by which we are bound in our business dealings.

The extent of the personal data processed about customers, potential customers and business partners arises from the legal regulations governing the closing of contracts of purchase and contracts for work or other business obligations.

In other cases, we process only the information that you provide us with when communicating with our Company (this is generally an e-mail address, telephone number, the registration number of a natural person engaged in business or the identification data of statutory representatives of business corporations or associations). We also process your IP address if you communicate with us using a computer.

The period of personal data processing is determined first and foremost by the legal regulations relating to our business activities (in particular the obligation of demonstrating compliance with tax obligations and the proper keeping of accounts, the performance of audits, etc.), according to which we are obliged to keep documents in which your personal data is given.

 

For this reason, we process the personal data:

• of our customers or other persons with whom we close a contract, this for a period of 10 years of the closure of the most recent valid contract,
• of potential customers, this for a period of 5 years of the last contact with the given person,
• of our business partners, this for a period of 10 years from the closure of the most recent contract,
• of job applicants, this for the duration of the selection procedure + 5 years,
• of those interested in our Company, this for a period of 5 years from the last contact between us and the interested party.

 

5. What is the source of the personal data we process and with whom do we share your personal data?

We process only personal data that you provide to us or that you create yourself by your activity and data from publicly accessible registers operated by bodies of the public administration.

We do not obtain any personal data from third parties and we do not purchase any databases of personal data or trade personal data in any other way.

We share the personal data that we obtain from you exclusively with entities that provide us with certain services and deliveries and that guarantee a high standard of protection of the personal data processed. This involves, first and foremost:

• entities that provide our Company with accounting, tax, human resources, payroll or legal services,
• our business partners, if personal data is essential to them for the fulfilment of contractual or other legal obligations towards our Company, for the purpose of the fulfilment of a contract between you and our Company, or for the purpose of resolving client requests or complaints,
• providers of IT services – entities providing our Company with webhosting services and website administrators.

 

We do not share personal data with or sell personal data to third parties, and we do not provide it to recipients in other countries. We are obliged within the scope of the authorisation stipulated by the law to provide processed personal data on request to state authorities, courts and supervisory bodies designated by the state.

 

6. What rights do you have in connection with the processing of your personal data?

• You have the right to request access to your personal data of our Company for the purpose of determining the extent of the personal data we process about you. You will receive written information from us about all the personal data we process about you. The rights of other data subjects may not, however, be thereby affected and the handling of repeated requests relating to the same content or requests that are clearly harassing and pointless will be subject to a charge of 500 CZK for each such request,
• You have the right to request that our Company corrects your personal data. We will correct or supplement any inaccurate or outdated personal data at your request,
• You have the right to request that our Company restricts the processing of your personal data in specific cases, in particular if you dispute the accuracy of your personal data, if you have raised an objection to the processing of your personal data by our Company, or if you refuse its deletion for reasons of protecting your legal claims or do not agree to its deletion and instead request the restriction of the processing of your personal data,
• You have the right to request that our Company erases the processed personal data (the right to be forgotten) in the cases specified in the GDPR. We will not be able to comply with this in situations in which we are legally obliged to process your personal data for a statutory period,
• You have the right to raise an objection to the processing of your personal data if the reason for its processing is the legitimate interest of our Company. In such case, we are obliged to terminate the processing of your personal data unless the Company has compelling legitimate grounds for this processing that outweigh your interests or rights and freedoms (in particular if the given personal data is essential to the exercising or enforcement of existing legal claims of our Company),
• You have the right to raise an objection to the processing of your personal data if the given processing is being performed for the purposes of direct marketing. We will cease the processing of your personal data for this purpose on the basis of your written objection without undue delay,
• You have the right to the transferability of your personal data processed by our Company in the event that the processing of your personal data is based on a contract or the preparation of a contract or on the basis of the consent you have provided and the processing is performed automatically. We will provide you with your personal data in an ordinary machine-readable format or will provide it to a person you designate.

If you do not want us to send you information about our news, special offers, etc. to your e-mail address, the given message always give you the option of notifying us that you no longer wish us to send you further commercial communications and we will stop doing so.

 

7. How can you exercise your rights in respect of our Company?

You can exercise your rights relating to the processing of personal data only in writing in paper form by sending it to the address of our registered office.

It is, therefore, necessary that your signature is officially verified for the purpose of your identification for the exercising of your rights in order to prevent your personal data from being transferred to a third party and to prevent any other illegal operation being performed on it.

On the basis of the facts verified in this way, we will register your exercising of your rights and will inform you of the measures we have taken on the basis of your exercising your rights within 30 days of delivery to the address of our registered office.

We would like to notify you of the fact that we are entitled to refuse evidently unfounded or unreasonable requests relating to the right of entities or to impose a reasonable fee for their settlement (a minimum of 500 CZK) taking into account the administrative costs associated with the settlement of the given request.

 

8. The right to lodge a complaint with the supervisory authority

You have the right to file complaints against the processing of your personal data by our Company or if you believe that our Company is not fulfilling its obligations relating to the processing of your personal data to the supervisory authority in the Czech Republic, which is the Office for Personal Data Protection.

 

These Principles of the Company STAVOS Brno, a.s. are valid as of 25 May 2018