Declaration

Terms of personal data processing

PERSONAL DATA PROCESSING POLICY

This Personal Data Processing Policy (hereinafter the "Policy") of CSGM a.s., having its registered office at U Rustonky 714/1, Prague 8, 186 00, Czech Republic, ID No.: 013 84 694, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, File 19596 (hereinafter the "CSGM" or "we") contains information about the basic circumstances of the processing of personal data.

We process personal data, including personal data of data subjects located outside the European Union/European Economic Area (hereinafter the "EU"), in accordance with applicable EU law, in particular the General Data Protection Regulation (EU) 2016/679 ("GDPR"). In the event of specific requirements for the processing of personal data in jurisdictions outside the EU, if these impose obligations on us as data controllers beyond the scope of the GDPR, we also respect these local specifics when processing personal data.

This Policy contains the following information:

  1. IDENTIFICATION OF THE DATA CONTROLLER
  1. PURPOSE, SCOPE AND LEGAL BASIS OF THE PERSONAL DATA PROCESSED
  1. CLIENT
  1. BUSINESS PARTNER
  1. JOB APPLICANT
  1. WEBSITE VISITOR
  1. VISITOR TO OUR PREMISES MONITORED BY CCTVVISITOR TO OUR PREMISES MONITORED BY CCTV
  1. A PARTICIPANT IN EVENTS THAT WE ORGANISE OR PARTICIPATE IN
  1. PROCESSING OF PERSONAL DATA ON THE BASIS OF CONSENT
  1. RECIPIENTS OF PERSONAL DATA
  1. PERSONAL DATA OF THIRD PARTIES
  1. RETENTION PERIOD OF PERSONAL DATA
  1. RIGHTS OF DATA SUBJECTS
  1. CODE OF CONDUCT FOR THE HANDLING OF PERSONAL DATA

IDENTIFICATION OF THE DATA CONTROLLER

CSGM is the controller of your personal data within the meaning of the GDPR, i.e. it collects, stores and uses (and otherwise processes) your personal data for the performance of its business activities.

You can contact the controller in the following ways:

Delivery address:CSGM a.s., Pernerova 691/42, Praha 8, Czech Republic

Contact e-mail: ochranaou@czechoslovakgroup.cz

PURPOSE, SCOPE AND LEGAL BASIS OF THE PERSONAL DATA PROCESSED

We may process your personal data primarily for the following purposes:

contract performance (in particular, the performance of contracts with our business partners, including pre-contractual measures);

compliance with legal obligations (in particular obligations within the meaning of accounting and tax legislation, i.e. the transfer of personal data to the financial administration authorities or other public authorities in accordance with the relevant legislation);

protection of our legitimate interest (e.g. protection of our website and network against misuse, operation of CCTV on our premises, protection of our know-how);

effective communication (especially to facilitate the establishment of business negotiations, to preserve your preferences, etc.);

handling requests received via email and contact forms;

sending commercial messages (newsletter) and targeting advertising.

CLIENT

If you are our customer, we usually process your personal data as follows:

Purpose of processing

  • Performance of the contract, including delivery of goods, handling of complaints, etc.
  • Management of accounting and financial works
  • Settlement of questions, suggestions, comments
  • Sending commercial messages - on the basis of our legitimate interest in promoting sales by sending you commercial messages relating to our goods or services similar to those you have ordered from us. You can refuse to receive commercial messages at any time
  • Personalisation of the content of commercial messages - only with your consent

    • Scope of personal data

  • Identification data (in particular name and surname, registration number, VAT number, personal document number)
  • Contact details (in particular contact and/or delivery address, e-mail, telephone number, address)
  • Payment data (in particular account number, information on payments made, information necessary to prove compliance with the Act on Certain Measures against the Legalization of Proceeds of Crime and Terrorist Financing)
  • Other data (in particular information about orders, deliveries, complaints, text of rating/review, text of request/comment/question)
  • Date of birth for the purpose of verification of age of majority

    • Legal basis for processing

  • Performance of the contract pursuant to Article 6(1)(b) of GDPR
  • Compliance with legal obligations to which we are subject under Article 6(1)(c) of GDPR
  • Protection of our rights and legitimate interests under Article 6(1)(f) of GDPR
  • Your consent pursuant to Article 6(1)(a) of GDPR

    • BUSINESS PARTNER

    If you are our business partner (supplier), we usually process your personal data as follows:

    Purpose of processing

  • Performance of the contract
  • Management of accounting and financial works

    • Scope of personal data

  • Identification data (in particular name and surname, registration number, VAT number)
  • Contact details (address, e-mail, telephone number)
  • Payment details (account number, bank, information on payments made)
  • Other data (especially information about orders, deliveries, complaints)

    • Legal basis for processing

  • Performance of the contract pursuant to Article 6(1)(b) of GDPR
  • Compliance with legal obligations to which we are subject under Article 6(1)(c) of GDPR
  • Protection of our rights and legitimate interests under Article 6(1)(f) of GDPR

    • JOB APPLICANT

    If you apply for a job with us, we usually process your personal data as follows:

    Purpose of processing

  • Pre-contractual measures
  • Maintaining a database of job applicants (only with your consent)

    • Scope of personal data

  • Identification data (in particular name and surname)
  • Contact details (address, e-mail, telephone number)
  • Other information (in particular, information provided in your CV and cover letter, or other information you voluntarily provide to us as part of the selection process)

    • Legal basis for processing

  • Pre-contractual measures pursuant to Article 6(1)(b) of GDPR
  • Protection of our rights and legitimate interests under Article 6(1)(f) of GDPR
  • Your consent pursuant to Article 6(1)(a) of GDPR

    • WEBSITE VISITOR

    When you visit a website operated by CSGM ("Website"), cookies may be activated, which are small text files containing short data that may be stored on your device when you visit the Website. We use cookies on the Website for the following purposes:

    1. remembering the logged-in user;
    1. adding to cart and ordering;
    1. evaluating user movement on the web;
    1. obtaining voluntary feedback and
    1. personalisation of display ads.

    All personal data is processed in a lawful and transparent manner and only adequate, relevant and necessary data in relation to the purpose of the processing is required. Further information is available in the current version here.

    LINKS TO THIRD PARTY WEBSITES

    Links to the websites of other entities are placed on our Website in order to make our Website more interesting for you as a user. You will only be redirected to the relevant website if you actively click on the link. In this case, your web browser will open the corresponding page. Please note that the personal data processing settings are governed by the policies of the respective website, which are beyond our control.

    VISITOR TO OUR PREMISES MONITORED BY CCTV

    If you visit our premises that are monitored by CCTV, we usually process your personal data as follows:

    Purpose of processing

  • Ensuring protection of health and property

    • Scope of personal data

  • Identification data (name, surname, personal document number)
  • Other data (image record)

    • Legal basis for processing

  • Protection of our rights and legitimate interests under Article 6(1)(f) of GDPR
  • Further information on such processing is always available within the respective monitoring site.

    • PARTICIPANT IN EVENTS WE ORGANISE OR PARTICIPATE IN

    If you participate in events that we organise or you provide us with your personal data in the context of events that we otherwise participate in (e.g. events, exhibitions, etc.), we usually process your personal data as follows:

    Purpose of processing

  • Pre-contractual measures
  • Maintaining a database of potential customers / partners (only with your consent)

    • Scope of personal data

  • Identification data (in particular name and surname)
  • Contact details (address, e-mail, telephone number)
  • Other data (data you voluntarily provide to us)
  • Other data (photo and video record of the event)

    • Legal basis for processing

  • Pre-contractual measures pursuant to Article 6(1)(b) of GDPR
  • Protection of our rights and legitimate interests under Article 6(1)(f) of GDPR
  • Your consent pursuant to Article 6(1)(a) of GDPR

    • PROCESSING OF PERSONAL DATA ON THE BASIS OF CONSENT

    If you consent to the processing of your personal data for the purposes of sending you commercial messages and targeting advertising, you acknowledge that your consent is voluntary and that you may withdraw your consent at any time. Consent is usually granted for a period of 5 years or until revoked.

    RECIPIENTS OF PERSONAL DATA

    We only disclose your personal data to authorised employees or individual data processors contracted by CSGM or other data controllers. These are e.g. processors or controllers involved in the delivery of goods/services, making payments, providing marketing services. However, only to the extent necessary for the fulfilment of the individual purposes of processing and on the basis of the corresponding legal title for the processing of personal data. The current list of recipients of CSGM personal data is available upon request.

    For the purposes set out in this Policy, we may also transfer personal data to recipients and processors based outside the EU in certain cases. In the case of transfers of personal data to countries outside the EU, if required by applicable data protection legislation, we undertake to take additional measures to ensure adequate protection of personal data through the Standard Contractual Clauses, the current version of which is available at https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:32021D0914.

    In the cases provided for by law, we are entitled or obliged to transfer certain personal data to law enforcement authorities or other public authorities on the basis of applicable legislation, for example.

    PERSONAL DATA OF THIRD PARTIES

    Personal data of third parties, which means personal data of employees of our business partners, carriers and other individuals involved in cooperation with us, or other data we receive in connection with the conclusion or performance of a contract, will be processed in accordance with the GDPR. We will use this personal data for the purpose of fulfilling contracts with business partners. The business partner hereby acknowledges that we will process the personal data of these third parties for the duration of our contractual relationship and for the period of time stipulated by special legal regulations, if any. They will then be kept for a longer period of time if there is a justified need to keep the data in relation to a specific case. The business partner is obliged to properly instruct its employees and other natural persons involved in the business partner's cooperation with us on the processing of personal data by CSGM.

    RETENTION PERIOD OF PERSONAL DATA

    We process and store your personal data for the period of time necessary to ensure all rights and obligations arising from the relevant contractual relationship and for the period of time for which we are obliged as a data controller to store personal data under generally binding legal regulations or for which you have given us your consent to the processing. In other cases, the processing period is based on the purpose of the processing, which must be proportionate, or is determined by data protection legislation.

    Performance of the contract

  • for the duration of the contract and for a period of 10 years from the termination of the contract

    • Fulfilling legal obligations

  • for the period of time specified by the relevant legislation

    • Protecting our legitimate interest

  • for a maximum period of 3 years from the start of processing, unless otherwise provided for in specific legislation or unless there is a justified need to keep the data for a longer period in connection with a specific case
  • in the case of CCTV recordings, for the period specified in the separate information available at the monitored location; unless the need to keep the recordings for a longer period arises in relation to a specific case/situation, this is up to 72 hours

    • Handling your requests sent via e-mail or contact forms

  • for the time necessary to process the relevant request

    • Effective communication

  • for a maximum period of 3 years from the start of the processing, or until your consent to the processing is withdrawn

    • Sending commercial messages

  • for as long as consent is given to receive commercial messages and targeting of advertising, or until consent to processing is withdrawn, or in accordance with applicable law*

    • Pre-contractual measures

    For the duration of the contract negotiations (during the tendering process) and for a maximum of 6 months after its completion

    * We are entitled to process your e-mail address within the meaning of Section 7(3) of Act No. 480/2004 Coll., on certain information society services and on amendments to certain acts (Act on certain information society services), as amended, for the purpose of disseminating commercial messages concerning our own products or services (e.g. in the form of a newsletter) in the event that you have not refused such sending.

    RIGHTS OF DATA SUBJECTS

    As a data subject, you have the following rights under the law, which you can exercise at any time. This includes the right (i) to access personal data, (ii) to rectification of inaccurate or false personal data, (iii) to erasure of personal data if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed or if it is established that they were processed unlawfully, (iv) to restriction of processing of personal data, (v) to the portability of the data; and (vi) the right to object, after which the processing of your personal data will be terminated unless it is demonstrated that there are compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, in particular if the ground is the enforcement of legal claims. You also have the option of contacting the relevant supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (in Czech: Úřad pro ochranu osobních údajů) (www.uoou.cz), to whom you can lodge a complaint.

  • Right of access to personal data: if you want to know whether we are processing personal data about you, you have the right to be informed whether your personal data is being processed and, if so, you also have the right to access your personal data.
  • Right to rectification of inaccurate and false personal data: if you believe that we are processing inaccurate or false personal data about you, you have the right to request its rectification. We will carry out the repair without undue delay, taking into account the technical possibilities.
  • Right to erasure: if you ask us to erase it, we will erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) the processing is not required by law.
  • Right to restriction of processing of personal data: if you are not interested in erasure but only in temporary restriction of processing of your personal data, you can request us to restrict the processing of your personal data.
  • Right to data portability: if you want us to transfer your personal data that we process on the basis of your consent or on the basis of a contract to a third party, you can exercise your right to data portability. If the exercise of this right could adversely affect the rights and freedoms of third parties, we will not be able to comply with your request.
  • Right to object: you have the right to object to the processing of personal data that is processed for the purposes of protecting our legitimate interests. If we do not demonstrate that there is a compelling legitimate reason for the processing which overrides your interests or rights and freedoms, we will terminate the processing without undue delay on the basis of your objection. If the main reason for your objection is against the sending of commercial messages and the targeting of advertising, please use the link at the end of the last commercial message (newsletter) you received from us to unsubscribe from commercial messages and the processing of personal data for this purpose.

    • In the event of repeated or manifestly unjustified requests to exercise the above rights, we shall be entitled to charge a reasonable fee for the exercise of the right in question or to refuse to exercise the right. We would inform you of such a procedure.

    To exercise your rights, please contact us by letter to our registered office or by email to ochranaou@czechoslovakgroup.cz. We reserve the right to adequately verify the identity of the applicant for the rights in question.

    This Personal Data Processing Policy is effective from 25/05/2018

    Last updated date November 2023