Principles for the protection and processing of personal data
Bc. Martin Šproch
Poolplast
Rychaltice 215, 739 46
ID: 87710277
Ensuring the information obligation of the personal data controller
Poolplast's personal data protection and processing policy is effective as of 25 May 2018. They are issued in accordance with Regulation (EC) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data ("Regulation" or "GDPR") in order to ensure the information obligation of the data controller pursuant to Article 13 GDPR.
Categories of personal data
Poolplast, as data controller, may process the following categories of personal data under the conditions set out below.
1. Personal identification data and address data
Such data include, in particular, title, name and surname, permanent address, address of registered office or place of business, name of the business company, date of birth, birth number, registration number, VAT number, billing address, VAT number, numbers of identification documents submitted and their copies (all data that cannot be copied are blacked out on copies of documents), bank connection, signature.
2. Contact details
Such data are in particular contact e-mail, telephone number.
3. Other data
These are in particular data provided by the data subject to the data controller for these purposes on the basis of consent, data available from regularly operated registers.
4. Operational data
These are data processed mainly for the resolution of any disputes arising from specific contracts, data arising from direct communication between Poolplast and the data subject, and for the purposes of accounting and the fulfilment of Poolplast's legal obligations.
5. Data processed on the basis of the data subject's consent
This is the processing of personal data that is not strictly necessary for the performance of a contract, the controller's legal obligations or the protection of Poolplast's legitimate interests. The purpose of the processing, especially when processing on the basis of Consent for business purposes, is to improve, speed up and enhance the quality of Poolplast's communication and services. These data are only processed if consent is given and may only be processed for the duration of the consent. Consent is revocable at any time.
6. Camera system, GPS, ČIP
In order to protect its own property and for security reasons only, Poolplast uses a camera system. The operation of the camera system is subject to strict rules and is only carried out to the extent necessary so as not to excessively interfere with the privacy of persons. This processing of personal data is necessary for the purpose of protecting Poolplast's legitimate interests and therefore Poolplast does not need the consent of the data subject to process this personal data. The GPS system is used exclusively for the purpose of checking that the company vehicles follow their official routes. The chips are used in the employees' department for the purpose of proper attendance records.
Purposes and legal grounds for processing personal data
The scope of the data processed depends on the purpose of the processing. For some purposes, data may be processed directly on the basis of a contract or a legitimate interest of Poolplast or on the basis of law, all without the consent of the data subject. For other purposes, personal data may only be processed on the basis of consent.
1. Processing for the performance of a contract, for the fulfilment of legal obligations and for the legitimate interests of Poolplast
The provision of personal data necessary for the performance of the contract, the fulfilment of Poolplast's legal obligations and the protection of Poolplast's legitimate interests is mandatory. Without the provision of personal data for these purposes, it would not be possible to contract, provide services or properly perform legal obligations. Processing for the performance of a contract and the fulfilment of legal obligations cannot be refused.
These are in particular the following sub-purposes: the fulfilment of statutory tax obligations (fulfilment of statutory obligations), billing (fulfilment of the contract), the purposes set out by specific laws for the purposes of criminal proceedings and for the fulfilment of the obligation to cooperate with the Police of the Czech Republic and other state authorities (fulfilment of statutory obligations).
Furthermore, debt recovery and other customer disputes (legitimate interest), securing evidence in case of the need to defend Poolplast's rights (legitimate interest of Poolplast).
2. Processing of Poolplast clients' data with consent
Poolplast, with the consent of the data subject, may process certain data beyond what is necessary for the performance of the contract and also for business purposes, on the basis of the Consent for Business Purposes, to create an appropriate offer of Poolplast's services to the client, to improve the quality of services and to possibly speed up and improve the level of mutual communication. The specific form(s) - e.g. by telephone, in writing, via internet advertising, by electronic communication - is always at the free disposal of the data subject who grants consent, if any. The controller carries out only the necessary processing to contact clients with suitable offers. The provision of consent is voluntary and revocable at any time. If the data subject withdraws his or her consent, this shall not affect the processing of his or her personal data by Poolplast for other purposes and under other legal titles, in accordance with this Poolplast Data Protection and Processing Policy Business communications may be sent to our clients' contacts on the grounds of Poolplast's legitimate interest, and only until the client has given his or her consent. Or on the basis of explicit consent to the processing of personal data for business purposes. In the commercial communications sent, there is a link to the contact to opt-out of receiving these communications.
Periods of processing of personal data, time limits
Personal data for the activities of Poolplast, are processed to the extent necessary for the fulfillment of these activities and for the period necessary to achieve them or for the period directly provided for by law. Thereafter, the personal data are erased, disposed of within the proper time limits.
In the case of Poolplast clients, Poolplast is entitled to process their basic personal, identification, address, contact and other and operational data in the client database for a period of 4 years from the date of termination of the last contract with Poolplast, if they have fulfilled all their obligations towards Poolplast.
If invoices are issued by the data controller in accordance with the Value Added Tax Act, they are archived for 10 years from the date of issue, in accordance with Article 35 of Act No. 235/2004 Coll., on Value Added Tax. The relevant contracts are also archived for 10 years from the date of termination of the contract due to the need to prove the legal reason for issuing the invoices.
The recordings made by Poolplast's camera system are continuously deleted from the relevant data storage within 3 days of their acquisition, at which point the data is replaced by the currently acquired recording. A longer archiving period of the CCTV footage is only permissible if the footage shows that there has been an unlawful interference with Poolplast's property or other rights and protected interests.
Regime of personal data provided in the context of negotiations which did not lead to the conclusion of a contract
In the event of negotiations between Poolplast and a potential prospect for the conclusion of a contract that did not result in the conclusion of a contract, Poolplast is entitled to process the personal data provided for a period of 3 months from the end of the relevant negotiations.
Other recipients of personal data
Poolplast uses the professional services of other entities in the performance of its obligations and duties under contracts. Insofar as these suppliers process personal data transmitted from Poolplast, they have the status of personal data processors. They process personal data only within the framework of the instructions given by Poolplast, in particular for the collection of outstanding debts, IT systems management, auditor, tax advisor, lawyer.
With all such entities, Poolplast enters into a personal data processing contract, in which the processor has obligations to protect and secure personal data, corresponding to the European standard.
Poolplast transfers personal data to the administrative authorities and authorities specified by the applicable legislation in the performance of its legal obligations.
Methods of processing personal data
Poolplast processes personal data both manually and by automated means and keeps proper records of such activities in which personal data are processed.
Information on the rights of data subjects
1. Right of access to personal data
According to Article 15 of the GDPR, the data subject has the right of access to personal data, which includes, on the one hand, the right to obtain from Poolplast a confirmation of the processing of personal data, the right to information about the purposes of processing, the categories of personal data that are processed. Furthermore, about the recipients to whom the personal data are disclosed and the duration of the processing. Furthermore, the data subject has the right to request from the controller the rectification or erasure of personal data concerning the data subject or the restriction of their processing or to object to such processing. He or she may request a copy of the personal data and, in the event of a repeated request, Poolplast shall be entitled to charge a reasonable fee for a copy of the personal data.
2. Right to rectification of inaccurate data
Pursuant to Article 16 of the GDPR, the data subject has the right to rectification of inaccurate personal data processed by Poolplast about him or her. The data subject has an adequate obligation to notify changes to his or her personal data and to provide evidence that such a change has occurred.
3. Right to erasure
Pursuant to Article 17 of the GDPR, the data subject has the right to have personal data concerning him or her erased, unless Poolplast demonstrates legitimate grounds for the processing of such personal data. Poolplast has set up mechanisms for the erasure of personal data when the purpose that determined the scope and parameters of the processing of personal data has passed.
4. Right to restriction of processing
According to Article 18 of the GDPR, the data subject has the right to restriction of processing until the complaint is resolved, if he or she contests the accuracy of the personal data, the grounds for processing or if he or she objects to the processing.
5. Right to notification of rectification, erasure or restriction of processing
The data subject also has the right under Article 19 GDPR to be notified by Poolplast in the event of rectification, erasure or restriction of the processing of personal data.
6. Right to data portability
Article 20 of the GDPR grants the data subject the right to the portability of data relating to him or her that he or she has provided to the controller in a structured, commonly used and machine-readable format, and the right to request Poolplast to transfer such data to another controller. The request may not be granted if, in a particular case, the rights and freedoms of third parties may be adversely affected.
7. Right to object to the processing of personal data
Pursuant to Article 21 of the GDPR, the data subject has the right to object to processing of his or her personal data on the grounds of legitimate interest of Poolplast. It is for Poolplast to demonstrate the existence of a legitimate reason for the processing which overrides the interests or rights and freedoms of the data subject. Otherwise, Poolplast shall terminate the processing without undue delay on the basis of the objection.
8. Right to withdraw consent to the processing of personal data
Consent to the processing of personal data is revocable at any time, in the same simple form in which it was given.
Automated decision-making
Poolplast does not carry out automated decision-making.
Right to contact the Data Protection Authority
The data subject has the right to contact the Data Protection Authority www.UOOU.cz.
Contact person for thePoolplast dataprotection agenda
E-mail: poolplast@gmail.com