INFORMATION ON THE PROCESSING OF PERSONAL DATA
for customers and business partners

 

 

EFFECTIVE FROM [1. 8. 2021]

 

Dear customers and business partners,

The purpose of this document is to acquaint you, as data subjects, with the basic principles of handling your personal data that you provide to the company UCED (hereinafter referred to as the "Company" or "Data Controller"), and to provide you with information on how the Company processes these personal data.

This document informs you about the extent and purpose of the processing of your personal data, who processes your personal data, to whom your personal data may be disclosed, what are the retention periods for your personal data, what are your rights in relation to the processing of your personal data, and whether there is automated processing of your personal data, including profiling, in connection with the processing of your personal data.

This document can also be found on the website www.uced.cz.

 

EXPLANATION OF BASIC TERMINOLOGY

For easier orientation in the area of processing your personal data, below is a terminological explanation of basic terms used by the Regulation of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”):

  • Personal data: According to the GDPR, personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Data subject: The data subject means an identified or identifiable natural person; in the context of this document, it refers to a natural person whose personal data are processed by the Data Controller in accordance with this document. Therefore, the data subject is exclusively a natural person to whom the personal data relate.
  • Processing of personal data: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
  • Processor of personal data: The entity that processes your personal data. The Controller is entitled to delegate the processing of your personal data to other processors.
  • Recipient of personal data: The entity to which your personal data are disclosed.

 

BASIC PRINCIPLES OF PROCESSING YOUR PERSONAL DATA

Your personal data is processed in a way that prevents unauthorized access to or unauthorized processing of your personal data.

The handling of your personal data is guided by the following principles:

  • PRINCIPLE OF ACCURACY, LEGALITY, FAIRNESS, AND TRANSPARENCY: The personal data controller manages your personal data accurately. The personal data controller processes your personal data on a legal basis, transparently, and fairly.
  • PRINCIPLE OF PURPOSE LIMITATION: Personal data are collected for specific, legitimate purposes and may not be processed in a manner incompatible with those purposes.
  • PRINCIPLE OF DATA MINIMIZATION: Personal data are adequate and relevant in relation to the purpose for which they are processed.
  • LIMITED RETENTION PERIOD FOR YOUR PERSONAL DATA: Personal data are stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
  • TECHNICAL AND ORGANIZATIONAL SECURITY OF YOUR PERSONAL DATA

 

1 LEGAL FRAMEWORK FOR HANDLING YOUR PERSONAL DATA

Personal data are processed in accordance with the GDPR, which is directly applicable in the member states of the European Union, including the Czech Republic.

 

2 DATA CONTROLLER

The controller of your personal data is the Company.

Contact details for the Data Controller: jana.jakubcova@uced.cz, +420724117296

The Company has not appointed a Data Protection Officer.

 

3 LEGAL BASIS, PURPOSE, AND DURATION OF PROCESSING YOUR PERSONAL DATA

In accordance with Article 6 of the GDPR, your personal data can only be processed on one of the following legal grounds:

  1. Consent you have given for the processing of personal data.
  2. Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.
  3. Processing is necessary for compliance with a legal obligation.
  4. Processing is necessary to protect the vital interests of the data subject or another natural person.
  5. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Your personal data is stored for the duration of the contractual relationship and further for the period required and stated in the relevant legal regulations.

The Company processes your personal data mainly for the purposes of concluding a contract with the Company, and also for fulfilling the Company's obligations. In these cases, your consent for the processing of personal data is not required.

In cases where the Company does not process personal data due to the fulfillment of a contractual or legal obligation of the Company, your consent is required for the processing of personal data. This applies to the processing of personal data for marketing and business purposes, where the Company informs you about products offered by the Company. This consent is entirely voluntary and can be easily withdrawn in writing at the Company's mailing address, and the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Further possible purposes for processing your personal data, as well as an overview of their retention periods, can be found in the table below:

 

Data Subject (Who it's about)

Purpose of Processing Personal Data

Legal Basis for Processing

Retention Period of Personal Data

Customer, Business Partner Ensuring fulfillment of obligations arising from the contractual relationship, as well as ensuring legal obligations
  • Fulfillment of contract obligations
  • Compliance with legal obligations
For certain purposes of processing personal data, we have set the usual processing time as follows:
  • Fulfillment of contract obligations: for the duration of the contractual relationship and then for 10 years after its termination
  • Compliance with legal obligations: period prescribed by law for keeping records
Customer, Business Partner Keeping records of incoming and outgoing correspondence including ensuring the document lifecycle in archives
  • Compliance with legal obligations
  • Protection of legitimate interests of the Data Controller
According to the disposal period set by legal regulations
Customer, Business Partner Camera recordings to ensure the protection of life, health, and property
  • Protection of legitimate interests of the Data Controller
Camera recordings are kept for 60 days, or for a longer period if necessary to protect the legitimate interests of the data controller (e.g., in relevant court or administrative proceedings)
Customer, Business Partner Assertion of claims or legal defense of the Data Controller in judicial, administrative, or similar proceedings
  • Protection of legitimate interests of the Data Controller
For this purpose, we process your personal data for the duration of the limitation period (usually up to 10 years) and further for the duration of judicial, administrative, or similar proceedings.
Customer, Business Partner
  • Consent of the Data Subject for the processing of personal data

After the period necessary for the stated purpose of processing. Typically, until the withdrawal of consent by the Data Subject, unless the Data Controller has another legally established reason for processing these personal data.

Consent to the processing of personal data can be revoked at any time.

 

4 SCOPE OF PERSONAL DATA PROCESSING

The Company processes the following personal data:

  • Identification data: name, surname, birth number, place and date of birth, residential address, marital status, nationality, photograph, type and number of identity document.
  • Contact details: mailing address, mobile phone, email.
  • Publicly available data: Data publicly available on the internet from trade, business, insolvency, or other similar registries, etc.
  • Data obtained through mutual communication.
  • Banking details.
  • Data for ensuring security in the building: These data are obtained for the purpose of protecting the legitimate interests of the Company. This particularly includes monitoring the premises or surroundings of buildings used by the Company.
  • Other personal data provided in your consent: In the case of a self-employed individual, the Company also processes their trade name, additional identifying information or other designations, place of business, identification number.

 

5 SOURCES OF PERSONAL DATA

We exclusively obtain personal data from you, in connection with negotiations for entering into a contract.

We also collect personal data from you during the duration of the contract, in cases where the personal data you have provided have changed and you fulfill an informational obligation towards the Company.

We mainly process your personal data based on the information you have provided during mutual communication, information that is publicly available, or from web portals.

 

6 DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

Processors and recipients of personal data

Your personal data are also transferred to third parties.

Your personal data may be disclosed without your consent:

  • Upon written request to public authorities, e.g., courts, criminal proceedings authorities, tax administrators, judicial executors, administrative agencies, etc., but only to the extent and in accordance with generally binding legal regulations, to persons who participate in the Company's activities based on a contract, who are tasked with fulfilling the Company's contractual and legal obligations, all for the above-mentioned purposes of processing personal data.

Your personal data may be provided to other entities exclusively with your explicit consent.

The personal data controller processes your personal data through its employees, while also utilizing the services of other processors, ensuring appropriate technical and organizational measures are in place to provide adequate protection for your personal data.

We also use services from the following categories for processing your personal data:

  • Security agencies
  • Staffing agencies
  • IT service providers and software suppliers
  • Postal and courier service providers
  • Legal service providers
  • Archival services
  • Other authorized entities

 

7 PROFILING AND AUTOMATED DECISION-MAKING IN PERSONAL DATA PROCESSING

The Company does not use automated information systems and profiling within its processes, therefore, there is no evaluation of your personal data.

 

8 YOUR RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA

Your rights regarding the processing of your personal data are as follows:

  • Right of access to your personal data under Article 15 of the GDPR: Everyone has the right to know whether their data are being processed – if so, they have the right to access these data and to information about the purposes, categories of data, recipients, storage period, the right to lodge a complaint, the source of the data (if not from the subject), the occurrence of automated decision-making, and also the right to obtain a copy of these data.
  • Right to information: You have the right to know information about the way your personal data are processed, the purpose and duration of their processing, as well as the source from which your personal data were obtained. As part of the right of access, you can request a copy of the processed personal data.
  • Right to rectification of your personal data under Article 16 of the GDPR, or to restriction of processing of your personal data under Article 18 of the GDPR: If you discover that the personal data we process about you are inaccurate, you have the right to have the Data Controller correct them without undue delay. Considering the purposes of the processing, you also have the right to have incomplete personal data completed.
  • Right to erasure of personal data under Article 17 of the GDPR: You have the right to have the Data Controller erase your personal data without undue delay if one of the following conditions is met:
    • Your personal data are no longer necessary for the purpose for which they were collected
    • You withdraw consent to the processing of your personal data, and there is no other legal ground for processing
    • You object to the processing of your personal data, and there are no overriding legitimate grounds for the processing
    • Your personal data have been unlawfully processed
    • The erasure of your personal data is required by law
  • The right to request the erasure of your personal data does not apply if their processing is still necessary for:
  • Compliance with a legal obligation of the Data Controller
  • Archiving purposes of the Data Controller
  • Protection of the legitimate interests of the Data Controller
  • Establishment, exercise, or defense of legal claims of the Data Controller
  • The right to object to processing under Article 21 of the GDPR: a Controller The right to object to processing under Article 21 of the GDPR: You have the right to object to the processing of your personal data by the Data Controller, and the Data Controller will no longer process such data if:
    • The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and the controller does not demonstrate compelling legitimate grounds for the processing which override your rights and freedoms
    • The personal data are processed for direct marketing purposes
  • Right to data portability under Article 20 of the GDPR: You have the right to receive your personal data, which you have provided to the Data Controller, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance from the Data Controller. This right applies in cases where your data are processed based on consent or contract and the processing is carried out by automated means. Your personal data will be provided to you in a structured, commonly used, and machine-readable format.
  • Right to restriction of processing of your personal data for reasons set out by law (e.g., because of the unlawful processing, inaccuracy of the data)
  • Right to withdraw consent to processing in writing or electronically at the address or email of the Data Controller: Data subjects have the right to withdraw their consent to the processing of personal data. This applies provided that the data subject's personal data are processed based on their consent.
  • Right to lodge a complaint with the relevant supervisory authority
  • If you believe that the processing of your personal data has violated or is violating the GDPR, you have, among other things, the right to lodge a complaint with the relevant supervisory authority, which is the Office for Personal Data Protection.

    If you are not given the opportunity to exercise any of your above-mentioned rights, you have the right to object.

     

    How can individual rights be exercised?

    All matters concerning the processing of your personal data can be addressed directly to the Data Controller, whom you can contact by any of the following means:

    • By email at: jana.jakubcova@uced.cz
    • In writing at the address: UCED s.r.o., AC Piano, Lidická 2331/6a, 370 01 České Budějovice, Czech republic

    Requests must have your signature officially verified. You can also exercise your rights in person through any employee of the Company.

    Your request will be processed without undue delay, but no later than one month. In exceptional cases, especially due to the complexity of your request, we are entitled to extend this period by another two months. Of course, we will inform you of such a possible extension and its reasons.

    To exercise your rights, you can also use the following form (in PDF format).