Information on the processing of personal data by VIZARD s.r.o.

A. Basic terms and information

Personal data

Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (name, surname, number, online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special categories of personal data

These are so-called sensitive data, i.e. data that could harm the data subject in society, at work or at school, or could lead to discrimination. Such data typically reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or involve the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

Data subject

A data subject is the natural person to whom the personal data relate and who can be identified directly or indirectly.

Controller

The controller is the natural or legal person who determines the purposes and means of the processing of personal data and is responsible for the processing. Unless stated otherwise in these principles or in the terms of a specific service, the controller is VIZARD s.r.o.

Processor

A processor is a natural or legal person who processes personal data on behalf of the controller on the basis of a written contract and the controller's instructions.

Processing of personal data

Processing means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

B. Categories and purposes of processing personal data

In connection with visits to the VIZARD s.r.o. websites, including purchases in the online shop, for the purpose of contacting existing and potential customers and suppliers of VIZARD s.r.o. and their representatives or contact persons, and in connection with recruiting employees via the websites, VIZARD s.r.o. may process the following categories of personal data.

1. Processing of personal data in connection with a completed or intended purchase of goods in the VIZARD s.r.o. online shop and in connection with the conclusion of other contracts with customers and suppliers

When goods are purchased from VIZARD s.r.o., VIZARD s.r.o. is entitled to process:

1. the customer's basic personal, identification and contact data (those provided by the customer when purchasing),
2. data on the concluded contract,
3. data on the goods,
4. data from communication between the customer and VIZARD s.r.o.,

for the duration of the warranty period for the purchased goods and for 3 years after it expires.

The purpose of the processing is

1. the performance of VIZARD s.r.o.'s obligations under the contract with the customer,
2. the legitimate interest of VIZARD s.r.o. in establishing, exercising or defending its rights and legal claims, and
3. the legitimate interest of VIZARD s.r.o. in informing its existing customers about offers related to goods they have previously purchased from VIZARD s.r.o.

When purchasing goods from its suppliers, VIZARD s.r.o. is entitled to process:

1. the supplier's basic personal, identification and contact data,
2. data on the concluded contract,
3. data on the goods,
4. data from communication between the supplier and VIZARD s.r.o.,

for the duration of the warranty period for the purchased goods and for 3 years after it expires.

The purpose of the processing is

1. the performance of VIZARD s.r.o.'s obligations under the contract with the supplier, and
2. the legitimate interest of VIZARD s.r.o. in establishing, exercising or defending its rights and legal claims.

Invoices issued by VIZARD s.r.o. are archived for 10 years from their issue in accordance with Section 35 of Act No. 235/2004 Coll., on Value Added Tax. Because the legal basis for issuing the invoices must be documented, the related contracts are also archived for 10 years from the end of the contract.

2. Data obtained from cookies and other actions taken by the user on the VIZARD s.r.o. websites

Processing these data allows VIZARD s.r.o. to improve its services, focus on what really interests website visitors – including shoppers in the VIZARD s.r.o. online shop and applicants for jobs at VIZARD s.r.o. – and, where appropriate, inform them about suitable offers.

These include in particular

1. Information about the user's device obtained from cookies, if cookies are enabled in the web browser, which is processed to ensure the functionality and improve the operation of the websites – these data are processed on the basis of VIZARD s.r.o.'s legitimate interest in ensuring the functionality and improving the operation of its websites.
2. Where VIZARD s.r.o. and a potential customer negotiate the conclusion of a contract but no contract is concluded, VIZARD s.r.o. processes the personal data provided for 10 years from the negotiations concerned, on the basis of its legitimate interest in making it easy for the customer to return to their intended purchase, using collected cookies or information from contact forms completed by the customer.
3. Records of behaviour on the websites managed by VIZARD s.r.o., including the online shop, obtained from cookies if cookies are enabled in the web browser, which are processed to analyse traffic – these data are processed on the basis of VIZARD s.r.o.'s legitimate interest in monitoring traffic to its websites.
4. Records about the user's device obtained from cookies if cookies are enabled in the web browser, which are processed for remarketing (also known as retargeting), i.e. targeting ads at users who have previously visited the VIZARD s.r.o. website – these data are processed on the basis of the user's consent, given on the website visitor's initiative by actively ticking the "I agree" option that follows the notice at the bottom of the website, which reads: "The website operator, VIZARD s.r.o., as the data controller, processes cookies on this website that are necessary for the website to function and for analytical purposes and, with your consent, also for remarketing (retargeting), i.e. for better ad targeting." The user gives consent for 10 years and may withdraw it at any time. To have stored cookies deleted, the visitor should contact VIZARD s.r.o. at info@medovnik.cz, stating their name, surname and IP address.

3. Data processed for business purposes

With the data subject's consent, we process personal data for business purposes.

With consent for business purposes, VIZARD s.r.o. will process the customer's personal data to create a suitable offer of VIZARD s.r.o. products and to contact the customer by phone, in writing, via online advertising and by electronic communication using their contact details. On the basis of consent, basic personal, identification and contact data, data on the concluded contract, data on the goods and data from communication between the customer and VIZARD s.r.o. may be processed for business purposes.

Giving consent for business purposes is voluntary and the customer may withdraw it at any time. This consent remains valid for 10 years or until the customer withdraws it. If the customer withdraws consent, this does not affect the processing of their personal data by VIZARD s.r.o. for other purposes and on other legal grounds in accordance with this information.

For commercial communications from VIZARD s.r.o. or third parties, VIZARD s.r.o. uses the abbreviation "OS" (obchodní sdělení – commercial communication) or another suitable label making it clear that the message is a commercial communication within the meaning of the applicable legislation. Commercial communications sent by VIZARD s.r.o. always make it clear that VIZARD s.r.o. is the sender. We may send commercial communications either to our customers' contact details on the basis of VIZARD s.r.o.'s legitimate interest, only until you object, or on the basis of your explicit consent to the processing of personal data for marketing and business purposes. Commercial communications also include a contact for unsubscribing from them.

4. Data of persons applying for a job

VIZARD s.r.o. also processes personal data in recruitment, i.e. it processes the personal data of job applicants.

This information is processed on the basis of legitimate interest in order to take steps prior to entering into a contract at the request of the data subject.

A certain amount of personal data is mandatory here – only data used for basic identification and contact (name, surname, email, telephone, position applied for). Applicants provide other data in their CVs, profiles and communication with the company without VIZARD s.r.o. explicitly or systematically requesting them. The company also processes records or notes of communication with the applicant, written and electronic correspondence with the applicant, etc. It is therefore not possible to give an exhaustive list of the personal data VIZARD s.r.o. processes in this area, as there is no standard CV format and each applicant may provide completely different information.

In general, VIZARD s.r.o. usually processes the following data:

1. name and surname
2. title
3. date of birth
4. photograph
5. email
6. telephone
7. place of residence
8. work experience
9. education
10. nationality
11. language skills
12. courses completed
13. training and certificates
14. knowledge and skills
15. personal interests

VIZARD s.r.o. never requests personal data that are not needed for the given purpose (e.g. personal identification number, ID card or other document number, copies of documents, etc.).

In a selection procedure, VIZARD s.r.o. always uses personal data solely for that purpose and always informs the data subject transparently about it.

Unless the applicant gives VIZARD s.r.o. explicit consent to further retention, all of the applicant's personal data, including the CV submitted, will be deleted no later than 3 months after the selection procedure ends. From the end of the selection procedure until this period expires, the personal data are processed on the basis of VIZARD s.r.o.'s legitimate interest in establishing, exercising or defending its rights and legal claims.

C. Retention periods for personal data

Personal data for these activities are processed to the extent necessary to carry them out and for the period necessary to achieve them or directly stipulated by law. The personal data are then erased or anonymised. Specific retention periods for some purposes are stated directly with those purposes.

D. Method of processing personal data

VIZARD s.r.o. processes personal data both manually and automatically. VIZARD s.r.o. keeps a record of all activities, both manual and automated, in which personal data are processed.

E. Categories of recipients of personal data

In fulfilling its contractual commitments and obligations, VIZARD s.r.o. uses the professional and specialised services of other entities. Where these suppliers process personal data transferred to them by VIZARD s.r.o., they act as processors and process the data only in accordance with VIZARD s.r.o.'s instructions; they may not use them in any other way. This applies in particular to debt collection, experts, lawyers, auditors, IT system administration, online advertising and sales representation. We select each such entity carefully and conclude a data processing agreement with each of them, imposing strict obligations on the processor to protect and secure personal data.

Processors are companies based in the Czech Republic, in a member state of the European Union or in so-called safe countries. Any transfer and processing of personal data in countries outside the European Union always takes place in accordance with the applicable legislation.

In fulfilling its legal obligations, VIZARD s.r.o. transfers personal data to the administrative authorities and offices designated by applicable law.

F. Information on the rights of data subjects in connection with the processing of personal data, effective from 25 May 2018

Under the Regulation, from 25 May 2018 a data subject has the following rights, provided that they are an identifiable natural person for VIZARD s.r.o. and prove their identity to VIZARD s.r.o.

1. Right of access to personal data

Under Article 15 GDPR, the data subject has the right of access to personal data, which includes the right to obtain from VIZARD s.r.o.:

1. confirmation of whether it processes personal data,
2. information about the purposes of processing, the categories of personal data concerned, the recipients to whom the personal data have been or will be disclosed, the envisaged period of processing, the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or restriction of processing or to object to such processing, the right to lodge a complaint with a supervisory authority, and any available information about the source of the personal data where they were not obtained from the data subject,
3. information on whether automated decision-making, including profiling, takes place,
4. information on appropriate safeguards for transfers of data outside the EU, provided the rights and freedoms of others are not adversely affected,
5. a copy of the personal data.

The right to confirmation of processing and to information may be exercised in writing at the address of VIZARD s.r.o.'s registered office.

The right to a copy of the personal data may be exercised at VIZARD s.r.o.'s registered office, provided the applicant proves their identity.

2. Right to rectification of inaccurate data

Under Article 16 GDPR, the data subject has the right to have inaccurate personal data that VIZARD s.r.o. processes about them rectified. Customers of VIZARD s.r.o. are also obliged to notify any changes to their personal data and to prove that such a change has occurred.

They are also obliged to cooperate with VIZARD s.r.o. if it is found that the personal data we process about them are inaccurate. We will make the correction without undue delay, but always with regard to the technical possibilities. A request for rectification may be made at VIZARD s.r.o.'s registered office, provided the applicant proves their identity.

3. Right to erasure

Under Article 17 GDPR, the data subject has the right to erasure of personal data concerning them, unless VIZARD s.r.o. demonstrates legitimate grounds for processing them. VIZARD s.r.o. has mechanisms in place to ensure the automatic anonymisation or erasure of personal data once they are no longer needed for the purpose for which they were processed. If the data subject believes that their personal data have not been erased, they may contact us in writing at the address of VIZARD s.r.o.'s registered office.

4. Right to restriction of processing

Under Article 18 GDPR, until the matter is resolved, the data subject has the right to have the controller restrict processing if the data subject contests the accuracy of the personal data or the grounds for processing them, or objects to the processing; this may be done in writing to the address of VIZARD s.r.o.'s registered office.

5. Right to notification of rectification, erasure or restriction of processing

Under Article 19 GDPR, the data subject has the right to be notified by VIZARD s.r.o. that it will make or has made a rectification, erasure or restriction of processing of personal data. If personal data are rectified or erased, we will inform the individual recipients, unless this proves impossible or involves disproportionate effort. At the data subject's request, we can provide information about these recipients.

6. Right to data portability

Under Article 20 GDPR, the data subject has the right to receive the personal data concerning them that they have provided to the controller in a structured, commonly used and machine-readable format, and the right to ask VIZARD s.r.o. to transmit these data to another controller.

If the data subject provides personal data to VIZARD s.r.o. in connection with a service contract or on the basis of consent, and the data are processed by automated means, they have the right to receive these data in a structured, commonly used and machine-readable format. Where technically feasible, the data may also be transmitted to a controller you designate, provided the person acting on behalf of that controller is properly identified and can be authorised.

If exercising this right could adversely affect the rights and freedoms of third parties, your request cannot be granted. The request may be made at VIZARD s.r.o.'s registered office once its legitimacy has been demonstrated.

7. Right to object to the processing of personal data

Under Article 21 GDPR, the data subject has the right to object to the processing of their personal data on the grounds of VIZARD s.r.o.'s legitimate interest.

If VIZARD s.r.o. does not demonstrate compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, VIZARD s.r.o. will stop the processing based on the objection without undue delay.

Objections may be sent in writing to the address of VIZARD s.r.o.'s registered office.

8. Right to withdraw consent to the processing of personal data

Consent to the processing of personal data for business purposes may be withdrawn at any time. Withdrawal must be made by an explicit, clear and specific expression of will, either by phone, by email or at VIZARD s.r.o.'s registered office.

Consent to marketing contact given for a specific electronic contact may be withdrawn at any time by phone, by email or at VIZARD s.r.o.'s registered office.

The processing of data from cookies can be prevented through your web browser settings.

9. Automated individual decision-making, including profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. VIZARD s.r.o. states that it does not carry out automated decision-making without human assessment that has legal effects for data subjects.

10. Right to contact the Office for Personal Data Protection

The data subject has the right to contact the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz).

These principles are effective from 25 May 2018 and replace the previous Privacy Policy.