Company privacy statement

In this privacy statement, the company KOSTKA – kolobka s.r.o. describes, how it processes the personal data of natural persons (data subjects), i.e. information about the categories, extent and purposes of data processing; information about the source, where personal data are processed from and the information about individuals who transfer personal data, information about the time of storage of data etc. This privacy statement also contains information about the rights of data subjects with respect to the processing of personal data.

The company KOSTKA – kolobka s.r.o., Adress: Purkyňova 649/127, 612 00 Brno – Medlánky, TIN: 277 86 790, registered in the company register of the Krajský soud v Brně, section C, number 103851, as the controller of the personal data (hereinafter „KOSTKA – kolobka“), processes the personal data in compliance with legal requirements on the protection of personal data, especially the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 concerning the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR) and in compliance with our inner policies and principles.

Contact details of the controller:

info@kolobka.cz
Tel.: + 420 583 231 025
We didn’t appoint any Data Protection Officer

Purposes of processing the personal data and the legal basis of the processing operation:

We process personal data only to the extent necessary for the given purpose. We process personal data for:

 

Commercial purposes

(locksmithing, machining, toolmaking, production, other services not mentioned in appendices 1 - 3 of the Czech Trade Licensing Act, performing Trading Activity and Standard Company Operation) – i.e. Processing necessary for Contract operation or for Implementation of actions which were taken up on request of Data subjects – in accordance with Article 6(1)(b) GDPR.

 

Contractual purposes

(making, operating or terminating an agreement with customers, natural persons doing business or legal entities, invoicing, warranty claims and other communication. Provision of personal data is one of the contractual requirements.) – Processing is necessary for the performance of a contract – in accordance with Article 6(1)(b) GDPR and legitimate interests pursued by the controller in accordance with Article 6(1)(f) GDPR.

 

Purposes of compliance with controller’s legal obligations

(Processing of personal data on the basis of Law, i.e. according to the legislation of the Czech Republic and Eurepean Union – e.g. Accounting Law, tax rules, Auditors Act etc.) – processing is necessary for compliance with a legal obligation to which the controller is subject – in accordance with Article 6(1)(c) GDPR.

 

Purposes of controller’s legitimate concerns

(processing is necessary for the purposes of the legitimate interests pursued by the controller, which is the company KOSTKA – kolobka, s.r.o. – in accordance with Article 6(1)(f) GDPR;

– making contact with customers to establish cooperation and making a sales agreement, contacting existing business partners for inviting them to events organized by the company KOSTKA – kolobka, s.r.o.; (Data subjects receive Newsletters as offers or information about discount events);

– making contact with business partners in order to promote and present the company KOSTKA – kolobka, s.r.o.;

– data processing while labour-law disputes, debt collection, recovery of claims, resolving business disputes with business partners (natural persons, e.g. in case of damage of a company property etc.). In some cases, the company is entitled to transfer personal data to third parties (e.g. Law firms);

– CCTV systems in the company premises which have to protect the property, life and health of people entering the company premises. Information signs inform about the presence of cameras. Camera recording is not checked unless there occurred a damage to property or health. Otherwise the camera recording is not processed or used in any way. Camera recordings are stored for 10 days.

– registration of job-seekers (registration and processing of job-seekers' applications for a specific position or generally sent CVs without a specific selection process).

 

Categories of personal data processed:

1.) The company KOSTKA – kolobka, s.r.o. processes following personal data of existing and potential business partners: First name and last name of the company representative or natural person doing business, business phone and e-mail,

(The data as main office address, TIN or VAT ID are not considered to be personal data in terms of GDPR, because these data are freely accessible on public registers. The company KOSTKA – kolobka, s.r.o. uses these data only for contractual purposes.

2.) The company KOSTKA – kolobka, s.r.o. processes following personal data of job-seekers: first name, last name, date of birth, permanent address, phone number, e-mail, education, qualification.

 

Source of information:

The company KOSTKA – kolobka, s.r.o. gathers personal data from their business partners or directly from job-seekers.
The company can gather personal data from freely accessible sources (e.g. from the websites of business partners, advertising etc.)

 

Recipients (or category of recipients) of personal data

The company KOSTKA – kolobka, s.r.o. Processes personal data as a controller of the personal data. Personal data are not transferred to third parties unless it is imposed by law (state or state-designated entities, law enforcement, misdemeanour and administrative proceedings, audit company) or on the basis of a concluded data protection agreement (services of external processors). In case of provision of personal data to other subjects mentioned in previous sentence, our company will make these personal data accessible only to the extent necessary to achieve the intended purpose.

 

Period during which the personal data are stored at the controller:

Personal data of existing and potential business partners gathered without consent - personal data will be stored during the time of contractual relationship / business cooperation and after its termination, as long as it is necessary for further cooperation.
Personal data of existing and potential business partners gathered on the basis of consent - these data will be stored for 3 years from the consent.
Personal data of existing and potential business partners gathered on the basis of consent - these data will be stored for 3 years from the consent.


The rights of data subjects in terms of personal data protection:

The rights of data subjects in terms of personal data protection:

1.) Right of access by the data subject - the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and how (i.e. the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipient to whom the personal data have been or will be disclosed; the envisaged period for which the personal data will be stored; the existence of the right to request from the controller rectification or erasure of personal data; the right to lodge a complaint with a supervisory authority; the existence of automated decision-making).

2.) Right to rectification - The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

3.) Right to erasure (‘right to be forgotten’) - The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds (mentioned in Art. 17 GDPR) applies: (the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the data subject withdraws consent on the processing; the data subject objects to the processing; the personal data have been unlawfully processed; the personal data have to be erased for compliance with a legal obligation; the personal data have been collected in relation to the offer of information society services).

The personal data shall not be erased in case the processing is necessary for the performance of a contract (in accordance with Article 6(1)(b) GDPR) or in case the processing is necessary for compliance with a legal obligation (in accordance with Article 6(1)(c) GDPR).

4.) Right to restriction of processing - The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

- the accuracy of the personal data is contested by the data subject;

- the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

- the data subject has objected to the processing;

Right to restriction of processing cannot be required in case the personal data were collected for the performance of a contract or the processing is necessary for compliance with a legal obligation - with regard to the nature of the performance.

5.) Right to data portability – The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

- the data were provided by the data subject;

- the processing is based on consent;

- the data are provided by the controller in a structured, commonly used and machine-readable format, if it is accessible for the data subject.

- the processing is carried out by automated means.

 

6.) Right to object - The data subject shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest or unless the processing is necessary for legitimate concerns of the legitimate concerns of a controller. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. Same rules are applied for direct marketing purposes.

7.) Right not to be subject to a decision based solely on automated processing, including profiling, this right shall not apply if the decision is necessary for entering into, or performance of, a contract or if the decision is authorised by Union or Member State law or if the decision is based on the data subject’s explicit consent.

 

If any of the above rights is applied, the applicant will be informed in writing without undue delay (within the legal terms) of the manner of processing the application.

The data subject has the right at any time to withdraw the consent to the processing of personal data granted to the controller (if the personal data are processed with consent). The withdrawal of consent shall not affect the legality of processing based on the consent granted before its withdrawal

The data subject has the right to lodge a complaint with the Office for Personal Data Protection (Address in Czech Republic: Pplk. Sochora 27, 170 00 Praha 7, tel.: +420 234 665 111, 234 665 800 - quick consultation about GDPR), if data subject considers that there has been a breach of the obligations defined by the legal provisions.

The nature of the relationship between the controller and the data subject determines whether the provision of personal data is a legal or contractual requirement and whether the data subject is obliged to provide personal data (see above the purposes of processing the personal data and the legal basis of the processing operation).

The company KOSTKA – kolobka, s.r.o., as the controller, processes the personal data without automated decision-making.

 

Update

Last update from 18th February 2019
At the company KOSTKA – kolobka, s.r.o., the personal data protection principles and rules are continuously reviewed and may occasionally be changed in order to comply with the legal provisions.
An updated version of this Declaration will always be available on this website.

New Account Register

Already have an account?
Log in instead Nebo Reset password