Terms and conditions for processing personal data

INFORMATION ON PROCESSING OF PERSONAL DATA for clients and suppliers according to the General Data Protection Regulation (GDPR)

The company provides information on the processing of personal data provided by the data subject to the data controller in the context of the commencement of the activity in the performance of the contractual relationship:

 
1.Personal data controller:

The data controller is WESTERN INVESTMENTS s.r.o.

Contact person. Mgr. Alexandr Vasilenko - GDPR MANAGER

tel: 773 673 107

e-mail: infozaavviinnaáččczech-estate.cz

2. Purpose of processing:

The data controller will process the personal data of the data subject for the purpose of fulfilling the contractual relationship in the field of mediation of sale or lease of immovable property, including related activities.

3. Legal basis:

Data subject consent: for marketing and business purposes

Performance or conclusion of a contract: for the purposes of performance of a contract or communication in the course of supplying or arranging products and services and the implementation of investment projects

Legal obligation (Act No. 89/2012 Coll., the Civil Code; Act No. 499/2004 Coll., on archiving and filing services; Act No. 455/1991 Coll., the Trade Licensing Act; Act No. 563/1991 Coll., on accounting; Act No. 235/2004 Coll., on value added tax;)

Legal interest: for the purpose of protecting property (CCTV recordings in the premises of the company's branches) and defending legal claims (debt recovery); for the purpose of contacting with an offer of services or products directly related to the products or services; for the purpose of handling requests, inquiries, comments and complaints

4. Personal data we process:

4

For the above legal bases, the company primarily processes the following categories of personal data:

Basic data

- Identification data: title, name, surname, date of birth, ID card number or ID number, if applicable;

- Contact details: permanent address, delivery address or delivery point address, telephone number, e-mail address, data box ID.

Other data

- We also process data that is closely related to the way in which you use the products or services provided by us, which are related to the nature of the business cooperation: bank account number, SIPO connection number, customer number, IP address, access data for personalized access to the customer portal, cookies and other data arising from the performance of a specific contract or the relevant legal regulation;

5. Personal data processors:

Personal data are provided by the data controller for further processing to external providers of accounting services, legal services, transport companies, whose identity will be disclosed to the data subject upon request.

6. Other recipients:

The data subject may, for legitimate interest, disclose the personal data provided by the data controller to authorised contractors in the field of IT services and technologies, partners for the management of the www.czech-estate.cz and www.czech-estate.ru websites, marketing services, consulting services, certification services, whose identity will be disclosed to the data subject on request.

Due to the necessary transfer, backup and archiving of electronic data, personal data is provided outside the EU in exceptional cases (cloud services with servers outside the EU).

7. Other third parties:

The Data Controller provides personal data to the relevant public authorities or other bodies authorised to process personal data for the purposes of state surveillance, prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security.

8. Other processing purposes:

The data controller may also use the personal data provided for commercial and marketing purposes based on the data subject's consent or legitimate interest, for the purpose of contacting him/her to offer services or products directly related to the products or services, or to deal with requests, enquiries, comments and complaints. The processing of personal data on the basis of legitimate interest is non-consensual.

9. Storage period of personal data:

The data controller retains personal data for the duration of the performance of the contractual relationship and for the period imposed by law.

For most contractual relationships, we must ensure a retention period related to tax proceedings, therefore we are required to retain tax documents and records with similar data relating to the provision of services for a period of 10 years from the end of the tax year in which the performance took place.

The exception to this may be the retention of personal data for business and marketing purposes, which we process for as long as consent is validly given or withdrawn (you can withdraw consent by email or telephone - see contact details of the controller above). The Company processes personal data for this purpose for a period of 5 years.

When processing personal data on the basis of the handling of requests, comments, questions and complaints, the retention of personal data is limited to the time strictly necessary, until the request has been handled. Thereafter, the data subject's personal data is deleted and shredded.

10. Rights of the data subject:

Right of access to personal data - the data subject has the right to access the personal data concerning him/her, the data controller is obliged to provide a copy of the personal data processed.

Right to rectification and completion of personal data - the data subject has the right to have inaccurate personal data concerning him or her rectified or completed by the data controller without undue delay.

Right to erasure - the data subject has the right to have personal data concerning him or her erased by the data controller without undue delay if:

- the personal data are no longer necessary for the purposes for which they were processed

- the data subject withdraws consent to the processing of the personal data

- the data subject objects to the processing

- the personal data have been unlawfully processed

- the storage of personal data is not prescribed by other relevant legal provisions

- it is not in the public interest in the field of public health, archiving, scientific or historical research, statistics

- it is not for the exercise or defence of legal claims

Right to restriction of processing - the data subject has the right to have the data controller restrict the processing of personal data in justified cases.

Right to portability of personal data - the data subject has the right to obtain personal data concerning him or her in a structured, commonly used and machine-readable format and the right to transmit that data to another controller.

Automated individual decision-making - the subject has the right not to be subject to any decision based solely on automated processing, including profiling, unless this is necessary for the performance of a contract.

Right to lodge a complaint with a supervisory authority - the data subject has the right to lodge a complaint with a supervisory authority, i.e. the Office for Personal Data Protection.
Right to object - the data subject has the right to object to the processing of personal data, the data controller may no longer process the data in unjustified cases. An objection may be raised at any time against processing for direct marketing purposes.

11. Failure to provide personal data:

The data subject must provide personal data for legal reasons or as specified in the business contract, otherwise the performance of the business contract would be prevented.

12. Other provisions:

If the data subject provides consent to the data controller for the processing of personal data or does not enter into a business relationship with the controller and there are no other reasons for the processing, his or her personal data will be shredded in written form and deleted in electronic form.