PERSONAL DATA PROCESSING POLICY

1. PERSONAL DATA PROCESSING POLICY

Our company SRP s.r.o., ID No.: 263 02 781, with its registered office at Brno, Řehořova 785/26, Postal Code 618 00, registered at the Regional Court in Brno under file No. C 42367, will process your personal data. This policy sets out the rules that we will follow when processing your personal data in order to preserve your right to protection of your personal data, your right to privacy and prevent misuse of your personal data. We will follow this policy for as long as we process any of your personal data.

The personal data processing rules set out in this policy correspond to the obligations imposed on us when processing personal data by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - General Data Protection Regulation ("GDPR").

Through this policy, we also inform you of the facts and your rights that you need to be informed of in accordance with the GDPR and which ensure sufficient transparency in the processing of your personal data

This policy sets out the procedures and principles on the basis of which we will process and handle your personal data. If anything is unclear or you would like to enquire about anything relating to your personal data, please use the contact details provided in this policy.

2. COLLECTION OF PERSONAL DATA

2.1 Reasons for collecting personal data

We will only collect and process personal data from you if it is necessary for:

1. 1. a) Performance of the contract you have concluded or intend to conclude with us
  2. b) Providing the service you want to use.
  3. c) Meeting the requirements of the Act
  4. d) The purposes of our legitimate interests, unless your interests or the fundamental rights and freedoms of data subjects requiring the protection of personal data take precedence.

2.2. Sending for direct marketing purposes

A legitimate interest may be the processing of your personal data for the purpose of direct marketing - sending commercial communications if we are already in a business relationship with you and the commercial communication will be directly related to the goods or services we have already provided to you. However, you can opt out of receiving such marketing communications at any time by following the link in the commercial communication or by using the contact email below.

2.3. Consent

In other cases, we can only collect and process your personal data with your explicit and free consent. You may withdraw your consent at any time by using the contact details provided in this policy. The specific conditions for the use of your personal data after consent is given are always set out in each individual consent.

2.4 Acquisition of personal data

We do not obtain your personal data from publicly available sources, but always only from you or from third parties who cooperate with us and have obtained personal data from you in accordance with the law and can pass it on to us. In either case, we will follow this policy.

We may either explicitly request your personal data from you directly or we may obtain it if you register for our services, enter into a contract with us or use a service. Alternatively, you may provide us with your personal information by, for example, filling in forms on the website or by communicating with us by telephone, email, web chat or otherwise. We also collect some of it automatically with your consent, for example by using cookies when you visit our website.

We will always inform you of the specific reason for processing your personal data in each individual case. This information is either stated directly in the contract being concluded, in the terms of service or in this policy. Alternatively, you can ask us about the reasons for processing your personal data at any time using the contact details below.

3. USE OF YOUR PERSONAL DATA

We use your personal data primarily to provide you with our services, to perform a contract, to comply with legal requirements, to notify you of changes to our services, to improve our services, to enter into or perform a required contract with you, or to comply with legal requirements. We may also use this information, with your consent, to inform you about other services and products that we or selected third parties offer that may be of interest to you or that you may use. We will always inform you of any other uses of your personal information.

4. TRANSFER OF YOUR PERSONAL DATA TO OTHERS

4.1 Transmission of personal data

We will not disclose your personal information to anyone except as described in this policy.

Your personal data will be accessed by employees of our company who will be authorised to handle such personal data. All employees who will have access to your personal data are bound in writing to confidentiality, so your personal data must not be shared anywhere. These employees are also responsibly selected and properly trained so that they know how to handle your personal data and under what conditions your personal data may be processed.

We will then transfer your personal data to certain third parties if necessary. These parties are called processors. Our company is responsible for ensuring that these processors provide appropriate safeguards for the processing of your personal data. We choose all processors responsibly. At the same time, the processors will be contractually bound to fulfil all their obligations, which will contractually ensure that your personal data is adequately protected and minimise the risk of misuse.

4.2 Third parties to whom personal data will be transferred - recipients of personal data

The processors are mainly our accountants, legal, tax, marketing and other similar advisors to whom we transfer your personal data if necessary in order to use their services - consulting. In addition, IT service providers and hosting providers. In the event that we send you goods or commercial communications, we may transfer your personal data to external processors for the purpose of sending commercial communications or goods to you. In the event that we decide to use a subcontractor to provide the service you request from us, we may transfer your personal data to that subcontractor to the extent necessary.

In addition to the above, for the purpose of improving our services or the smooth provision of our services, we may transfer your personal data to those persons whose online tools we use - but only for the purpose of targeted outreach or to improve the quality of our services. A list of these persons is set out in the table below.

Name	Country	Purpose of processing
Google	USA	Web behaviour analysis

We may also share your personal information with other third parties in order to prevent crime and reduce risk, where required by law and where we deem it appropriate, in response to legal process, or to protect the rights or property of our company, our partners or you.

4.3 Transfers outside the EU

Your personal data is not transferred to countries outside the European Union or to international organisations, except for situations where it is transferred there for the purpose of better data backup and protection and the situations set out in these terms and conditions.

5. AUTOMATIC INDIVIDUAL DECISION-MAKING AND PROFILING

When processing your personal data, our company does not carry out any automated individual decision-making or profiling that would have any legal effect on you or would otherwise significantly affect you. Should this change, we will inform you immediately.

6. PERIOD OF PROCESSING OF PERSONAL DATA

We process your personal data only for the time necessary. If your personal data is no longer needed for the purposes of processing, we will delete it immediately.

If we process your personal data on the basis of consent, the processing period is specified in this consent.

Where we process your personal data as a result of statutory provisions, we process it for the period of time required by law. Where the law requires the archiving of certain data, we will archive your personal data for the required period in accordance with the law.

In the event that we process your personal data as a result of entering into a contract or providing a service, we will process your personal data for the duration of the performance of that contract or provision of the service and for 10 years after the termination of the contract or provision of the service. However, during this period we will only process your personal data for the purpose of defending any legal claims or legal proceedings. The 10-year period then corresponds to the maximum limitation period for which claims can be successfully brought before a court. In the event that legal or other proceedings are initiated that require your personal data, we will continue to process your personal data throughout the duration of these proceedings, including any enforcement and other follow-up proceedings.

7. YOUR RIGHTS

7.1 Right to information

At any time, you can ask us to send you confirmation of whether we are processing any of your personal data and, if we are processing your personal data, you have the right to access this information using the contact details below:

1. a) For what purpose do we process your personal data and what are the categories of personal data.
2. b) Who are the recipients and processors of your personal data.
3. c) For how long your personal data will be stored and, if this period cannot be determined, the criteria used to determine this period.
4. d) For which personal data you can request its erasure or restriction of processing and object to such processing.
5. e) The right to lodge a complaint with the supervisory authority.
6. f) About the sources of the personal data, if not obtained from you.
7. g) Whether there is automated individual decision-making or profiling.

If you ask us to do so, we will provide you with copies of your personal data processed. If you request further copies, you may be charged for this at the cost incurred. If you request electronically, copies will be provided to you in electronic form unless you request otherwise. However, we have the right to require you to verify your identity to ensure that this information relating to your personal data does not come into the possession of an unauthorised person.

We will endeavour to provide you with this information as soon as possible, depending on the extent of the information you have requested. However, no later than 30 days.

7.2 Right to repair

If you find that some of your personal data is inaccurate, incorrect or incomplete, you have the right to have your personal data corrected or completed without undue delay after you notify us.

7.3 Right to be forgotten - right to erasure

You have the right to have us delete your personal data without undue delay if:

1. a) Your personal data is no longer needed for the purposes for which it was collected
2. b) You withdraw your consent.
3. c) You object to the processing
4. d) We have processed your personal data unlawfully.
5. e) The deletion will fulfil a legal obligation under the law.
6. f) The personal data was collected in connection with the offer of information society services.

However, we will not delete your personal data even for the reasons mentioned above if one of the reasons according to Article 17(3) GDPR is given.

If this is then technically possible and feasible and your personal data has been disclosed or third-party personal data has been transmitted, we will also arrange for the deletion of this personal data.

7.4 Right to restriction of processing

You have the right to have us restrict the processing of your personal data if:

1. a) You tell us that your personal data is inaccurate for a period of time before we verify the accuracy of the personal data.
2. b) We process your personal data unlawfully, but you ask us to restrict its use instead of erasing it.
3. c) We no longer need your personal data but you require it to establish, exercise or defend legal claims.
4. d) You have objected to the processing, pending an examination of whether it is justified.

During the period of restriction of processing, your personal data may only be stored and may otherwise only be processed on the basis of your consent, for the establishment, exercise or defence of legal claims or for reasons of public interest.

7.5 Right to object

You have the right to object to the processing of your personal data if we process it for direct marketing purposes. You must send us your objection in writing or by email. If you object to processing for direct marketing purposes, we will no longer process your personal data to that extent unless we can demonstrate compelling legitimate grounds for processing which override your interests or rights and freedoms or for the establishment, exercise or defence of legal claims.

7.6 Right of data portability

If you ask us to do so, we will provide your personal data in a structured, commonly used format so that you can provide it to another controller. In doing so, where technically possible, you may want us to pass your personal data directly to the controller you identify to us.

7.7 Right to lodge a complaint

You can file a complaint regarding the processing of your personal data or our failure to comply with our obligations under the GDPR with a supervisory authority at any time. The supervisory authority in the Czech Republic is the Office for Personal Data Protection, located at Pplk. Sochor 27, 170 00 Prague 7, www.uoou.cz.

8. MEASURES IN PLACE

Our company has put in place personnel, organisational and technical measures to eliminate various serious risks to your rights and freedoms and to the protection of your personal data. To this end, we have trained all our employees who come into contact with personal data. Furthermore, all personal data in physical form is secured against unauthorised access. For personal data stored in electronic form, we comply with security standards and it is also secured against unauthorised access.

9. DATA PROTECTION OFFICER

Our company is not obliged to appoint a data protection officer under the GDPR and has not appointed one. However, it has appointed a person within our company who is responsible for data protection. You can contact this person on any matter relating to your personal data and to exercise your rights. This person is the project manager, Tereza Urbánková, e-mail: info@spr-reklama.cz.

10. CONTACT DETAILS

If you have any requests, requirements, comments or uncertainties, you can contact us by e-mail at info@spr-reklama.cz or in writing to our registered office.

11. CONCLUSION

This policy was adopted on 23 May 2018. Our company may change this policy as long as it remains in compliance with the law and GDPR. We will notify you of any changes to this policy on our website.