1. Data Controller
Your personal data are processed by JettyVision s.r.o., with its headquarters Modřanská 621/72, Modřany, 143 00 Prague 4, company ID: 05493692, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, part 264571, as the controller, for the purposes, in the manner, and on the basis of the legal reason and for the time period set forth further in this Policy.
2. Controller’s Contact Details
When exercising your rights stated further in this Policy, you can contact the controller in writing at JettyVision s.r.o., Modřanská 621/72, Modřany, 143 00 Prague 4, or via e-mail at firstname.lastname@example.org.
3. Categories of Data Subjects
- Data subjects, whose personal data are processed by JettyVision s.r.o., include but are not limited to:
Customers of JettyVision s.r.o.
- Employees and members of JettyVision s.r.o.
- Sales representatives of JettyVision s.r.o.
- ther persons who are in a contractual relationship with JettyVision s.r.o.
- Persons, with whom JettyVision s.r.o. is negotiating a contract or another legal relationship
- Job candidates
4. Categories of Personal Data
Personal data means any information concerning a natural person identifiable by JettyVision s.r.o. In connection with the provisions of services and sales of goods, JettyVision s.r.o. may process in particular the following categories of personal data:
- Address and identification details that can be used to unambiguously and unmistakably identify the data subject (such as first name, last name, title, personal birth number, date of birth, permanent address, place of business, mailing address, billing address, IČ – Company Identification Number, DIČ – Tax Identification Number, bank details, identification details of the customer’s representative or a contact person nominated by the customer, contract and signature), information allowing contact with the data subject (contact details such as contact address, phone number, fax number, e-mail address and the like), and other data needed to perform a contact
- Data provided beyond the relevant laws processed with a consent granted by the data subject (processing of photos, use of personal data for human resource development purposes, signature specimens, copies of identity cards for the purposes of identifying a party to a trade, guarantor declarations containing personal data)
5. Purposes, Legal Grounds and Duration of Processing of Personal Data
The extent of the processed data depends on the purpose of processing. For some purposes, data may be processed directly on the basis of a contract, a legitimate interest of JettyVision s.r.o. or law (without a consent), and for any other purposes only with consent.
Processing on grounds of performing a contract, compliance with legal obligations and due to legitimate interests of JettyVision s.r.o.
The processing of personal data needed to perform a contract, to comply with legal obligations of
JettyVision s.r.o.and to protect the legitimate interests of JettyVision s.r.o. does not require consent of the relevant data subjects; however, the processing of personal data for the purposes of the legitimate interests of JettyVision s.r.o. can be objected to. Processing on grounds of performing a contract and compliance with legal obligations cannot be refused.
This includes particularly the following specific purposes:
- Compliance with labour and wage administration requirements (compliance with legal obligations)
- Bookkeeping (compliance with legal obligations)
- Compliance with legal tax obligations (compliance with legal obligations)
- Negotiating a contract (legitimate interest of JettyVision s.r.o.)
- Provision of services, provision of warranty services (performing a contract)
- Invoicing (performing a contract)
- Collection of debts owed by a customer and other disputes with customers (legitimate interest of JettyVision s.r.o.)
Personal data used for such specific purposes are processed to the extent necessary to fulfil such purposes and for the time period necessary to achieve them, or for a period set out in legislation, a contract or the shredding regulations of JettyVision s.r.o. After that, the personal data are deleted or anonymized. The basic time periods for the processing of personal data are provided below.
In terms of customers, JettyVision s.r.o. is entitled to, in the event that the customers have met all their obligations towards the company, process in its client database their basic personal, identification and contact data, details of the services and details of their communication with JettyVision s.r.o. for a period of 4 years from the date of termination of the last contract with JettyVision s.r.o.
In the event that a product is purchased from JettyVision s.r.o., the company is entitled to process basic personal, identification and contact data, details of the services and details of their communication between the customer and JettyVision s.r.o. for a period of 4 years from the date of expiry of the product warranty.
In the event that JettyVision s.r.o. and its potential customer are holding contract negotiations that do not result in the conclusion of a contract, JettyVision s.r.o. is entitled to process the personal data provided for a period of 12 months from the negotiations.
Invoices issued by JettyVision s.r.o. are archived for a period of 10 years from the date of issue in accordance with Section 35 of Act No. 235/2004 Sb., on Value Added Tax. In order to be able to substantiate a legal ground for issuing invoices, customer contracts are also archived for a period of 10 years from the date of termination.
JettyVision s.r.o. customer data processing for business purposes with consent
In terms of customers, JettyVision s.r.o. processes personal data for business (marketing) purposes only with the customer’s consent.
With consent to the processing for business purposes, JettyVision s.r.o. processes customer personal data primarily to prepare an offer for JettyVision s.r.o. products and services and in connection with contacting the customer by phone, in writing or electronically using the customer’s contact details.
Granting consent for business purposes is voluntary and the customer may revoke it at any time. The consent remains valid during the use of the JettyVision s.r.o. products and services and for 4 years thereafter or until the customer revokes it. If the customer revokes its consent for business purposes, it will not affect the processing of the customer’s personal data by JettyVision s.r.o. for other purposes and on the basis of other legal titles in accordance with this Policy.
Processing of data of data subjects who have granted their consent to receiving marketing communication electronically
For subjects, who have granted consent to receiving marketing connection electronically, JettyVision s.r.o. processes – with their consent for the time period specified in the consent – contact details provided by the subject for the purposes of marketing communication regarding offers of JettyVision s.r.o. products and services.
It is always apparent from business communication sent by JettyVision s.r.o. that such communication is business communication as defined in applicable laws and that JettyVision s.r.o. is the sender. JettyVision s.r.o. sends business communication using the customers’ contact details either on the basis of a legitimate interest of JettyVision s.r.o. only until the customer objects to the processing of personal data or on the basis of an express consent to the processing of personal data for business purposes or on the basis of a consent to receiving marketing communication electronically. All business communication sent must also provide contact details for unsubscribing from receiving such communication.
Processing of cookies on websites operated by JettyVision s.r.o.
6. Categories of Recipients to Whom the Personal Data Have Been or Will Be Disclosed Including Recipients in Third Countries or International Organisations
To comply with its legal obligations, JettyVision s.r.o. transfers personal data to administrative authorities and offices specified in applicable legislation. In addition, in complying with its obligations and duties arising from contracts, JettyVision s.r.o. uses expert and specialised services of other entities. In the event that these suppliers process personal data transferred by JettyVision s.r.o., they have the status of data processors and process the personal data only as instructed by JettyVision s.r.o. and are not allowed to use them in any other manner. This includes but is not limited to the collection of outstanding debt, activities of experts, accountants (company, independent), translators, attorneys, auditors, IT system administration, online advertising and agency. JettyVision s.r.o. selects every supplier carefully and enters into a personal data processing agreement with every supplier, imposing strict obligations on the processor with regard to the protection and security of personal data. The processors are companies based in the Czech Republic, in an EU Member State or in so-called secured countries. Any transfer and processing of personal data in countries outside the European Union always complies with applicable legislation. The categories of recipients of the personal data are:
- Financial institutions
- Public institutions
- Contractual partners conducting selection procedures for job vacancies
- State and other authorities when complying with legal obligations prescribed by applicable legal regulations
- Other recipients
- depending on the consent granted by the data subject (such as transfer of personal data abroad
- EU Member States) The current list of processors that may obtain some of your personal data for the above purposes: Google LLC ABRA Software a.s. (IČ – Company ID No.: 25097563) RAYNET s.r.o. (IČ – Company ID No.: 26843820)
7. Personal Data Updates
JettyVision s.r.o. updates the personal data processed using information from data subjects, third parties, and, where appropriate, using public resources (internet, public registers).
8. Method of Personal Data Processing
The personal data are processed by JettyVision s.r.o. The processing takes place in its registered office or branch (establishment) by individual authorised employees of JettyVision s.r.o., or, a processor, as the case may be. The processing is carried out using computers or manually when it comes to personal data in documentary form in order to comply with all personal data administration and processing security principles. For this reason, JettyVision s.r.o. took technical and organizational measures to ensure security of the personal data, including but not limited to measures to prevent unauthorised or accidental access to, changes, destruction or loss, unauthorised transmission, any unauthorised processing or another misuse of personal data. All entities, to whom the personal data may be disclosed, respect the right of data subjects to privacy and are required to proceed in accordance with applicable laws regarding the protection of personal data.
9. Information about the Rights of Data Subjects in Connection with the Processing of Personal Data
In the event that a data subject is an identifiable natural person for JettyVision s.r.o. and proves his/her identity, he/she has the following rights. The rights stated below may be exercised only in relation to personal data where there is no doubt that they belong to the requesting data subject.
1. Right to information (Art. 13 and 14 GDPR)
Under Art. 13 and 14 GDPR, the data subject has the right to information, including but not limited to the scope and purpose of processing, the method of personal data processing, and information regarding to whom the personal data may be disclosed. JettyVision s.r.o. meets its information obligation towards data subjects through these principles posted at www.jettyvision.cz/en, as well as in contracts with customers and contractual partners, and in responses to requests of data subjects.
2. Right of access to personal data (Art. 15 GDPR)
Under Art. 15 GDPR, the data subject has the right of access to personal data, which includes the following rights:
- To obtain a confirmation whether personal data are processed;
- To obtain information about the purposes of processing;
- Categories of personal data concerned;
- Recipients to whom the personal data have been or will be disclosed;
- Planned duration of processing;
- Existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- To lodge a complaint with a supervisory authority;
- To obtain any available information as to the source of personal data if they are not collected from the data subject;
- To obtain information about the fact that automated decision making is used, including profiling, about suitable guarantees when transferring data outside the EU;
- To obtain a copy of personal data provided that the rights and freedoms of other persons are not adversely affected. In case of repetitive requests, JettyVision s.r.o. will be entitled to charge an adequate fee for a copy of personal data.
3. Right of rectification of inaccurate data (Art. 16 GDPR)
Under Art. 16 GDPR, the data subject has the right of rectification of inaccurate personal data and completion of incomplete personal data processed by JettyVision s.r.o. about the data subject. JettyVision s.r.o. will rectify the data without undue delay, however, always depending on the relevant technical possibilities.
4. Right of erasure (Art. 17 GDPR)
Under Art. 17 GDPR, the data subject has the right of erasure of personal data regarding the data subject if JettyVision s.r.o. fails to prove its legitimate reasons for the processing of such personal data. JettyVision s.r.o. has implemented mechanisms for ensuring automatic anonymization or erasure of personal data in the event that the data are no longer needed for the purposes for which they were processed. If the data subject believes nonetheless that his/her personal data were not erased, he/she may request erasure provided that the data subject substantiates the legitimacy of such a request.
5. Right of limitation on processing (Art. 18 GDPR)
Under Art. 18 GDPR, until his/her case is handled, the data subject has the right to request a limitation on processing if the data subject claims inaccuracy of the personal data, the reasons for their processing or lodges an objection to their processing.
6. Right to be notified of rectifications, erasure or limitation on processing (Art. 19 GDPR)
Under Art. 19 GDPR, the data subject has the right to be notified by JettyVision s.r.o. of a rectification, erasure or limitation on processing of personal data.
7. Right to portability of personal data (Art. 20 GDPR)
Under Art. 20 GDPR, the data subject has the right to request from JettyVision s.r.o. personal data regarding the data subject and personal data provided by the data subject to JettyVision s.r.o. in connection with a contract of employment or on the basis of a contract and that are processed by an automated system in a structured, commonly used and machine readable format, and the right to request that such data be transferred to another controller if the person acting on behalf of the relevant controller is properly identified and can be verified. In the event that this right cannot be exercised due to an adverse effect on the rights and freedoms of third parties, the request cannot be granted.
8. Right to lodge an objection to the processing of personal data (Art. 21 GDPR)
Under Art. 21 GDPR, the data subject has the right to object to the processing of his/her personal data due to a legitimate interest of JettyVision s.r.o. In the event that JettyVision s.r.o. fails to prove that there is a considerable legitimate reason for such processing that outweighs the interests or rights and freedoms of the data subject, JettyVision s.r.o. will stop such processing according to the objection without undue delay.
9. Right to revoke consent to the processing of personal data
Consent to the processing of personal data for business purposes can be revoked at any time after it comes into effect. Such revocation requires an express, comprehensible and specific manifestation of will. Consent to marketing communication granted for a specific electronic contact may be revoked at any time in the manner specified in such marketing communication.
10. Automated individual decision-making, including profiling (Art. 22 GDPR)
Under Art. 22 GDPR, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. JettyVision s.r.o. declares that it does not utilise automated decision-making.
11. Right to contact the Office for Personal Data Protection (Art. 77 GDPR)
Under Art. 77 GDPR, the data subject has the right to file a complaint to the Office for Personal Data Protection (www.uoou.cz) if the data subject believes that the processing of his/her personal data violates his/her rights or any provision of the GDPR.