GDPR

Information on the processing of personal data

Declaration on the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the information of data subjects (hereinafter referred to as "GDPR")

I. Personal data controller 

The company Edhouse s.r.o. with its registered office at Budova 13 Zlín, Vavrečkova 7074, 760 01 Zlín, ID No.: 276 90 083, VAT No.: CZ 276 90 083, registered in the Commercial Register kept at the Registry Court in Brno, Section C, Insert 52306, (hereinafter referred to as the "Controller") hereby informs you about the processing of your personal data and your rights in accordance with Article 12 of the GDPR.

II. Scope of processing of personal data 

Personal data are processed to the extent that the respective data subject has provided them to the controller, in connection with the conclusion of a contractual or other legal relationship with the controller, or which the controller has otherwise collected and processes them in accordance with applicable law or to fulfil the controller's legal obligations.

III. Sources of personal data 

• directly from data subjects (registration and purchases via e-shop, emails, phone, chat, website, contact form on the website, social networks, business cards, etc.)
• Distributor
• publicly accessible registers, lists and records (e.g. commercial register, trade register, land registry, public telephone directory, etc.)

IV. Categories of personal data subject to processing 

• address and identification data used to uniquely and unmistakably identify the data subject (e.g. name, surname, title, birth number, date of birth, permanent address, lČ, lČČ) and data enabling contact with the data subject (contact data - e.g. contact address, telephone number, fax number, e-mail address and other similar information)
• descriptive data (e.g. bank details)
• other data necessary for the performance of the contract
• data provided in excess of the relevant laws and processed within the scope of the data subject's consent (processing of photographs, use of personal data for the purpose of personnel management, etc.)

V. Categories of data subjects 

• Customer of the controller (only for subjects registered on the e-shop)
• employee of the controller
• carrier
• service provider
• another person who has a contractual relationship with the controller
• a job seeker

VI. Categories of recipients of personal data 

• wholesalers
• financial institutions
• public institutions
• Processor
• state and public authorities in the performance of their statutory obligations under the relevant legislation
• other recipients (e.g. transfer of personal data abroad - EU countries)

VII. Purpose of the processing of personal data 

• the purposes contained in the data subject's consent
• the negotiation of a contractual relationship
• performance of the contract
• protection of the rights of the controller, the recipient or other persons concerned (e.g. recovery of claims of the controller)
• archiving conducted on the basis of the law on vacancy procedures
• compliance with legal obligations by the controller
• protection of the vital interests of the data subject

VIII. Method of processing and protection of personal data 

The processing of personal data is carried out by the controller. The processing is carried out at the controller's premises, branches and headquarters by individual authorised employees of the controller or by the processor. The processing is carried out by means of computer technology or, in the case of personal data in paper form, manually, in compliance with all security principles for the management and processing of personal data. To this end, the controller has adopted technical and organisational measures to ensure the protection of personal data, in particular measures to prevent unauthorised or accidental access to, alteration, destruction or loss of personal data, unauthorised transmission, unauthorised processing or other misuse of personal data. All entities to which personal data may be disclosed shall respect the right of privacy of data subjects and shall comply with applicable data protection legislation.

IX. Period of processing of personal data 

In accordance with the time limits specified in the relevant contracts, in the controller's filing and shredding rules or in the relevant legislation, this is the time necessary to ensure the rights and obligations arising from the contractual relationship and the relevant legislation.

X. Instructions 

The controller shall process data with the consent of the data subject, except in cases provided for by law where the processing of personal data does not require the consent of the data subject.
In accordance with Article 6(1) of the GDPR, the controller may process the following data without the data subject's consent:

• the data subject has given consent for one or more specific purposes,
• the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of measures taken prior to the conclusion of the contract at the request of the data subject,
• the processing is necessary for compliance with a legal obligation to which the controller is subject,
• the processing is necessary for the protection of the vital interests of the data subject or of another natural person,
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
• the processing is necessary for the purposes of the legitimate interests of the controller or of a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data.

XI. Rights of data subjects 

1.In accordance with Article 12 of the GDPR, the controller shall inform the data subject, upon request, of the right to access personal data and to the following information:

• the purpose of the processing,
• the category of personal data concerned,
• the recipients or categories of recipients to whom the personal data have been or will be disclosed,
• the intended period for which the personal data will be stored,
• any available information on the source of the personal data,
• if not obtained from the data subject, whether automated decision-making, including profiling, is involved.

2. Any data subject who becomes aware or considers that the controller or processor is carrying out processing of his or her personal data which is contrary to the protection of the data subject's private and personal life or contrary to law, in particular where the personal data are inaccurate with regard to the purpose of the processing, may:

• Ask the controller for an explanation.
• Request that the controller remedy the situation. In particular, this may involve blocking, rectifying, supplementing or erasing the personal data.
• If the data subject's request pursuant to paragraph 1 is found to be justified, the controller shall rectify the defective situation without delay.
• If the controller does not comply with the data subject's request pursuant to paragraph 1, the data subject shall have the right to apply directly to the supervisory authority, i.e. the Office for Personal Data Protection.
• The procedure referred to in paragraph 1 shall not preclude the data subject from submitting his or her complaint directly to the supervisory authority.
• The controller shall have the right to charge a reasonable fee for the provision of the information, not exceeding the costs necessary to provide the information.