for Přátelé Pavlova, s.r.o.
1. INTRODUCTORY PROVISIONS
1.1. Přátelé Pavlova, s.r.o., registered at Slunný vrch 333, 692 01 Pavlov, Company Registration No.: 019 98 021, inscribed under file number C 79970 in the Companies Register kept by the Regional Court in Brno, email pavel@pritelpavlova.cz, tel. + 420 602 500 266, (hereinafter referred to as the ‘Company’) is the controller of personal data pursuant to Article 4, Paragraph 7 of Regulation (EU) 2016/679 (EU) of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general regulation on the protection of personal data) (hereinafter referred to as the ‘Regulations’) and generally-binding legal regulations.
1.2. The Company operates an online store on a website located at the following Internet address: https://www.pratelepavlova.cz/nase-vina (hereinafter referred to as the ‘online store’) for the purpose of presenting, offering, and selling its products.
1.3. The Company operates a reservation system on the Company’s website at https://www.pratelepavlova.cz/ubytovani#rezervace (hereinafter referred to as the ‘reservation system’) for the purposes of offering and booking the Company’s accommodation services.
2. SOURCES AND CATEGORIES OF PERSONAL DATA, LEGAL BASIS, AND PURPOSE
2.1. The Company processes personal data it has received in accordance with:
2.1.1. operating the Company’s online store and offering and selling the Company’s products,
2.1.2. offering the Company’s accommodation services, both through the reservation system and directly in connection with the accommodation (without reservation).
2.2. In submitting an order through the Company’s online store, or by enquiring about/booking/reserving accommodation services through the reservation system, or by using the Company’s accommodation services, the data subject provides the following personal data to the Company: name and surname, residential address, date of birth, Buyer’s electronic address (or email), phone number, IP address, method of payment (hereafter collectively referred to as ‘personal data’).
2.3. The Company may also obtain the personal data of the data subject from intermediary service providers, such as the booking.com platform, etc., which mediate offers of the Company’s services or products.
2.4. In connection with sending an order, whether through the online store or reservation system, or in connection with concluding an accommodation agreement, the data subject provides the Company (by ticking the appropriate declaration) with their consent to the processing of their personal data for marketing purposes and sending commercial messages. Consent is voluntary and can be withdrawn at any time. The granting of this consent is not linked to the provision of goods or services by the Company.
2.5. Personal data is processed in a correct, lawful, and transparent manner solely for the specified purposes:
2.5.1. the creation, management, and processing of reservations through the reservation system and provision of accommodation (even without a reservation), whereby the legal basis for the processing of personal data for this purpose is the concluded accommodation agreement in accordance with Article 6, Paragraph 1, Point (b) of the Regulations and, if applicable, the fulfilment of legal obligations according to Article 6, Paragraph 1, Point (c) of the Regulations,
2.5.2. order processing, whereby the legal basis for the processing of personal data for this purpose is the concluded purchase agreement in accordance with Article 6, Paragraph 1, Point (b) of the Regulations and, where applicable, fulfilment of legal obligations according to Article 6, Paragraph 1, Point (c) of the Regulations,
2.5.3. marketing of the Company’s products, sending commercial communications, whereby the legal basis for the processing of personal data for this purpose is the express consent of the data subject to the processing of personal data in accordance with Article 6, Paragraph 1, Point (a) of the Regulations in conjunction with Article 7, Paragraph 2 of Act No. 480/2004 Coll., on Certain Information Society Services, in the absence of an order for goods or services.
2.5.4. protection of the Company’s assets, provision of documents and evidence for the possible defence of the Company’s rights and position, with the legal basis being the legitimate interests according to Article 6, Paragraph 1, Point (f) of the Regulations.
2.6. The Company declares that it shall always process personal data only to the extent and scope necessary for the purposes stated above, and in accordance with the Regulations.
2.7. The legality of the processing of personal data provided by the Buyer is based, among other things, on Act No. 563/1991 Coll., on Accounting (invoicing data), on Act No. 89/2012 Coll., of the Czech Civil Code (fulfilment of the purchase agreement, accommodation agreement, protection of the seller’s entitled interests), or on Act No. 235/2004 Coll., on Value Added Tax, Act No. 99/1963 Coll., the Code of Civil Procedure, and Act No. 141/1961 Coll., on Criminal Proceedings (identification data of the buyer).
2.8. The data subject is obliged to provide their personal data (during registration, making a reservation, ordering from the online store, concluding an accommodation agreement) in a correct, up-to-date, complete, and truthful manner, and is obliged to inform the Company without undue delay of any change to their personal data.
3. PERIOD OF STORAGE OF PERSONAL DATA
3.1. The Company declares that it shall store personal data for the period necessary to fulfil the purpose for which the personal data is processed, depending on the specific purpose and legal basis of the processing of this personal data.
3.2. The Company shall store personal data for a period of 3 years from the settlement of the last order or provision of accommodation.
3.3. For the purposes of marketing (including commercial communications) the Company’s products, the Company shall store personal data for a period of 2 years from the moment of termination of the purchase agreement/settlement of the last order, or until consent is withdrawn.
4. RECIPIENTS OF PERSONAL DATA
4.1. The Company hereby declares that the recipients of personal data, in addition to the Company as the controller, may also be entities to which the Company provides personal data on the basis of legal regulations, as well as other processors – in particular companies providing payroll and HR software, companies providing logistics activities, companies providing IT security and data encryption, other suppliers, Czech Post, couriers, and any other cooperating persons. The Company shall ensure that the recipients comply with the necessary level of personal data protection in accordance with the Regulations and these principles.
4.2. Personal data shall not be transferred to a third country.
5. PROCESSING METHODS AND PROFILING
5.1. Personal data will be processed in electronic form in an automated manner or in printed form in a non-automated manner.
5.2. The Company does not carry out profiling or automated decision-making.
5.3. The company declares that it has taken all technical and organisational measures to ensure the protection of personal data.
6. DATA SUBJECT RIGHTS
6.1. Personal data subjects have the following rights:
- the right to withdraw consent – the data subject may use either an electronic form sent via the Company’s email, a written form sent by post to the Company’s registered address, or in person at the Company’s registered office. Withdrawal of consent does not affect the legality of the processing of personal data that the Company shall process on the basis of the data subject’s withdrawal.
- the right to access in accordance with the provisions of Article 15 of the Regulations – the data subject has the right to obtain confirmation as to whether their personal data is being processed by the Company, and to have information on and access to the data subject’s record, for the period during which the record is kept.
- the right to rectification according to Article 16 of the Regulations – the data subject may request the correction of inaccurate personal data and request an additional statement.
- the right to erasure (to be deleted) according to Article 17 of the Regulations – the data subject can request deletion, and this corresponds to the Company’s obligation if the conditions according to the Regulations are met (e.g. personal data is no longer necessary to fulfil the purpose of processing).
- the right to restrict processing according to Article 18 of the Regulations – in specified cases, the data subject has the right limit the Company’s processing of their personal data.
- the right to data portability according to Article 20 of the Regulations – in cases stipulated by the Regulations, the data subject has the right to receive processed personal data in a structured, commonly-used and machine-readable format, and the right to transfer this data to another administrator without the Company preventing it. However, this right only applies to personal data obtained on the basis of consent or on the basis of a contract.
- the right to object according to Article 21 of the Regulations – the data subject has the right to object to the processing of personal data based on legitimate justifiable interests, particularly if they believe that the Company does not have a compelling legitimately justifiable reason or interest for the processing.
- the right to lodge a complaint – the data subject can file a complaint with the supervisory authority, which is the Office for Personal Data Protection Office, located at Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, if they believe that their personal data is being processed in violation of the Regulations. More information can be found here: https://www.uoou.cz/chci-podat-stiznost-na-spravce-nebo-zpracovatele/ds-4454/archiv=0&p1=2611
7. SENDING COMMERCIAL COMMUNICATIONS
7.1. The personal data subject consents to receiving information related to the Company’s goods or services to the data subject’s electronic address and further consents to the Company sending commercial communications to their electronic address.
8. FINAL PROVISIONS
8.1. The data subject acknowledges that they are familiar with these principles within the framework of the online store or reservation system, or in concluding an accommodation agreement by ticking the relevant declaration.
8.2. The Company is entitled to change these policies at any time. The new version of these will be published by the Company on its website.
