Processing of personal data

Information on Personal Data Processing

PLAVBY LODÍ PRAHA, s.r.o. (hereinafter referred to as the “controller”) informs the customer, as the data subject (hereinafter referred to as the “customer”), in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”), about the processing of their personal data:

Purpose of Personal Data Processing

Personal data are obtained directly from the customer at the moment of order submission. The controller undertakes to process accurate personal data solely for the purpose of: performance of the contract (service provision agreement) [in accordance with Article 6(1)(b) of the GDPR] and its subsequent fulfillment, including handling any claims by the customer for defective performance. Processing the customer’s personal data is also necessary to fulfill a legal obligation applicable to the controller. The controller is required to meet legal obligations arising from legislation governing consumer protection and accounting. The reason for the customer providing personal data to the controller is to identify the contracting parties necessary for concluding and fulfilling the contract (contractual requirement), which would not be possible without providing this data. Failure to provide personal data may result in failure to fulfill or termination of the service by the controller. sending commercial communications (direct marketing) [in accordance with Recitals 47 and 70a and Article 6(1)(f) of the GDPR]. In this case, the controller has a legitimate interest in promoting the services it offers. The reason for providing personal data to the controller is the customer’s interest in receiving commercial communications, which would not be possible without providing such personal data. The controller undertakes not to process personal data in a manner incompatible with the above purposes.

Scope of Personal Data

The controller undertakes to process personal data only to the extent necessary in relation to the above purposes for which the data are processed. The scope of personal data is as follows:

• First name and last name
• Phone number
• Email address
• Residential address in case of sending gift vouchers by Czech Post
• Billing information of individuals and legal entities (hereinafter referred to as “personal data”).

Data Retention Period

The controller undertakes to process personal data for the purpose of contract fulfillment for a period of 5 years from the date of obtaining the personal data from the customer. The controller is obligated to retain such data under generally binding legal regulations, specifically Act No. 235/2004 Coll., on Value Added Tax. After this period, the controller is obliged to dispose of the personal data. The controller undertakes to process personal data used for sending commercial communications (direct marketing) for a period of 3 years from the date of obtaining the personal data from the customer. After this period, the controller is obliged to dispose of the personal data. In accordance with Recital 70 and Article 21 of the GDPR, the controller explicitly informs the customer that with regard to personal data processed for direct marketing purposes (including profiling related to such direct marketing), the customer has the right to object at any time, free of charge, to such processing to the extent that it relates to such direct marketing, whether it is initial or further processing. If the customer objects to the processing of personal data for the purposes of sending commercial communications (direct marketing), the controller undertakes that the personal data will no longer be processed for these purposes.