Privacy Policy and GDPR

INFORMATION OBLIGATION FOR CUSTOMERS AND POTENTIAL CUSTOMERS

The company VÚTS, a.s., Svárovská 619, Liberec XI-Růžodol I, postal code: 460 01, ID number: 46709002, entered in the Commercial Register kept by the Regional Court in Ústí nad Labem under file no. No. B 293 (hereinafter referred to as “Company”) as a controller hereby, in accordance with Regulation (EU) No. 2016/679 of the European Parliament and of the Council (EU) on the protection of individuals (natural persons) with regard to the processing of personal data (hereinafter referred to as “Regulation”), as amended effective from 25 May 2018, allows to inform its customers and potential customers (hereinafter referred to as "Data Subjects") about the processing of their personal data.

Protecting the privacy of customers and their personal data is one of the Company's priorities. We hold the privacy of your personal data in the highest regard. We emphasize security in their processing, the appropriate selection of contractual partners who have access to personal data of potential customers and customers, and strict adherence to all the rules by which we are bound.

The Company hereby informs Data Subjects that it processes their personal data on the basis of the following legal titles and for the following purposes:

a) Provision of services
Legal title: Fulfillment of a contractual obligation
Data Subject: Customer
Purpose: Implementation of the provision of service on the basis of an order or a contract
Data retention period:
i) For the duration of the contract,
ii) To the extent strictly necessary after its termination for the duration of the limitation period of any claim by the Company and/or the Data Subject

b) Response to demand
Legal title: Fulfillment of a contractual obligation
Data Subject: Potential customer
Purpose: Communication in response to demand
Data retention period:
i) For the duration of the communication in response to the demand,
ii) To the extent strictly necessary after its termination for the duration of the limitation period of any claim by the Company and or the Data Subject and for the archiving period stipulated by law

c) Entry in the guest book
Legal title: Legitimate interest
Data Subject: Any visitor to the Company's premises, including customers and potential customers
Purpose: Protection of property and safety of the Company's employees
Data retention period: For 1 year

d) Sending business messages to current customers
Legal title: Legitimate interest
Data subject: Customer
Purpose: Sending business messages, such as Christmas cards, price offers, invitations to various events, etc.
Data retention period: For the duration of the contractual relationship, or until the withdrawal of consent by the Subject

e) Sending business messages to potential customers
Legal title: Consent to the processing of personal data, if granted by the Subject
Data Subject: Potential customer
Purpose: Sending business messages, such as price offers, invitations of various events, etc.
Data retention period: 3 years, or until the withdrawal of the Data Subject

The Data Subject may at any time object to the processing of his/her personal data by the Company for the purposes of direct marketing carried out on the basis of the legitimate interest of the Company.

For information on the processing of personal data by means of a camera monitoring system, the Data Subject may consult the document Information on the processing of personal data of individuals (natural persons) by means of a camera monitoring system, which is available at the Company's registered office.

The personal data processed under letters d) and e) are voluntary data and Data Subjects are not obliged to provide them. Personal data under letters a) and b) are a contractual requirement and for the purposes of fulfilling the given contract, their provision is mandatory. Personal data under letter c) are processed on the basis of the legitimate interest of the Company and are provided by the Data Subject compulsorily, otherwise it would not be allowed to enter the registered office of the Company.

The granted consent can be revoked at any time with effect for the future by a written statement sent to the address of our Company. The Data Subject may not be sanctioned in any way by the Company for failure to grant consent or its subsequent revocation. The granting or non-granting or later revocation of any consent to the processing of personal data does not affect the implementation of the contractual relationship between the Company as a service provider and the Data Subject. The Data Subject may revoke the consent already granted by a written statement delivered to the Company's address.

Personal data of the Data Subject will be processed automatically also through the Company's employees. However, the company does not make any individual automated decisions, including profiling.

To the extent strictly necessary, personal data may be transferred/made available for processing to the following recipients:

i) Companies that cooperate in the management (administration) of IT infrastructure
The Company informs the Data Subject that, under the conditions set out in the Regulation, the Data Subject towards the Company:

Right of access - The Data Subject may request the Company to access personal data that it processes about him/her (them). The Company will also provide a copy of the processed personal data.

Right of correction - The Data Subject may request the Company to correct inaccurate or incomplete personal data that it processes about him/her (them)

Right of deletion (erasure) - A Data Subject may request the Company to delete his/her (their) personal data if any of the following situations occur:

Personal data are no longer needed for the purposes for which they were collected or otherwise processed;

The Data Subject has withdrawn the consent on the basis of which his/her (their) personal data were processed and there is no other legal reason for their processing;

The Data Subject has objected to being the subject of a decision based on the automated processing of his/her (their) personal data and there are no overriding legitimate reasons for such processing or has objected to the processing of his/her (their) personal data for direct marketing purposes;

The Data Subject's personal data were processed illegally;

The personal data of the Data Subject must be deleted in order to comply with a legal obligation laid down in Union or Member State law applicable to the controller;

Personal data of the Data Subject were collected in connection with the offer of information society services;

Right to restrict processing - The Data Subject may request the Company to restrict the processing of his/her (their) personal data if any of the following situations occur:

The Data Subject has denied the accuracy of the personal data for the time necessary for the Company to verify the accuracy of the personal data;

The processing of the Data Subject's personal data is illegal, but the Data Subject refuses to delete this data and instead requests a restriction on their use;

The Company no longer needs personal data for processing purposes, but the Data Subject requires it to determine, enforce or defend legal claims;

The Data Subject has objected to the processing of his/her (their) personal data pursuant to Article 21 (1) of the Regulation until it is verified that the legitimate reasons of the Company outweigh the legitimate reasons of the Data Subject

Right to data portability - in cases provided for in the GPDR Regulation, the Data Subject has the right to obtain personal data concerning him/her (them) provided to the Company in a structured, commonly used and machine-readable format, provided that this right does not adversely affect the rights and freedom of others

Right to revoke consent - if the processing of personal data of the Data Subject is based on consent, the Data Subject has the right to revoke his/her (their) consent to the processing of personal data for the purpose for which he/she (they) gave his/her (their) consent at any time

Right to object - The Data Subject may at any time object to the processing of his/her (their) personal data by the Company for the purposes of direct marketing carried out on the basis of the legitimate interest of the Company

Right to file a complaint - The Data Subject has the right to file a complaint with the supervisory body, which is Úřad na ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

In order to exercise his/her (their) rights, the Data Subject may contact the Company in writing at the address of its registered office or at the e-mail address vuts@vuts.cz.

The Data Subject was hereby informed of his/her (their) rights and their protection under Articles 13 and 15 - 22 and 34 of the Regulation.