Information on the processing and protection of personal data of individuals by

BRISK Tábor a.s., with its registered office at Vožická 2068, 390 02 Tábor, ID No.: 47252090,
registered in the Company Register maintained by the Regional Court in České Budějovice, Section B, Entry 563

Email: gdpr@brisk.cz

(hereinafter referred to as the ?Company?)

_____________________________________________________________________________________________

As a data controller, the Company hereby provides information on the method and scope of the processing of personal data by the Company, including the scope of the data subjects‘ rights related to the processing of their personal data by the Company.

The Company processes personal data in accordance with laws of the European Union, in particular Regulation (EC) No. 2016/67 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

Collected data

The Company processes the following range of personal data (depending on the type of data subject):

name and surname
residential address / registered office
date of birth / ID No. (for entrepreneurial individuals)
e-mail address
phone number
information on the purchase / sale of products or services
job position information

third-party cookies (Google Analytics and Google Maps APIs) are used for visits to our site

Purpose of the processing

To complete the purchase and delivery of goods (which includes services) at the designated place identified by the buyer/seller, and to communicate with the buyer and comply with other statutory obligations, the Company needs to know the aforementioned data. The data is obtained by the Company via commercial communication with the buyer or seller and is retained for the period of time necessary for the purpose for which the personal data has been collected. Since the buyer?s/seller’s personal data is acquired for the purpose of entering into contractual business relationships, to which the buyer/seller is a party, or is necessary to meet a statutory obligation, the buyer’s explicit consent with the processing is not necessary.

Processing with consent

The buyer may consent to the processing of the aforementioned personal data when placing their order, e.g., for the purposes of:

receiving information related to goods and services
receiving commercial communications/newsletters/magazines
receiving invitations for promotional events organised by the Company

The purchase of goods/services is not subject to such consent, and the buyer may withdraw their consent to the retention and processing of the aforementioned personal data or to receiving commercial communications, information related to goods and services, newsletters/magazines and invitations for promotional events as referred to above at any time by sending an e-mail to: gdpr@brisk.cz. The withdrawal shall be without prejudice to the processing of personal data for the purpose of performing a contract to which the buyer is a party, or, where appropriate, personal data that is necessary for the fulfilment of a statutory obligation.

Form and duration of the processing

A buyers? personal data shall be processed electronically, using automated means of processing, or in printed format, without using automated means of processing. In order to ensure the security of the processed personal data, the Company has put in place appropriate technical and organisational measures, which reflect the severity of the risks posed by the processing to the rights and freedoms of individuals.

Any data processed to fulfil a contract, to which the buyer is a party, or, where relevant, to comply with a statutory obligation (to provide for the supply of goods or services, settle any claims, adhere to accounting obligations, keep records, address serial defects, etc.) shall be maintained for the necessary period of time as set out by the relevant laws (Act No. 89/2012 Coll., New Civil Code, Act No. 563/1991 Coll., on accounting, etc.) or for such a period of time as may be necessary to fulfil the purpose of the collection thereof.

Personal data processed on the basis of granted consent shall be kept until expiry of the consent.

Processors

In order to secure the attainment of the purposes described above, the personal data shall, in addition to the Company and its employees, also be processed by processors under processing contracts to be entered into in accordance with the Regulation and the Act.

Data processors are:

public authorities
other third parties providing services in connection with the fulfilment of contractual or statutory obligations (external IT companies, auditing companies, external accountants, external law firms)

Instruction on the rights

The buyer/seller shall have the following rights to secure the protection of their personal data:

1. Right of information

Right of information denotes all rights of the buyer set out under Article 13 or Article 14 of the Regulation. In particular, this concerns the buyer’s right to know the identity and contact details of the controller and to know the purpose for which the buyer’s personal data is collected and processed.

2. Right of access to personal data

The right of access to personal data denotes all the buyer’s rights contained under Article 15 of the Regulation. In particular, this concerns the buyer’s right to obtain confirmation from the controller as to whether or not any personal data concerning them is being processed.

3. Right to rectification

The right to rectification denotes all of the buyer’s rights contained in Article 16 of the Regulation, in particular the right to have the Company rectify without undue delay any inaccurate or incorrect personal data concerning the buyer.

4. Right to erasure (?right to be forgotten?)

The right to erasure denotes all the buyer’s rights contained in Article 17 of the Regulation, in particular the buyer’s right to obtain the erasure of all their personal data without undue delay at their request, provided the conditions laid down by the Regulation are met.

5. Right to restriction of processing

The right to restriction of processing denotes all the buyer’s rights contained in Article 18 of the Regulation.

6. Right to data portability

The right to data portability denotes all the buyer’s rights contained in Article 20 of the Regulation, in particular the buyer’s right to obtain the personal data they have provided to the Company in a structured, commonly used and machine-readable format.

7. Right to object

The right to object denotes all the buyer?s rights contained in Article 21 of the Regulation.

If the buyer/seller finds out or believes that the Company processes their personal data in contravention of the protection of the buyer?s/seller?s private life, in contravention of the Regulation, or in contravention of the Act, they may require clarification from the Company or demand that the condition be removed.

In addition, the buyer/seller has the right to address a complaint to the Office for Personal Data Protection, which acts as the supervisory authority in matters concerning personal data protection.

This shall be without prejudice to the buyer?s/seller’s right to other means of court and administrative protection.

The buyer may direct any questions concerning the processing of personal data by the Company to the contact addresses given in the heading of this document.

In Tábor, 24 May 2018