Privacy Policy
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC
—
These rules on the protection and processing of personal data (hereinafter referred to as the “Rules”) describe which personal data of clients who are natural persons, or of other customers in relation to natural persons acting on their behalf (hereinafter referred to as the “Data Subject”), are processed in the course of the activities of Technologické inovační centrum s.r.o., Company ID No.: 26963574, with its registered office at Zlín, Vavrečkova 5262, Post Code 760 01, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File No. 48562 (hereinafter referred to as the “Controller”).
These Rules specify the types of personal data that we collect and process when you use our services, as well as the manner in which your personal data are used, shared and protected. They also explain the options available to you in relation to your personal data and how you can contact us. We hereby inform you below about the processing of your personal data and your rights in accordance with Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter also referred to as the “GDPR”).
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
PROCESSORS AND RECIPIENTS OF PERSONAL DATA
The Controller is entitled to transfer personal data to entities with which it has concluded a personal data processing agreement and which will process personal data on behalf of the Controller as its processors. Personal data of the Data Subject may also be further transferred to the following recipients/categories of recipients:
* suppliers of the Controller,
* customers,
* employees of the Controller,
* persons in another contractual relationship with the Controller (e.g. providers of marketing and advertising services, auditors, security agencies, evaluators of business plans),
* financial institutions and insurance companies,
* public authorities in the performance of statutory obligations laid down by applicable legislation (e.g. the Zlín Region, supervisory authorities).
CATEGORIES OF PERSONAL DATA PROCESSED
The Controller is entitled to process, in particular, the following personal data of the Data Subject:
* address and identification data serving to uniquely and unambiguously identify the Data Subject (e.g. first name, surname, title, date of birth, or birth identification number, permanent residence address, business premises address, delivery address, Company ID No., VAT ID No.) and data enabling contact with the Data Subject (e.g. telephone number, fax number, e-mail address, contact address and other similar information),
* descriptive data (e.g. bank account details, payment information or credit card information, order history),
* images, photographs and videos,
* account login information, including the name under which the Data Subject appears on the internet, passwords and a unique user ID,
* data provided beyond the scope of applicable laws and processed on the basis of consent granted by the Data Subject (e.g. use of personal data for personnel management purposes, use of personal data for promotional purposes, etc.),
* personal settings (preferences), including marketing settings and the use of cookies by the Data Subject,
* other data necessary for the performance of the contract,
* other personal data provided by the Data Subject to the Controller.
PURPOSES AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
The Controller processes the personal data of the Data Subject for the following purposes:
a) performance of the contract, on the basis of Article 6(1)(b) of the GDPR,
b) compliance with a legal obligation of the Controller laid down by generally binding legislation, on the basis of Article 6(1)(c) of the GDPR (e.g. the Controller’s obligation to retain accounting and tax documents, the Controller’s obligations relating to grants provided, etc.),
c) establishment, exercise or defence of the Controller’s legal claims, on the basis of Article 6(1)(f) of the GDPR (e.g. informing the grant provider about the participation of Data Subjects in events),
d) sending commercial communications, on the basis of Article 6(1)(f) of the GDPR due to the existence of the Controller’s legitimate interest consisting in direct marketing,
e) other marketing purposes of the Controller associated with the offering of products and services; sending information about organised events, services provided and other activities (e.g. by means of newsletters or telemarketing); contacting Data Subjects for the purpose of market surveys and marketing research;
contacting Data Subjects for the purpose of sending Christmas and Easter greetings or greetings on other holidays and sending discount vouchers, etc., on the basis of Article 6(1)(a) of the GDPR.
PERIOD OF PROCESSING OF PERSONAL DATA
Personal data will be processed only for the period necessary with regard to the purpose of their processing. In view of the above:
* for the purpose under point a) above, personal data will be processed until the obligations arising from the contract cease to exist (without prejudice to the Controller’s right to subsequently continue processing such personal data to the extent necessary for the purposes under points b), c), d) and/or e) above,
* for the purpose under point b) above, personal data will be processed for the duration of the relevant legal obligation of the Controller,
* for the purpose under point c) above, personal data will be processed until the expiry of the 4th calendar year following the end of the warranty period under the contract (if a quality warranty was agreed in the contract), but at least until the expiry of the 5th calendar year following the termination of the obligations arising from the contract,
* in the event of the commencement and continuation of judicial, administrative or other proceedings in which the rights or obligations of the Controller in relation to the relevant Data Subject are addressed, the period of processing of personal data for the purpose under point c) above shall not end before the conclusion of such proceedings,
* for the purpose of sending commercial communications under point d) above, personal data will be processed until the Data Subject expresses their objection to such processing,
* for the purposes under point e) above, personal data will be processed for the period for which the Data Subject has granted the Controller consent pursuant to a separately approved consent to the processing of personal data. In this case, the Data Subject acknowledges that, before this period expires, the Controller may contact them for the purpose of renewing their consent.
No later than by the end of the calendar quarter following the expiry of the above processing period, the relevant personal data for which the purpose of processing has ceased shall be destroyed (by shredding or another method ensuring that unauthorised persons cannot access the personal data) or anonymised.
METHOD OF PROCESSING PERSONAL DATA
Personal data are processed by the Controller. Processing is carried out at the Controller’s registered office by individual authorised employees of the Controller or, where applicable, by Processors. Processing is carried out using computer technology or, where applicable, manually in the case of personal data in paper form, while observing all security principles for the administration and processing of personal data. For this purpose, the Controller has adopted technical and organisational measures to ensure the protection of personal data, in particular measures to prevent unauthorised or accidental access to personal data, their alteration, destruction or loss, unauthorised transfers, unauthorised processing, as well as other misuse of personal data. All entities to which personal data may be disclosed respect the right of Data Subjects to privacy and are obliged to comply with applicable legislation concerning the protection of personal data.
Automated individual decision-making or profiling based on the data provided will not be carried out. Personal data of Data Subjects may be transferred to third countries (i.e. countries outside the EU and EEA). The Controller is entitled to provide personal data of Data Subjects obtained in accordance with these Rules also to relevant recipients/categories of recipients established outside the EU and EEA. In the event of transfers of personal data to third countries, the Controller uses sufficient mechanisms for their protection, including, in particular, an assessment of the adequacy of protection in the third country, the conclusion of standard contractual clauses for the protection of personal data approved by the European Commission, and, where applicable, verification of “Privacy Shield” certification if the intended recipient is established in the USA (more information about this certification is available at the following link: https://www.privacyshield.gov/list).
In the event that personal data of Data Subjects are provided to a third party established outside the EU and EEA, the Controller proceeds as follows:
● internal verification of the existence of a European Commission adequacy decision pursuant to Article 45 GDPR: The Controller transfers personal data of Data Subjects to data recipients in third countries for which the European Commission has assessed whether they provide an adequate level of protection of personal data (the so-called Adequacy Decision). At the time of publication of these Rules on the protection and processing of personal data, these countries include: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Switzerland, Jersey, New Zealand, Uruguay, Isle of Man, Japan and the United States of America (limited to the so-called “Privacy Shield”). Further information on European Commission Adequacy Decisions is available at the following link: https://ec.europa.eu/info/law/law-topic/data-protection_cs.
● verification of certification of a mechanism approved by the European Commission to support the adequacy of the protection of personal data transfers: The Controller transfers personal data of Data Subjects to data recipients in third countries for which the European Commission has not assessed whether they provide an adequate level of protection of personal data (the so-called Adequacy Decision). In order to comply with personal data protection regulations, the Controller uses data transfer mechanisms approved by the European Commission (standard contractual clauses for the protection of personal data approved by the European Commission, available at: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:CS:PDF, https://eur-lex.europa.eu/legal-content/CS/TXT/PDF/?uri=CELEX:32004D0915&from=CS). Where necessary, the Controller also verifies with the specific recipient the existence of binding corporate rules for the protection of personal data (binding corporate rules constitute, pursuant to Article 47 of the GDPR, a protection mechanism approved by the European Commission to ensure the adequacy of personal data transfers).
INFORMATION PROVIDED TO DATA SUBJECTS UNDER THE GDPR
In connection with the processing of their personal data, Data Subjects have a number of rights, including the right to request from the Controller:
* access to their personal data (subject to the conditions of Article 15 of the GDPR),
* rectification or erasure of personal data (subject to the conditions of Article 16 or Article 17 of the GDPR),
* restriction of processing of personal data (subject to the conditions of Article 18 of the GDPR),
* object to the processing of personal data (subject to the conditions of Article 21 of the GDPR),
* the right to data portability (subject to the conditions of Article 20 of the GDPR),
* the right to withdraw consent to the processing of personal data, in writing or electronically, at the address or e-mail address of the Controller specified in these Rules.
If the Data Subject discovers or believes that their personal data are being processed in violation of the Data Subject’s privacy and personal life or in violation of applicable legislation, they have the right to contact the Controller with a request for an explanation and/or remedy. The request must be submitted in writing by sending a letter or e-mail to the Controller’s contact details: [gdpr@ticzlin.cz](mailto:gdpr@ticzlin.cz).
If the Data Subject’s request is found to be justified, the Controller shall remedy the situation without undue delay. This is without prejudice to the Data Subject’s right to contact the supervisory authority directly, the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, +420 234 665 555, [www.uoou.cz](http://www.uoou.cz).
CONCLUSION
The Controller reserves the right to change the Rules on the protection and processing of personal data in any manner and at any time, with the current version always being published on the following websites operated by the Controller: www.ticzlin.cz; www.katalogfiremzk.cz; www.mujprvnimilion.cz; www.zlin.jobs; www.ris3meet.cz; www.createdinzlin.cz; www.liveinzlin.cz; www.mejsvujsmer.cz; www.podnikatelskaakademie.info; www.tictalk.cz; www.zlinbusinessregion.cz; www.zlinbusinessregion.com; www.zlintalentregion.cz; www.zlintalentregion.com.