Personal Data Processing Policy

The company CCVis s.r.o., Company Number: 14327341 having its registered office at Evropská 2758/11, 160 00 Praha 6, entered in the Commercial Register maintained at the Metropolitan Court in Prague, file C 363994 (hereinafter referred to as “We”), as the personal data controller, inform you, as the user of our website, our customers, suppliers, and persons involved in the development and testing of our products of the collection of personal data described hereunder and the privacy policy.

It is important to us that your personal data are protected, and for this reason We shall invariably respect this policy in our relations with you. This personal data protection policy primarily explains:

which of your personal data We shall process;
for which purposes and in which way We shall process your personal data, and the legal basis for the processing thereof;
to whom your personal data may be transferred;
for how long We retain your personal data; and
what rights you have in relation to the protection of your personal data.

Should you require an explanation for any part of this document, you need advice, or you need to discuss the onward processing of your personal data, you can contact us at any time by e-mail at gdpr@ccvis.cz or at the address of our company’s registered office.

THE SCOPE OF PERSONAL DATA PROCESSING

Should you merely visit our website, We will process the following personal data:
- Cookies
Should you contact us as an applicant for employment with us (via the website http://www.makejvit.cz/, or in some other way), you will be asked to provide certain data about yourself, which We will then process. Such data are:
- first name and surname;
- e-mail address and telephone number;
- curriculum vitae, which might contain, in addition to the data specified already, at a minimum, information about your education and your work experience and about your other knowledge or expertise according to the position sought; if you state any other personal data in the CV, this is your free choice to provide us with that information and We will process such information provided by you for the purposes of the selection process.
Should you wish to attend any of the events held at our company’s registered office or organised by our company, for example Open Days, you will be asked to register, either via the website http://www.makejvit.cz/ or in some other way. When registering, you will be asked to provide your data, which We will then process. Such data are:
- first name and surname;
- e-mail address and telephone number.
If you are our customers or suppliers, you might be asked to provide your data, which We will then process. Such personal data are, primarily:
- first name and surname, date of birth, or Company Number;
- representing the company (trade name);
- address, telephone number, and e-mail address;
- employment position of the representative of the company;
- bank account number;
- other personal data which are required for the fulfilment of our obligation to each other.
If you are involved in the development and testing of our products, We shall process the personal data that are required for cooperation on development and testing, whereby in some cases this might involve special categories of personal data, primarily about medical condition. A full, across-the-board listing of personal data cannot be provided without specification of the actual project, whereby this information will be provided to you within the bounds of that project. We shall, however, invariably require:
- first name and surname;
- e-mail address and telephone number.

COOKIES

Our website uses cookies files (small text files located on your device), which serve to provide websites and online services and collect data. The text in cookies often consists of a set of numbers and letters which unambiguously identify your computer, but which might also contain other information. We are able to collect such information in the case of you interacting with the website; for example, submitting a registration form or submitting a form to register your interest in employment. You can learn more about cookies, for example, from the Internet encyclopaedia Wikipedia at https://cs.wikipedia.org/wiki/HTTP_cookie.

We collect such data in the case that you access our website. Certain cookies are required for the functioning of our website, and these will always be active. We may only use other cookies which are not required for the functioning of the website on the condition that you give your consent to our use of them.
Further, our website might collect information containing, for example, the type of browser or operating system, IP address, site visits, Internet connection provider, and other information of a similar nature.

HOW TO BAN THE USE OF COOKIES

Some of the functions of our services are based on cookies. Even if you have given consent to the use of cookies that monitor your behaviour on the website, you can block their use thereafter. If you decide to block cookies, you will probably not be able to sign in or use certain functions and you might lose any preferences which are based on cookies. You can set the use of cookies in your Internet browser. Most browsers automatically accept cookies in the default settings. Cookies can be banned using your Internet browser, or you can set up the use of only certain cookies.
You can find information about browsers and how to set preferences for cookies at the following websites:

A tool for managing cookies is also available at http://www.youronlinechoices.com/cz/.

THE PURPOSE OF PROCESSING AND THE LEGAL BASIS OF PROCESSING

1) If you are a visitor to our website, We process your personal data in the form of cookies, as is described above, in our legitimate interest, which means our interest in monitoring the use of our services and improving them. We will only process your personal data for the purpose specified above. The provision of the data specified above is not our requirement; however, not providing such data could lead to the limitation of certain functions of our website. Such personal data of yours shall not be used for the purpose of any solely automated decision-making, including profiling based on such decision-making.

2) If you are applying for employment with us, We process your personal data in our legitimate interest, meaning our interest in occupying our vacant position, and in your interest in obtaining employment in line with your expectations. The purpose of processing is therefore finding a suitable candidate for the vacant position We have. We use the data which you provide us to be able to contact you regarding the status of the selection process. We will only process your personal data for the purpose specified above. In the event that you are interested in a specific employment position, We will only process your personal data for the purpose of occupying that employment position, or a position which is similar to the position for which you are applying. We require that you provide the personal data specified above; if you do not provide those data, We cannot include you in the selection process. Such personal data of yours shall not be used for the purpose of any solely automated decision-making, including profiling.

If you are applying for employment with us, you might also give us your consent to process personal data, namely to process data for the purposes of the selection process, or consent to the sending of the controller’s commercial and marketing communications and invitations to events, trade fairs, and workshops. The legal basis for this processing is the consent which you have given, which We will not force you to do – it is entirely voluntary. You may also give us consent for one case only – consent for different purposes is separate. The giving of consent is not our contractual requirement. Consent to the retention of data for the purposes of the selection process will, however, make it possible for us to contact you over a longer period of time; We will have a longer period of time during which We are able to offer you an employment position with us. Consent to the sending of commercial and marketing communications and invitations to events, trade fairs, and workshops makes it possible for us to send you information which might, from our perspective, be of interest and benefit to you; We will certainly not take this to excesses.

3) If you wish to attend any of the events held at our company’s registered office or organised by our company, We will process your personal data on the grounds of performing a contract, when it is our obligation to allow you to attend the event which We organise and, to be able to fulfil this obligation, We need to identify you so as to be able to give you access to the event. We use the data which you provide so as to be able to identify you and, where appropriate, contact you in the situation that there is a change to the organisation of the event. We will only process your personal data for the purpose specified above. We require that you provide the personal data specified above; if you do not provide those data, We cannot admit you to the event. Such personal data of yours shall not be used for the purpose of any solely automated decision-making, including profiling.

If you wish to attend any of the events held at our company’s registered office or organised by our company, you might also give us your consent to process personal data, namely to process data for the purposes of inclusion in the record of applicants for employment, or consent to the sending of the controller’s commercial and marketing communications and invitations to events, trade fairs, and workshops. The legal basis for this processing is the consent which you have given, which We will not force you to do – it is entirely voluntary. You may also give us consent for one case only – consent for different purposes is separate. The giving of consent is not our contractual requirement; however, consent to data processing for the purposes of inclusion in the record of applicants for employment will allow us to contact you in the case that an employment position becomes vacant. Consent to the sending of commercial and marketing communications and invitations to events, trade fairs, and workshops makes it possible for us to send you information which might, from our perspective, be of interest and benefit to you (for example, invitations to similar events); We will certainly not take this to excesses.

4) If you are our customers or suppliers, We primarily process your personal data on the grounds that they are required for the purposes of performing a contract or fulfilling statutory obligations (in particular, tax and accounting obligations), or in our legitimate interest (in particular, so that We can improve the quality of our services and contact you with our offers). The purpose of processing is primarily to ensure the problem-free execution of our commercial relationship and to further develop our commercial cooperation together. We may therefore use your first name, surname, and e-mail address to send you commercial and marketing communications and invitations to events, trade fairs, and workshops; i.e. so that We can provide you with information which might, from our perspective, be of interest and benefit to you. We may also use your personal data for our internal needs, in particular to monitor your level of satisfaction, optimise and increase the quality of the products and services provided, develop new products, and reduce risks. We require that you provide personal data for the purposes of performing a contract and for the fulfilment of statutory obligations and any failure to provide them could be grounds for not entering into a contract or terminating commercial cooperation.

However, the processing of your personal data for the purposes of sending commercial communications is not our contractual requirement and you can refuse at any time without this having any effect on our other relations with each other. It is enough to send an e-mail containing the relevant request to gdpr@ccvis.cz, or to another address from which you received commercial communications from us. Such personal data of yours shall not be used for the purpose of any solely automated decision-making, including profiling.

5) If you are involved in the development and testing of our products, all detailed information will be provided to you before the start of the relevant project. Each and every project is original and across-the-board information cannot be provided. We shall, however, invariably process your first name, surname, and e-mail address for the purpose of being able to contact you. We require the provision of such data.

WHO HAS ACCESS TO YOUR PERSONAL DATA?

Processors may process your personal data for us within the bounds of ensuring certain activities, or personal data may be provided to recipients; this primarily involves the following entities:

Entities which provide us with server, web, cloud, or IT services;
Entities which provide us with accounting services;
Entities which provide us with legal services;
Processors which provide us with other services – consultation, audits, and other external services.

In light of the frequency of our projects, it might occur in some cases that We find ourselves in the position of joint controller together with a partner; if such a situation should arise, We will inform you of this in that specific case.

THE TERM OF PERSONAL DATA PROCESSING

We will process your personal data for the period of time for which We provide you with our services or perform a mutual contract, for the duration of our legitimate interest, or for the period of time required for the fulfilment of archiving or other obligations according to the legal regulations in force; for example, the Act on Accounting, the Act on Archiving, and Act on Value Added Tax, etc.

We shall retain your personal data for the period of time which is absolutely required for the provision of our services and the completion of the requested transactions, or for other essential purposes, such as adhering to our legal obligations, the resolution of disputes, and the legal enforcement of our agreements. Such needs might differ for different types of data within the context of different situations, and for this reason the actual period of data retention might differ significantly. The following are among the criteria on the basis of which the period of data retention is determined:

How long are personal data required for the provision of services and to ensure the running of our company? This includes activities such as maintaining and improving the performance of such services, maintaining the security of our systems, and maintaining the relevant commercial and financial records. This is a generally-valid rule, which is in most cases the basis on which the period of data retention is determined.
Do you provide us with your data in the expectation that We will retain them until such time as you expressly want them erased? If so, We will erase them at your express request.
Have We established and reported a specific period of retention for a specific type of data? If so, We will certainly not exceed this.
Have you provided consent to an extension of the data retention period? If so, We will retain the data in accordance with your consent.
Do legal, contractual, or similar obligations to retain data apply to us? Examples of this include laws which govern the mandatory retention of data, government regulations to retain data associated with an investigation, or data which must be retained for the purposes of a judicial dispute.

In light of the above criteria, which may differ over time (in particular, with regard to an amendment to legal regulations), We are unable to set out a general retention period in this policy. However, We shall invariably inform you of the exact period of processing your personal data should you contact us (for example, by sending an e-mail to gdpr@ccvis.cz).

YOUR RIGHTS ARISING FROM PERSONAL DATA PROCESSING

You have the following rights in relation to our processing of your personal data:

the right of access to personal data;
the right of rectification;
the right of erasure;
the right of restriction of data processing;
the right of data portability;
the right to lodge an objection to processing;
the right not to be subject to a decision based solely on automated processing, including profiling;
the right to lodge a complaint against personal data processing.

Your rights are explained hereunder so that you are able to get a clearer idea of what they involve.

The right of access means that you can, at any time, request confirmation from us of whether or not We are processing personal data which concern you, and if so, for which purposes, to what extent, to whom they are disclosed, for how long We will process them, whether you have the right of erasure, the right of restriction of processing, or the right to lodge an objection, from where We obtained those personal data, and whether automated decision-making, profiling included, will take place during the processing of your personal data. You also have the right to obtain a copy of your personal data, whereby the first such provision thereof is without charge. We may demand reasonable payment of the administrative costs of any provision thereafter.

The right of rectification means that you may request, at any time, the rectification or supplementation of your personal data if they are inaccurate or incomplete.

The right of erasure means that We must erase your personal data if (i) they are no longer required for the purposes for which they were collected or otherwise processed; (ii) processing is unlawful; (iii) you lodge an objection to processing and there are no overriding legitimate grounds for processing; (iv) We are required to do so by statutory obligation; or (v) you withdraw given consent to personal data processing.

The right of restriction of processing means that if We are not dealing with any contentious issues regarding the processing of your personal data, We may not process your personal data in any other way than retaining them and We may only use them with your consent or for the establishment, exercise, or defence of legal claims.

The right of portability means that you have the right to receive personal data which concern you and which are processed in an automated manner and based on consent or a contract in a structured, commonly used, and machine-readable format, and the right to have these personal data transferred directly to another controller.

The right to lodge an objection means that you can lodge an objection to the processing of your personal data which We process for the purposes of direct marketing or on the ground of legitimate interest.
If you lodge an objection to processing for direct marketing purposes, your personal data will no longer be processed for such purposes. If you lodge an objection to processing on the ground of legitimate interest, your objection will be evaluated and We will subsequently inform you of whether We have accepted your objection and will no longer process your data, or whether the objection is groundless and processing will continue. Whatever the outcome, processing will be restricted for the period of time taken to deal with the objection.

The right not to be subject to a decision based solely on automated processing, including profiling, means that no decision which has legal effects for you or which significantly concerns you in a similar manner shall be taken by our company by way of automated processing, including profiling. This does not stand in the case that such processing is required in order to enter into or perform a contract between you and our company or in the case that you give your express consent to this type of processing, or if such processing is permitted by a legal regulation which applies to our company.

If you have any remarks or complaints to concern the protection of your personal data, or if you have a question for the person responsible for data protection at our company, or if you are exercising any of your rights, please contact us by e-mail at gdpr@ccvis.cz. We will respond to your questions or remarks within one month. If required, and with regard to the complexity and number of requests, this time limit may be extended by a further two months.

Úřad pro ochranu osobních údajů (Office for Personal Data Protection) also supervises our activity and you may lodge a complain with the Office for Personal Data Protection if you are not satisfied. More information is available at the Office for Personal Data Protection website (www.uoou.cz).

REPORTING SECURITY INCIDENTS

In this age of modern technology, there is a risk, albeit a minor risk, that your personal data might leak or be misused or lost. In our activities, We shall do everything in our power to avoid such security incidents. In particular, We shall regularly train all of those of our employees who come into contact with your personal data in personal data protection, We shall adopt and familiarise our employees with internal corporate regulations which regulate the protection of your personal data, and We shall invariably use only the most appropriate technical solutions to ensure our processing, such as data encryption, complex passwords, and the corresponding software.

If, however, in spite of our best efforts, a security incident does occur and this incident could mean a high risk to your rights and freedoms, We will inform you of this incident without delay by sending an e-mail to the e-mail address which you have provided and by publishing such information on our website, together with all the necessary details.

POLICY CHANGES

Our personal data protection policy might be amended from time to time. We will not restrict your rights arising from this personal data protection policy without your express consent. We will publish all amendments to the personal data protection policy at this site and, if the amendment is significant in nature, We will inform you in a more direct manner (in the case of certain services, We may announce amendments to the personal data protection policy by e-mail).