GDPR

Personal Data Processing and Protection Policy under the GDPR

(hereinafter also referred to as the “Policy”)

1. INTRODUCTORY PROVISIONS

1.1.

The controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”), is:

Name: Dana Kápičková
Registered Office / Address: Bartoňova 828, 530 12 Pardubice
Company ID (IČO): 09614362
Contact: e-mail: dkapickova@seznam.cz

(hereinafter referred to as the “Controller”).

1.2.

When processing personal data, the Controller acts in accordance with the GDPR, Act No. 101/2000 Coll., on the Protection of Personal Data, Act No. 89/2012 Coll., the Civil Code, and other applicable legislation.

1.3.

The following sections set out the personal data processed, the manner in which such data are processed, the period for which your personal data are processed, the purposes of processing, as well as information provided to you as data subjects by the Controller.

2. CATEGORIES OF PERSONAL DATA

2.1.

The Controller processes only the basic data that are strictly necessary, namely:

identification data (your first and last name, business name, residential or registered office address, and, where applicable, your delivery address, Company ID (IČO), VAT ID (DIČ), and date of birth);
contact details (your e-mail address and telephone number, and, where applicable, your IP address).

2.2.

The Controller processes personal data that you have provided to the Controller or personal data obtained by the Controller in connection with the fulfilment of your order.

3. LEGAL BASIS AND PURPOSE OF PROCESSING PERSONAL DATA

3.1.

The legal grounds for processing personal data are:

performance of a contract to which you, as the data subject, are a party;
compliance with a legal obligation to which the Controller is subject;
the Controller’s legitimate interest in carrying out direct marketing;
your consent to the processing of personal data for the purposes of direct marketing (sending commercial communications and newsletters).

3.2.

The Controller processes personal data for the purpose of processing and fulfilling your order, complying with the Controller’s legal obligations towards the state (e.g. tax obligations), and carrying out marketing activities.

3.3.

You may withdraw your consent to receiving commercial communications at any time (see Section 7.6 of this Policy).

4. RETENTION PERIOD OF PERSONAL DATA

4.1.

The Controller retains your personal data for the period necessary to exercise the rights and fulfil the obligations arising from the contractual relationship, or for the period necessary to comply with archiving obligations under other applicable legislation (the Accounting Act, the Archives and Records Management Act, and the VAT Act), but for no longer than 10 years after the termination of the contractual relationship.

Unless you withdraw your consent to the processing of personal data for direct marketing purposes, such data are processed for a maximum period of 3 years.

4.2.

After the retention period has expired, your personal data will be deleted.

5. SECURITY OF PERSONAL DATA

5.1.

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons arising from the processing, the Controller has implemented appropriate technical and organisational measures to comply with the requirements of the GDPR and protect the rights of data subjects.

6. RECIPIENTS OF PERSONAL DATA

6.1.

The Controller provides personal data to the following recipients:

external accountants;
payment service providers and payment processors for the purpose of securing the transfer of funds.

6.2.

Your personal data are not transferred to any country outside the European Union. Personal data are processed both manually and by automated means.

7. YOUR RIGHTS

7.1. RIGHT OF ACCESS TO PERSONAL DATA (Article 15 GDPR)

You have the right to request access to the personal data concerning you that are being processed and to the following information:

a) the purposes of the processing of personal data;
b) the categories of personal data being processed;
c) the categories of recipients to whom the personal data have been or will be disclosed;
d) the period for which the personal data will be processed and stored;
e) any available information concerning the source of the personal data, where the data have not been obtained from you;
f) information as to whether automated decision-making, including profiling, takes place.

7.2. RIGHT TO RECTIFICATION OF PERSONAL DATA (Article 16 GDPR)

You may contact us and request the correction of your personal data if the information we hold about you is inaccurate, incomplete or outdated. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

7.3. RIGHT TO ERASURE OF PERSONAL DATA (Article 17 GDPR)

You may contact us and request the erasure of your personal data if:

a) the data are no longer necessary for the purposes for which they were collected or otherwise processed;
b) you have withdrawn your consent to the processing of the data;
c) the data have been processed unlawfully;
d) the data must be erased in order to comply with a legal obligation under EU or Member State law to which the Controller is subject; or
e) you have objected to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

7.4. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA (Article 18 GDPR)

You have the right to request restriction of the processing of your personal data if:

a) you contest the accuracy of the personal data, for the period necessary for us to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request restriction of their use instead;
c) we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims;
d) you have objected to processing pursuant to Article 21(1) of the GDPR, pending the verification of whether our legitimate grounds override your legitimate grounds.

If you have obtained a restriction of processing, you will be informed in advance before the restriction is lifted.

7.5. RIGHT TO DATA PORTABILITY (Article 20 GDPR)

You may request that your personal data be provided to you in a structured, commonly used and machine-readable format, or that such data be transmitted directly to another controller, where:

a) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR; and
b) the processing is carried out by automated means.

7.6. RIGHT TO WITHDRAW CONSENT TO THE PROCESSING OF PERSONAL DATA AT ANY TIME

You may withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7.7. RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA (Article 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7.8. RIGHT TO LODGE A COMPLAINT

If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)

Address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

Data Box ID: qkbaa2n

E-mail: posta@uoou.cz

8. PERSONAL DATA BREACH

8.1.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you of the breach without undue delay.

The notification will describe the nature of the personal data breach and will contain at least the information and measures referred to in Article 33(3)(b), (c) and (d) of the GDPR.

Such notification is not required if any of the following conditions is met:

a) we have implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular measures that render the personal data unintelligible to any person who is not authorised to access them, such as encryption;
b) we have taken subsequent measures which ensure that the high risk to your rights and freedoms is no longer likely to materialise;
c) it would involve disproportionate effort.

9. DATA PROTECTION OFFICER

9.1.

The Controller has not appointed a Data Protection Officer (DPO). In matters relating to the processing of personal data, you may contact us directly.

All contact details can also be found on the Controller’s website:

www.danakap.com

This Policy is effective as of 19 March 2025.

No entries found...