PRIVACY POLICY
PERSONAL DATA PROCESSING RULES
ORGREZ Group, a.s. as the administrator of personal data (hereinafter referred to as "ORGREZ Group)" processes personal data in accordance with Act No. 110/2019 Coll., on the processing of personal data, as amended, and Regulation (EU) 2016/679 of the European Parliament andof the Council of April 27, 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as "GDPR").
1. BASIC INFORMATION ABOUT THE PROCESSING OF PERSONALDATA
1.1. Identification and contact details of the personal data administrator:
ORGREZ Group, a.s. ID number: 24682063 with registered office at Hudcova 660/76d, Medlánky, 612 00 Brno, registered in the commercial register kept at the Regional Court in Brno in section B, entry no. 6271,contact e-mail: gdpr@orgrez.cz, phone: + 420 702 158 987.
1.2. Personal data protection officer:
The company ORGREZ Group did not appoint a personal data protection officer, as it is not a mandatory person according to Article 37 of the GDPR.
1.3. Purpose and legal basis for processing:
In order to fulfill the contract or fulfill legal obligations, ORGREZ Group processes in particular: name, surname, first name, identification number, residence/place of business, telephone, e-mail. In the event that the ORGREZ Group intends to process personal data other than those specified in this article, or for other purposes, it may do so on the basis of a validly granted consent to the processing of personal data. Consent to the processing of personal data is granted by the data subject on a separate document.
1.4. Transfer of personal data to a third country or international organization:
ORGREZ Group does not transfer personal data to third countries or international organizations within the meaning of Article 44 et seq. GDPR.
2. RECEIPT OF PERSONAL DATA
2.1. Other personal data administrators:
ORGREZ Group does not transfer personal data to any other administrators. ORGREZ Group transfers personal data processed for the fulfillment of obligations arising from special legal regulations to state administration bodies or other relevant authorities only in cases where the law imposes it.
2.2. Processors of personal data:
The processing of personal data can be carried out by processors for the ORGREZ Group exclusively on the basis of a contract on the processing of personal data, i.e. with guarantees of organizational and technical security of these data with a definition of the purpose of processing, whereby the processors may not use the data for other purposes.
3. FURTHER INFORMATION ABOUT THE PROCESSING OFPERSONAL DATA
3.1. Data processing time:
Personal data of data subjects is processed by ORGREZ Group for the duration of the contractual relationship and subsequently for a maximum of 10 years from the termination of the contractual relationship. ORGREZ Group processes personal data processed for the fulfillment of obligations arising from special legal regulations for the period specified by these legal regulations. If it is necessary to use personal data to protect the legitimate interests of the company, ORGREZ Group processes this data for the time necessary to exercise these rights.
3.2. Sources of personal data:
ORGREZ Group obtains personal data directly from data subjects in the context of contract negotiations. ORGREZ Group always informs the data subjects which of the personal data they must provide for the purposes of fulfilling the contract.
3.3. Automated individual decision-making:
ORGREZ Group does not perform automated individual decision-making or profiling within the meaning of Article 22 GDPR when processing personal data.
3.4. Information on the nature of data provision:
If personal data is processed for the purpose of fulfilling legal obligations, the provision of data is a legal requirement. If personal data is processed based on the consent of the data subject, the provision of data is a contractual requirement.
4. RIGHTS OF DATA SUBJECTS
4.1 Right of access to personal data
The datasubject has the right to obtain confirmation from the ORGREZ Group as to whether or not personal data concerning him or her are being processed and, if so, the right to access such personal data and the following information:
a) purpose of processing;
b) category of personal data concerned;
c) recipients to whom personal data have been or will be made available;
d) the planned period for which personal data will be stored;
e) the existence of the right to request from ORGREZ Group the correction or erasure of personal data or the limitation of their processing, or to raise an objection against this processing;
f) the right to file a complaint with the supervisory authority;
g) all available information about the source of personal data, unless obtained from the data subject;
h) the fact that automated decision-making takes place, including profiling. At the same time, the data subject has the right to obtain a copy of the processed personal data.
4.2 Right to rectification of personal data
The datasubject has the right to have ORGREZ Group correct inaccurate personal dataconcerning him without undue delay, or completed incomplete personal data.
4.3 Right to erasure of personal data
The datasubject has the right to have ORGREZ Group delete personal data concerning him without undue delay, in the event that:
a) personal data are no longer needed for the purposes for which they were collected or otherwise processed;
b) the datasubject revokes the consent on the basis of which the data were processed and there is no other legal reason for the processing;
c) the datasubject objects to the processing and there are no overriding legitimate reasons for the processing;
d) personal data were processed unlawfully;
e) personal data must be deleted to fulfill a legal obligation set out in the law of the EU or the Czech Republic;
f) personal data were collected in connection with the offer of information society services. The right to erasure does not apply if the processing is necessary for the fulfillment of legal obligations, for the determination, exercise or defense of legal claims and in other cases stipulated in the GDPR.
4.4 Right to restriction of processing
The datasubject has the right to have ORGREZ Group restrict the processing in any of the following cases:
a) the datasubject denies the accuracy of the personal data, for the time required for ORGREZ Group to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject refuses the erasure of the personal data and instead requests the restriction of their use;
c) ORGREZ Group no longer needs personal data for processing purposes, but the datasubject requires them for the determination, exercise or defense of legal claims;
d) the datasubject has objected to the processing until it is verified whether the legitimate reasons of ORGREZ Group prevail over the legitimate reasons of the data subject.
4.5 The right to object to processing
The datasubject has the right to object at any time to the processing of personal data concerning him and which ORGREZ Group processes due to his legitimate interest,for reasons related to his specific situation. ORGREZ Group does not further process personal data in such a case, unless it proves serious legitimate reasons for processing that outweigh the interests or rights and freedoms ofthe data subject, or for the determination, exercise or defense of legal claims.
4.6 Right to Data Portability
The datasubject has the right to receive the personal data concerning him/her provided by ORGREZ Group in a structured, commonly used and machine-readable format, and the right to transfer this data to another administrator without ORGREZ Group preventing this, in the event that:
a) processingis based on consent;
b) processing is performed automatically. When exercising his right to data portability, the data subject has the right to have personal data transferred directly from one administrator to another administrator, if technically feasible.
4.7 The right to file a complaint with the supervisory authority
If the datasubject believes that ORGREZ Group is not processing his personal data in a lawful manner, he has the right to file a complaint with the Office for Personal Data Protection.
4.8 Right to information regarding correction ordeletion of personal data or restriction of processing:
ORGREZ Group is obliged to notify the individual recipients to whom personal data has been made available of any correction or deletion of personal data or restriction of processing, except where this proves impossible or requires unreasonable efforts. If the data subject so requests, ORGREZ Group informs the data subject of these recipients.
4.9 The right to be informed in the event of a breachof personal data security:
If it is likely that a certain case of breach of personal data security will result in ahigh risk for the rights and freedoms of natural persons, ORGREZ Group will notify the data subject of this breach without undue delay.
4.10 The right to withdraw consent to the processing of personal data:
In the event that ORGREZ Group processes any of the personal data on the basis of consent,the data subject has the right to withdraw his consent to the processing of personal data at any time in writing, by sending his objection to the processing of personal data to the e-mail address gdpr@orgrez.cz.
5. COOKIES
ORGREZ Group uses cookies, small text files that identify users of the website www.orgrezgroup.cz and record their user activities. The text in the cookiefile is often made up of a series of numbers and letters that clearly identify the user's computer, but do not provide any specific personal information about the user. This information is recorded in the activity file by the server, which enables the subsequent processing of the data.
