GDPR

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, pursuant to Articles 13 and 14 of the Regulation (hereinafter referred to as the “GDPR”), and Act No. 110/2019 Coll., on the Processing of Personal Data (hereinafter referred to as the “Personal Data Processing Act”).

Who processes your personal data?

AVENA s.r.o.
Divnice 115, 763 21 Slavičín
Company ID: 255 45 957
Contact email: rostislavhrbacek@seznam.cz
Telephone: +420 603 506 232

Hereinafter referred to as “we”, the “controller” or the “organisation”.

What is personal data?

Personal data means any information relating to an identified or identifiable living natural person. Personal data may include general personal data, such as name and surname, age, telephone number, place of birth or marital status, as well as special categories of personal data, such as biometric data, trade union membership, ethnic origin, philosophical beliefs, genetic data, information on criminal convictions and offences, religious beliefs, political opinions, racial origin, sex life or sexual orientation, and health data.

What is the processing of personal data?

The processing of personal data means any operation or set of operations performed on personal data for a specific purpose. Such operations include, in particular, collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Sources and categories of personal data

The controller processes personal data that you provide directly to us, or personal data obtained in connection with the fulfilment of your order.

We process your identification and contact details and data necessary for the performance of the contract.

Legal basis and purpose of processing

Legal basis for processing

The legal basis for processing your personal data is:

your consent to the processing of personal data for the purposes of direct marketing pursuant to Article 6(1)(a) GDPR;
the performance of a contract or taking steps prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
compliance with a legal obligation pursuant to Article 6(1)(c) GDPR, in particular archiving obligations under applicable law.

Purpose of processing

The purpose of processing personal data is to process your order and to exercise the rights and obligations arising from the contractual relationship between you and the controller. When placing an order, you are required to provide personal data necessary for the successful processing of the order pursuant to Article 6(1)(b) GDPR. This also includes payment processing, provision of services, handling of complaints and related communication.

We use the personal data you provide to enter into a contract with you and, where a contract has already been concluded, to fulfil that contract. The provision of personal data is a necessary requirement for entering into and performing the contract. Without providing the necessary personal data, it is not possible to enter into the contract or for the controller to fulfil its terms.

Once the contract has been fulfilled, we are required to retain selected personal data for the period stipulated by applicable legal regulations, in particular accounting, tax and archiving regulations.

What personal data do we process?

In order to provide our services, we may process the following personal data:

name and surname;
permanent residence address;
delivery address for services or goods;
telephone number;
email address.

How long do we retain your personal data?

We retain your personal data for the duration of our contractual relationship. After the contractual relationship ends, we retain your personal data for as long as necessary to comply with mandatory archiving obligations under applicable legal regulations, including, for example, the Accounting Act, the Value Added Tax Act and the Archives and Records Management Act.

To whom do we disclose your personal data?

Your personal data may be disclosed to the following categories of recipients:

providers of legal services;
providers of tax and accounting services;
providers of technical solutions;
public authorities and courts, where required by law.

Your personal data may also be disclosed to public authorities and courts where required by specific legislation or where you have given your explicit consent.

Where your personal data is disclosed to processors, this is always done on the basis of a data processing agreement and in accordance with the level of personal data protection required by the GDPR.

The controller does not transfer, publish or make personal data available to third countries.

Personal data security

The controller declares that it has adopted appropriate personnel, technical and organisational measures to protect personal data.

The controller has implemented technical measures to secure data storage systems and personal data stored in paper form.

The controller declares that access to personal data is granted only to authorised persons.

No automated decision-making or profiling takes place as part of our personal data processing activities.

Your rights in connection with personal data processing

Under the conditions set out in the GDPR, you have the following rights:

the right of access to your personal data pursuant to Article 15 GDPR;
the right to rectification of personal data pursuant to Article 16 GDPR;
the right to restriction of processing pursuant to Article 18 GDPR;
the right to erasure pursuant to Article 17 GDPR;
the right to object pursuant to Article 21 GDPR;
the right to data portability pursuant to Article 20 GDPR;
the right to withdraw consent, electronically or by post to the correspondence address;
the right to lodge a complaint with the supervisory authority if you believe that your personal data protection rights have been violated.

How can you exercise your rights?

Right of access

Upon your request, we must inform you whether or not we process your personal data. If we process your personal data, you have the right to be informed of:

the purpose for which we process your personal data;
the scope of the personal data processed;
how long the personal data will be retained;
to whom the personal data will be disclosed;
whether you may lodge a complaint with the Office for Personal Data Protection.

You may submit your request electronically to rostislavhrbacek@seznam.cz or by post to: Divnice 115, 763 21 Slavičín.

Right to rectification

If you believe that we process inaccurate personal data about you, you have the right to have such data corrected. If you identify any inaccuracy in your personal data, please notify us and we will make the correction without undue delay.

You may submit your request electronically to rostislavhrbacek@seznam.cz or by post to: Divnice 115, 763 21 Slavičín.

Right to erasure

Under certain circumstances, you have the right to request that we erase your personal data. You may request the erasure of your personal data at any time. We will erase your personal data if:

we no longer need your personal data for the purpose for which you provided it to us;
you withdraw your consent;
you object to the processing of your personal data;
we process your personal data unlawfully;
the personal data must be erased to comply with a legal obligation;
you are a child, or the parent of a child, who consented to the processing of personal data online.

Right to restriction of processing

You may request that we restrict the processing of your personal data. If we grant your request, we will only store your personal data and will not otherwise process it. Restriction of processing will occur if:

your personal data is inaccurate, until we verify its accuracy;
we process your personal data unlawfully, but you do not wish it to be erased and instead request restriction of processing;
we no longer need your personal data, but you need it to establish, exercise or defend legal claims;
you object to the processing of your personal data, pending verification of whether our legitimate grounds override your interests.

Right to data portability

You have the right to request that we provide your personal data in an electronic format, such as XML or CSV, which allows you to transfer the data to another company. You may also request that we transfer your personal data directly to a company of your choice. We will comply with your request where the conditions set out in the GDPR are met, in particular where the processing is based on your consent or on a contract and is carried out by automated means.

Right to object

You have the right to object to the processing of your personal data where we process it on the basis of our legitimate interest, including any related profiling. You may object to such processing on grounds relating to your particular situation.

Contact for exercising your rights

You may contact us in any of the following ways:

Email: rostislavhrbacek@seznam.cz
Postal address: Divnice 115, 763 21 Slavičín

Supervisory authority

If you believe that your personal data protection rights have been violated, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection
Pplk. Sochora 27
170 00 Praha 7
Company ID: 70837627

Switchboard: +420 234 665 111 (does not provide consultations)
Information line: +420 234 665 800 (available every Tuesday and Thursday from 13:00 to 15:30)

Website: https://www.uoou.cz
Email: posta@uoou.cz
Data box ID: qkbaa2n