The Personal Data Processing Policy for the Customers of DoorHan s.r.o. according to GDPR
The aim of this Policy is processing of personal data for the customers of DoorHan s.r.o., in compliance with the GDPR released by DoorHan s.r.o., ID 273 52 820, Tax ID CZ27352820, with the registered office at based Kralovsky vrch 2018, 432 01 Kadan, is to provide information about what personal data DoorHan s.r.o. (as the administrator) processes on natural persons in the provision of services and contacts with potential customers, for what purposes and for how long DoorHan s.r.o. processes such personal information in accordance with the applicable regulations, to whom and for what reason it may pass it, and also to inform what rights natural persons are entitled to in relation to the processing of their personal data.
This Policy relates to the processing of personal data of customers of DoorHan s.r.o. and reasonably also to their representatives or contact persons and applicants for the goods of DoorHan s.r.o. The Policy is effective from 25. 5. 2018 and is released in accordance with the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the "Regulation” or "GDPR” hereinafter) in order to secure the information obligation of DoorHan s.r.o. as the administrator pursuant to Art. 13 GDPR.
A. Categories of Personal Data
Personal data is any information that relates to a natural person, that DoorHan s.r.o. is able to identify. In connection with the provision of services and sale of goods DoorHan s.r.o. may process the following categories of personal data.
1. Basic personal identification data and address information
That data is necessary for the conclusion and performance of a contract. It includes specifically:
- academic title
- first name and surname
- business name
- personal identification number (in case that none was assigned, the date of birth)
- ID No., Tax ID No.
- permanent address
- registered address or place of business
- billing address
- numbers of presented identification documents and their copies (all data that is not needed to provide the service, are blacked out in the copies of documents)
- identification data of the customer representative or of the contact person who will be named by customer
- identification data of billing payer
- bank details
- signature
In the case of contracts for single sale of disposable products, the scope is limited to the general identification data.
- Contact details
- contact telephone number
- contact e-mail
- social network addresses
- Data about the purchased goods, purchased services, use of services and payment habits
- type and specification of the provided service or goods
- the volume of provided services and their price
- information about the payment habits
4. Data of communication between DoorHan s.r.o. and the customer
This data is generated in the communication relating to the provision of services and goods of DoorHan s.r.o. between DoorHan s.r.o. and the customer. It includes the records of personal communication with the customer or other direct contact with the customer, written and electronic communication with the customer
5. CCTV recordings from the premises of DoorHan s.r.o.
DoorHan s.r.o. installs cameras in the premises of DoorHan s.r.o. in order to protect the legitimate interests of DoorHan s.r.o.
B. Purposes, legal grounds and personal data processing times
The scope of the processed data depends on the purpose of processing. DoorHan s.r.o. processes data directly under a contract, legitimate interest or under the law (without the consent).
1. Processing due to the performance of a contract, the fulfilment of legal obligations and for the legitimate interests of DoorHan s.r.o.
The provision of personal data necessary for the performance of a contract, the fulfilment of legal obligations of DoorHan s.r.o. and the protection of the legitimate interests of DoorHan s.r.o. is obligatory. Without the provision of personal data for the above purposes it would not be possible to provide the services. We do not need permission for the processing of personal data for such purposes. Processing due to the performance of a contract and the fulfilment of legal obligations cannot be refused.
Those include in particular the following sub-purposes:
- providing of electronic communication services, payment transactions, provision of other services (contract fulfilment)
- billing for services (contract fulfilment)
- fulfilment of legal tax obligations (fulfilment of legal obligations)
- purposes established by special laws for the purpose of criminal proceedings and for the fulfilment of the obligations of cooperation with the Police of the Czech Republic and other state authorities (fulfilling of the statutory obligations)
- operation of CCTV and monitoring systems in the premises of DoorHan s.r.o. for damage prevention (legitimate interest of DoorHan s.r.o.)
- to evaluate customer behaviour in the use of services and their payment discipline for the prevention of receivables that may affect the company's decisions on the conditions of entering into other contracts with the customer with the decision on entering or non-entering into other contracts not being made automatically (legitimate interest of DoorHan s.r.o.)
- Recovery of customer’s claims and other customer disputes (legitimate interest)
- processes associated with the identification of the customer (contract fulfilment)
- providing evidence for cases of urgent need for the advocacy of DoorHan s.r.o.’s rights (legitimate interest of DoorHan s.r.o.)
- registry of debtors (legitimate interest of DoorHan s.r.o.)
Personal data for these activities are processed to the extent necessary for the fulfilment of these activities and for the time required for their achievement or for the time directly stipulated by law. After that, personal data is deleted or made anonymous. The general deadlines for processing of personal data are provided below.
As concerns the customers of DoorHan s..r.o. Services, the company is entitled, if they have fulfilled all their obligations to it, to process in the DoorHan s.r.o.’s customer database their general personal, identification, contact information, information on services and data from their communication with DoorHan s.r.o. for a period of 4 years from the date of the termination of the last contract with DoorHan s.r.o.
If goods are purchased from DoorHan s.r.o., DoorHan s.r.o. is entitled to process the general personal, identification and customer contact information, data on goods and data from the communication between the customer and DoorHan s.r.o. for a period of 4 years following the date of the expiration of the warranty on the goods.
If negotiations took place between DoorHan s.r.o. and a potential customer on entering into a contract that have not resulted in the conclusion of one, DoorHan s.r.o. is entitled to process the personal information provided for a period of 3 months from the relevant negotiation.
Invoices issued by DoorHan s.r.o. are, in accordance with § 35 of Act No. 235/2004 Coll., On Value Added Tax, archived for a period of 10 years from their release. Because of the need to prove the legal basis for issuing of the invoices for a period of 10 years from the date of contract termination, even customer contracts are archived.
The identification data necessary for the provision of services from the customer's identity card are processed by DoorHan s.r.o. in accordance with § 16 of Act No. 253/2008 Coll., on selected measures against legitimisation of proceeds of crime and financing of terrorism, for a period of 10 years from the date of the termination of your contract with DoorHan s.r.o. To fulfil the above legal obligation, DoorHan s.r.o. retains a period of 10 years from the date of the completion of the last service of the customer, copies of identity cards with the information required to provide the service, while other data which is not necessary for the provision of the service, is blackened on the copy of the card.
CCTV footages from the premises of DoorHan s.r.o. and the buildings near DoorHan s.r.o. are processed for a maximum period of 90 days from the date of obtaining such CCTV recording.
2. Processing of cookies from websites operated by DoorHan s.r.o.
In the event that the data subject has cookies enabled in its browser, we process the data subject’s behaviour records from the cookies placed on the website operated by DoorHan s.r.o. in order to ensure better traffic of the DoorHan s.r.o.’s websites and for the purpose of the internet advertising of DoorHan s.r.o.
C. Personal data recipients category
In fulfilling of its commitments and obligations under the contracts, DoorHan s.r.o. uses professional and specialised services of other subjects. If those suppliers process personal data provided by DoorHan s.r.o., they have the status of personal data processors and process personal data only within the instructions issued by DoorHan s.r.o. and may not used that otherwise. This particularly involves the recovery of outstanding debts, activities of experts, lawyers, auditors, IT systems management, online advertising or sales representation.
Within the fulfilment of its legal obligations, DoorHan s.r.o. forwards personal data to administration bodies and authorities set out in the applicable legislation.
D. Personal data processing method
DoorHan s.r.o. processes personal data both manually and automatically. DoorHan s.r.o. keeps records of all activities, both manual and automated, in which personal data is processed.
E. Business communication
DoorHan s.r.o. uses appropriate designation for business communication from which it is clear that the said communication is business communication within the meaning of the applicable legislation. As concerns the commercial communications sent by DoorHan s.r.o. it is always clear that the company is the sender of those. Commercial communications can be sent either to the contact information of our customers on the basis of a legitimate interest of DoorHan s.r.o. Until you express your disagreement.
F. Information concerning the rights of data subjects in relation to the processing of personal data valid from 25 5. 2018
Accordingly with the Regulation effective from 25.5. 2018, if data subject is an identifiable natural person for DoorHan s.r.o. and demonstrates its identity to DoorHan s.r.o., it will have the consequential rights.
1. Right of access to personal data
According to Art. 15 GDPR, data subject will have the right to access personal data, which includes the right to obtain from DoorHan s.r.o.:
- a confirmation on whether it processes personal data,
- information about the purposes of the processing, the categories of the personal data concerned, the recipients to whom personal data have been or will be made available, the planned time of processing, the existence of the right to request rectification or erasure of personal data concerning the data subject from the administrator, or limiting of their processing, or to raise objection against that processing, the right to lodge a complaint with a supervisory authority, of any available information about the source of personal data, unless obtained from the data subject, the fact that there is an automated decision-making taking place, including the profiling, of the appropriate safeguards for the transfer of data outside the EU,
- as long as the rights and freedoms of other persons are not adversely affected, also a copy of the personal data.
In the case of repeated request, DoorHan s.r.o. is entitled to charge a reasonable fee for a copy of the personal data.
The right to confirmation of the processing of personal data and to the information can be exercised in writing to the address of the DoorHan s.r.o.’s registered office.
2. Right to the correction of incorrect personal data
Pursuant to Art. 16 GDPR, data subject shall have the right to have corrected the inaccurate personal information of it that DoorHan s.r.o. is going to process. Customer of DoorHan s.r.o. has also a duty to report any changes to its personal data and to demonstrate that such a change occurred. It is also obliged to provide us with assistance upon finding out that the personal data we process is not accurate. We will correct it without an undue delay, but always with regard to the given technical possibilities. Request for the correction of personal data can be applied at the registered office of DoorHan s.r.o. subject to the justification of the request.
3. Right of erasure
According to Art. 17 GDPR, data subject shall have the right to erasure of personal data concerning it. If DoorHan s.r.o. fails to establish legitimate grounds for the processing of that personal data. If the data subject believes that no erasure of its personal data took place, it can contact us in writing at the address of the DoorHan s.r.o.’s registered office.
4. Right to limit the processing
Pursuant to Art. 18 GDPR, data subject shall have until the time to resolving a complaint the right to limit processing if it denies the accuracy of the personal data, the reasons for its processing, or raises a written objection against its processing to the address of the DoorHan s.r.o.‘s registered office.
5. Right to notification of correction, erasure or limiting of processing
According to Art. 19 GDPR, data subject shall have the right to be notified by DoorHan s.r.o. in case of rectification, erasure or limiting of personal data processing. If personal data is corrected or deleted, we will inform each recipient, except where this proves impossible or involves unreasonable effort. Upon the request of the data subject, we may provide information on those recipients.
6. Right to personal data portability
Pursuant to Art. 20 GDPR, data subject will have the the right to the portability of data relating to it that is provided to the administrator in a structured, conventional and machine-readable format, and the right to ask DoorHan s.r.o. to forward such data to another administrator.
If data subject provides us with personal data in relation to a service agreement or upon the consent and the processing of it is done automatically, the data subject has the right to obtain that data from us in a structured, conventional and machine-readable format. If technically feasible, the data can also be passed to an administrator named by you, if the person acting on behalf of a competent administrator is properly identified and can be authorised.
In the event that the exercise of this right might adversely affect the rights and freedoms of third parties, your request cannot be satisfied. The request can be applied at the registered office of DoorHan s.r.o. upon the justification of the request.
7. Right to object to the processing of personal data
Pursuant to Art. 21 GDPR, data subject will have the right to raise an objection against the processing of its personal data due to the legitimate interest of DoorHan s.r.o..
In the event that DoorHan s.r.o. fails to prove that there is a serious legitimate ground for processing, which outweighs the interests or the rights and freedoms of the data subject, DoorHan s.r.o. shall terminate the processing without undue delay based on that objection. Objection can be sent in writing to the address of the DoorHan s.r.o.’s registered office.
8. Right to contact the Office for Personal Data Protection
The data subject has the right to contact the Office for Personal Data Protection (www.uoou.cz).
Mikhail A Kiselev
DoorHan s.r.o., Managing Director.
Czech Republic