Personal information protection

Dear customers,

Dear business partners,

The below document contains general information regarding the way we process your personal information.

In respect to a new European Union legislation, the text contained in this document has been prepared in agreement with the European Parliament and (EU) Commission Directive No. 2016/679. The directive deals with physical person protection regarding personal data processing, taking into account free sharing of this information and cancellation of the Directive No. 95/46/ES (GDPR – General Data Protection Regulation), dated April 27, 2016.

To achieve as much as possible clarity, the text is prepared in a form of the questions and answers.

You will learn the information in the following sequence:

1. Who is your personal data administrator?
2. For what purpose do we need your personal data?
3. What are our authorized interests?
4. How was the personal data obtained?
5. What personal data categories are processed?
6. What is the legislation base for the personal data processing?
7. Shall we hand the personal information over to another subject?
8. Shall we hand the personal information over to third countries or international organizations?
9. For how long shall we store the personal data?
10. What are your rights regarding personal data processing, and how can you apply them?
11. Is your personal information evaluated automatically?

We are hereby presenting you the general information that we are obliged to provide as personal data administrator.

In case of any questions regarding your personal data treatment, please do not hesitate to contact us.

1. Who is your personal data administrator?

The administrator is a person who (independently or in cooperation with others) defines the purposes and makes decisions how your personal data are to be treated. Your personal data administrator is the following company:

MAGSY, s.r.o., Holešovská 457, 763 16 Fryšták, Czech Republic.

You may contact the administrator using their e-mail address: magsy@magsy.cz

2. For what purpose do we need your personal data?

The administrator processes personal data as follows:

• Provision of closing and subsequent filling of the contractual obligation between the administrator and you (art. 6, section 1, letter b) of the GDPR). From this relation, further lawful obligations arise; by that reason, the administrator must also process your personal information for this purpose (art. 6, section 1, letter c) of the GDPR);
• Protection of his authorized interests (art. 6, section 1, letter f) of the GDPR) understood as, above all, marketing purposes. To provide that the administrator adapts the business information and offer of his products to your needs at best, he will need to get your unambiguous consent (art. 6, section 1, letter a) of the GDPR) for this processing purpose.

In general, personal data providing to the administrator is a lawful and contractual requirement. As for personal data provision for marketing purposes which does not represent filling of the administrator contractual and lawful obligations, your approval is needed. In case your approval regarding your personal data processing for marketing purposes is not given to the administrator, it does not mean that, as result of this, the administrator refuses to provide you their product or service based on a contract.

3. What are our authorized interests?

Your personal data is processed by the administrator to protect their authorized interests too. Above all, administrator authorized interests include proper filling of all administrator contractual obligations, proper filling of all administrator lawful obligations, marketing, administrator business and property protection, and, last but not least, also environmental protection and sustainable development providing.

4. How was the personal data obtained?

Administrator obtained your personal data directly from you, namely from the filled-in forms, communication or contracts made. In addition to that, your personal data may also come from publicly available resources, registers, records such as trade register, debtor registers, profession registers, etc. Furthermore, there is a possibility that the administrator received the data from third parties who they cooperate with, authorized to access and process your personal information. Also, the information could be obtained from the internet where you might have published the data by yourself.

5. What personal data categories are processed?

To guarantee your satisfaction based on a proper filling of your commitments, to provide meeting lawful obligations, to ensure personalized goods offer and administrator services, as well as for all of the purposes mentioned above, the administrator processes the following personal data categories:

• General identification data – name, surname, postal (delivery) address;
• Contact information – phone number and e-mail address;
• Webpage from which a customer visited MAGSY webpages;
• IP-address
• Access date and time;
• Possible visitor question;
• Webpage visitor computer – browser and operation system information.

6. What is the legislation base for the personal data processing?

Processing legitimacy is given by the article 6, section 1 of the GDPR. According to the stipulation, the processing is legal in case it is indispensable to fill the contract, meet administrator legislation obligations, protect administrator´s authorized interests, or when the data is treated based on an approval that you have given to us.

7. Shall we hand the personal information over to another subject?

Your personal information may be known to our employees and to the following cooperating companies:

• External accounting office;
• Carrier in question;
• IT systems administrators.

We have made respective contracts with all of these cooperators and companies. The contracts bind them treat your personal data obtained in a way given by the GDPR regulation.

Therefore, in terms of our legislation duties, we must provide your personal information to governmental organizations such as tax administrators, courts, prosecution organs or capital market supervisory bodies.

8. Shall we hand the personal information over to third countries or international organizations?

We will not hand your personal data over to countries out of the European Union and/or European market.

9. For how long shall we store the personal data?

We will be saving your personal data only for a period needed to process them. After the period expires, we will make them anonymous, or they will be removed in a safe and irreversible way, on order to prevent their misuse.

10. What are your rights regarding personal data processing, and how can you apply them?

The administrator strives to process your data properly and, above all, safely. We guarantee you the rights described in this article. You may apply that at the administrator.

You may apply your rights in a written application form that you send either to the e-mail address or to the postal address, as stipulated in the section 1.

All communication and comments dealing with rights that you apply are provided by the administrator for free. However, in case your requirement is not reasonable or adequate obviously, especially if repeated, the administrator reserves a right to charge a fee taking into account administration costs related to the information provided. In case of repeated requirements for providing copies of the personal data processed, the administrator reserves the right to charge an adequate fee for administration costs incurred by that reason.

The administrator will give comments and possible information regarding measures taken in the soonest possible term, at latest within one month. If needed, in case of a complexity and high number of requirements, the administrator is entitled to extend the period by two months. Regarding the extension and its reasoning, you will be informed by the administrator.

10.1 Right to be informed about your personal data processing

You are entitled to the information by the administrator whether your personal data is processed or not. In case it is, you have a right to require the information from the administrator, especially regarding the administrator identity and contact data, deputy and, possibly, representative for the personal data protection. Also information about the processing purposes, personal data categories, recipients, personal data recipient categories, authorized administrators, lists of your rights, possibilities to contact the Office for Personal Data Protection, processed personal data resources, automated decision making and profiling, must be given.

In case the administrator is willing to process your personal information further, for other purpose than that it was received for, he will give you, still before further processing in question, the information about this purpose, as well as another relevant information.

The information given to you in terms of this right application is already contained in this text. However, this does not prevent you asking for it ones more.

10.2 Right to an access to your personal data

You are entitled to the information by the administrator whether your personal data is processed or not. In case the data is processed, you have an access to the following information: processing purposes, personal data given categories, recipients and/or recipient categories, time for which the personal data will be stored, information about your rights (i.e. the rights to require error correction / delete actions, processing limitations, making objections against this processing), a right to file a complaint with the Office for Personal Data Protection, personal data source information, the information whether automated decision making and profiling is done, and the information dealing with the procedure being used. Also the information dealing with the sense and consequences expected of such processing to you, information and warranty in case the data is handed over to third persons or international organizations, fall within this category. You have a right to get copies of your personal data processed. However, other person rights may not be affected by your right to get appropriate copies.

10.3 Right to correct errors

In case you e.g. changed your residential address, phone number or any other fact considered as a personal information, you have a right to ask the administrator to change the personal data they process. In addition to that, you have a right to complement incomplete your personal data, even in a form of a supplementary declaration.

10.4 Right to delete (right to be forgotten)

In some defined situations, you have a right to require your personal information delete at the administrator. This happens e.g. in situations when the information processed is no more needed for the purposes stipulated above. After the time needed has elapsed, the administrator deletes your personal data automatically. However, you can contact the administrator regarding your requirement at any time. After that, your requirement will subject to an individual assessment process. In spite of your right to delete the data, the administrator may be obliged or may have an authorized interest to keep your personal information. We will inform you about your requirement processing in a detail.

10.5 Right to processing limitations

The administrator treats your personal information to the minimum needed extent only. However, in case you feel that the administrator e.g. exceeds the purposes stipulated above, you may file a requirement stating you wish to have your personal data processing to the minimum legislation purposes only. You may also ask to block your personal data. Then your request is subject to an individual assessment and you will be informed about its processing in a detail.

10.6 Data transferability right

In case you want the administrator give your personal data to another administrator or to another company, the administrator will hand your data over to a subject defined by you, in an appropriate format. This applies to situations when the administrator acts are not limited by valid legislation or any other important obstacles.

10.7. Right to make an objection and right for an automated individual decision making

If you believe or if you found out that the administrator performs your personal data processing activity in disagreement with your private and personal life protection principles, or if you believe that the administrator acts in disagreement with valid legislation (on provide that your personal information is processed by the administrator based on public or authorized interests, or it is processed for direct marketing purposes including profiling, or for statistics purposes or purposes of scientific or historical research), you may contact the administrator and ask them for explanation and/or fixing the defective situation occurred.

Furthermore, the objection can be made also directly, against the automated profiling and decision- making process.

10.8 Right to file a complaint with the Office for Personal Data Protection

You can contact appropriate supervisory body with your initiative or complaint regarding your personal data processing at any time.

10.9 Right to withdraw a consent

An approval given regarding your personal data processing may be withdrawn at any time. This may be done in a written form to be sent either to the e-mail address or to a correspondence address stated in the section 1.

11. Is your personal information evaluated automatically?

Your personal information is not evaluated automatically. It is not used in profiling or automatic decision making in terms of the administrator marketing activities.