Personal Data Protection Policy (GDPR)
Dear clients, we would like to inform you about the way we handle the personal information that we process as part of our activities. We hereby declare that we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “GDPR”.
WHO PROCESSES YOUR PERSONAL DATA?
Pursuant to Article 4(7) of the GDPR, the controller is a natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. BRETH TRANS s.r.o., with its registered office at Jeremiášova 947/16, Praha 5 – Stodůlky, 155 00, Czech Republic. Hereinafter referred to as the “Controller”.
WHAT DATA DO WE PROCESS?
The Controller processes personal data on the basis of the legal grounds set out below:
Provision of services and cooperation with the Controller’s clients:
- Name and surname
- Address
- Email address
- Phone number
- Company ID (IČO)
- Project information
In relation to employees:
- Name and surname
- Address
- Email address
- Phone number
For marketing purposes:
- Name and surname
- Address
- Email address
- Phone number
HOW DO WE OBTAIN PERSONAL DATA?
We obtain personal data based on inquiries from clients and the establishment of cooperation. We do not actively seek out personal data. In order to comply with the GDPR, the collection of personal data is carried out on the basis of one of the following legal grounds:
- The processing of personal data is necessary for the performance of a contract concluded between the Controller and the client. This applies to all employees of BRETH TRANS s.r.o. and all subcontractors.
- The processing is necessary to comply with the Controller’s legal obligations. This applies in particular to BRETH TRANS s.r.o. employees and the legal obligations BRETH TRANS s.r.o. has towards them. These purposes include, but are not limited to, payroll administration and internal communication activities.
- The processing is always carried out only when necessary, in a legitimate manner established by the legal basis of the state.
- The processing is based on the explicit consent of the client or data subject. Direct consent is required only in cases that do not fall under the legal grounds mentioned above.
RECIPIENTS OF PERSONAL DATA
The recipients of personal data are the Controller’s employees and its subcontractors. These entities have access to a secure server containing client data. Subcontractors are contractually bound by confidentiality. The server is protected by encryption and the access address is hidden. It is known only to the Controller and the subcontractors. The access itself is password-protected. All data is regularly backed up. All physical materials and other storage devices containing personal data are kept in a locked room. No personal data is transferred to third parties or other organizations.
RIGHTS OF DATA SUBJECTS
In accordance with Chapter III of the GDPR, data subjects have the following rights:
- to withdraw consent at any time in cases where personal data is processed on the basis of consent,
- to receive information about the processing of your personal data pursuant to Articles 13 and 14 of the GDPR,
- to access the processed personal data, to rectify and supplement such data,
- to have such data erased pursuant to Article 17 of the GDPR or to restrict its processing,
- to transfer your personal data to another controller,
- to object to the processing of personal data, including profiling and automated decision-making,
- to lodge a complaint with the supervisory authority in case of a conflict with the above or with the principles of personal data processing.
If you wish to exercise any of the above rights, please contact the Controller in writing at Jeremiášova 947/16, Praha 5 – Stodůlky, 155 00, Czech Republic, or by email at info@brethtrans.cz.