Processing of personal data (CZ)

How Google uses cookies

MADETA a.s., registered office Rudolfovská tř. 246/83, České Budějovice 4, 370 01 České Budějovice, postcode: 370 50, ID number: 632 75 635, the company is registered in the Commercial Register maintained by the Regional Court in České Budějovice under file number B 698 as a personal data controller, provides information in this Personal Data Processing Policy (hereinafter referred to as the "policy") provides information on the personal data of the data subjects it processes, based on the title it processes them under, how long it retains them, to whom they may transfer them and what rights the data subjects have in connection with the processing of personal data.

The extent of the processing of personal data depends on the position of the data subjects to Madeta as a personal data controller.

1. Groups of personal data

Personal data is any information relating to a natural person, provided that the person can be directly or indirectly identified from such information.

Madeta may come into contact with the following data when processing personal data:

• Basic personal identification and contact details necessary for the performance of the contract and contractual obligations. This category includes the following data:

• name and surname,
• address of permanent residence,
• telephone number,
• e-mail,
• bank account,
• ID number, VAT number if the data subject is an entrepreneur,
• Call centre communication records.
• Data necessary to identify and meet customer needs:
• cookies,
• IP address,
• Call centre communication records,
• order information,
• Basic personal identification and contact details necessary for participation in loyalty or similar programmes.
• CCTV footage of CCTV protected premises to protect Madeta's legitimate interests, which are the protection of Madeta's property and the health of persons on CCTV protected areas. The premises in which CCTV systems are located are duly marked with appropriate notices.

Madeta processes the above personal data only for specified purposes, only based on the relevant legal titles for processing, to the extent and for the time necessary to fulfil the purpose of processing.

2. Legal title for the processing of personal data

Madeta processes personal data of subjects to different extents and depending on the purpose of processing, namely:

• without the consent of the personal data subjects on the basis of the performance of a contract, the legitimate interest of Madeta or due to the fulfilment of legal obligations, or
• with the consent of the personal data subject.

A) Processing of personal data based on a contract performance

Madeta processes basic identification and contact data for the purpose of negotiating the conclusion of a purchase or other contract, and the performance and administration of the contract in the following cases:

• the data subject is Madeta's business partner,
• the data subject is a person who eats in one of Madeta's canteens
• the data subject registers and creates a user account in the e-shops www.eshopmadeta.cz and www.madeta-velkoobchod.cz, where Madeta processes personal data for the purpose of proper account management and administration,
• the data subject orders goods in the e-shops www.eshopmadeta.cz and www.madeta-velkoobchod.cz,
• the data subject orders goods in the e-shop www.lipanek.cz,
• the data subject orders the goods through the Madeta call centre.

B) Processing of personal data for reasons of Madeta's legitimate interests

In such a case, the processing of personal data by Madeta is necessary for reasons of their legitimate interests, in the following cases:

• Personal data related to the conclusion and performance of a contract. These include, in particular, the personal data of persons who are not directly a party to the contract, but act as contact persons, responsible persons, etc. in the contract,
• Personal data of visitors to the Madeta website, which is used to detect the behaviour of website visitors in order to improve and customize the website, monitor traffic, target advertising, test new website features and applications and prevent attacks on the Madeta website. In this case, Madeta processes personal data via cookies or an IP address. Cookies are necessary for the proper functioning of the Madeta website, and therefore this data is processed by Madeta based on its legitimate interest.
• To implement direct marketing in connection with sending flyer promotions related to goods sold on the Madeta website or to send other commercial communications. In connection with the implementation of direct marketing, the data subject has the right to unsubscribe from their collection free of charge via the link provided in the commercial communication sent.
• The implementation of marketing activities is subject to the condition that the data subject can reasonably assume such processing of personal data due to the circumstances. In such a case, the data subject has the right to object to the processing of personal data. If he/she objects, Madeta will no longer process his/her personal data.
• Processing and storage of communication from the official Madeta website and the Madeta call centre. Madeta retains such communication in the case of its legitimate interests, in particular in cases where the communication is related to the performance of a contract where the data subject is not a party to the contract, in the event of queries and requests raised by the data subject via Madeta's official e-mail address or the call centre. Such records will be properly preserved and protected in a manner that prevents access by unauthorized persons.
• Camera systems, security service and IT security. Madeta uses CCTV systems and security services on its premises and production and commercial premises in order to protect the property and health of people in the guarded areas. For the same purpose, it processes personal data from security camera recordings.
• Records of persons authorized to purchase non-standard goods as part of the services provided by Madeta to selected entities.
• Handling inquiries, complaints or requests from customers, consumers or business partners.

C) Processing of personal data on the basis of consent

Madeta processes personal data for which consent is required only and to the extent that consent is granted. The purposes of the processing of personal data, the conditions and the duration of their processing are governed by the terms of the relevant consent and this policy.

In particular, Madeta processes personal data on the basis of consent in the following cases:

• participation in the "Lipánek Store” loyalty programme or participation in other loyalty or similar programmes,
• sending other commercial and marketing communications.

Granting consent for the processing of data is voluntary and any failure to grant consent does not affect the legal rights of data subjects. If a service is subject to the provision of consent and consent has not been provided by the data subject, such a service cannot be provided.

Consent may be withdrawn at any time and the withdrawal of consent will not affect the legal rights and legitimate interests of the data subject.

D) Processing of personal data necessary for the fulfilment of the legal obligations of the controller

The processing of personal data for the purpose of fulfilling legal obligations particularly occurs in the following cases:

• processing and handling of complaints,
• fulfilment of the obligations imposed by legal regulations, in particular Act No. 89/2012 Coll., Civil Code, Act No. 634/1992 Coll., on Consumer Protection, Act No. 235/2004 Coll., on Value Added Tax, 586 / 1992 Coll., on Income Tax, Act 563/1991 Coll., on Accounting.

Processing for the performance of a contract, the legitimate interests of the controller and the fulfilment of legal obligations cannot be refused. Personal data is processed to the extent necessary for the performance of these activities, for the time necessary to achieve them or for a time directly stipulated by law. Thereafter, the personal data is deleted or anonymized.

3. Time of personal data processing

In the case of personal data processing based on the performance of the contract, Madeta retains such data for the time necessary for the performance of the contract, i.e. for the period of validity and effectiveness of the contract, and for the limitation period of any claim arising from the contract. After this period, Madeta will destroy the personal data, unless it is entitled or obliged to further process this data based on another legal title. Madeta will continue to process the personal data of data subjects for the duration of any litigation.

If Madeta processes personal data based on the fulfilment of legal obligations, it will process this data for the time required to fulfil the archiving obligations arising from under the applicable law.

Personal data relating to customer accounts maintained on the website www.madetaeshop.cz and www.madeta-velkoobchod.cz will be retained by Madeta until the account holder requests Madeta to cancel the account.

If Madeta processes personal data based on consent to the processing of personal data, such data is processed for the period for which the consent was granted or until the withdrawal of consent to the processing of personal data.

If Madeta processes personal data on the basis of its legitimate interests, it processes this data for the following period:

• Madeta processes data relating to customer accounts of e-shops or loyalty programmes until the cancellation of such an account,
• in the case of commercial communications, until the time of refusal to be sent via the link placed in the commercial communication sent,
• Madeta uses personal data obtained through cookies or IP addresses for a maximum of 3 months. The data subject has the right to object to such processing.

4. Entities involved in the processing of personal data

In addition to Madeta, personal data is also processed by other entities that Madeta uses in the course of its business activities. These entities are, in particular, subcontractors, who are mainly carriers, suppliers, courier and logistics service providers, accounting firms, law firms, companies or entrepreneurs who provide server, web, cloud or IT services to Madeta, or who are its business partners.

If these subcontractors process the personal data of data subjects transmitted by Madeta, they have the status of personal data processors and process personal data solely and exclusively in accordance with Madeta's instructions.

Each Madeta subcontractor is selected with due diligence to meet all legal requirements, and Madeta enters into a personal data processing agreement with each such entity, where each subcontractor has clearly defined rights and obligations to protect and secure personal data.

Madeta may also provide personal data to entities designated for the protection of their rights or to other entities, in particular administrative authorities and bodies designated by the applicable legislation, if required by law.

5. Rights arising from the processing of personal data

Right of access

Based on the right of access to personal data, the data subject has the right to know what data Madeta processes about him/her, for what purpose, for how long, where it obtains this data and to whom it transmits it.

In this context, the data subject has the following rights:

• the right to confirm whether Madeta processes his/her personal data,
• the right of access to personal data,
• the right to information about the purpose, method, time and recipients of the personal data,
• the right to a copy of the personal data processed. In the case of the first copy, this is provided free of charge.

Right for rectification

If the data subject finds that the data processed by Madeta is inaccurate or incomplete, he/she has the right to have Madeta rectify or supplement it without undue delay. At the same time, the data subject is obliged to notify changes to his personal data.

Right for deletion

The data subject has the right to delete personal data if he/she proves that Madeta has stopped processing the data in accordance with generally binding regulations. The data subject is entitled to request the deletion in writing.

Exercising the right to delete personal data does not automatically imply that Madeta will delete all personal data of the subject. This right does not apply only if Madeta has another legal basis for the processing of personal data, which may be the fulfilment of a legal obligation, the performance of a contract or the legitimate interest of Madeta.

Right to restriction of processing

This right allows the data subject in certain cases to request that personal data be identified and that such data not be subject to any operations by Madeta for a limited period of time. Such restriction of the processing of personal data will occur if:

• the data subject contests the accuracy of the personal data,
• Madeta processes personal data without a sufficient legal basis,
• the data subject objects to the processing of personal data for the duration of the investigation of the objection.

Right for transfer

Upon request, the data subject shall have the right to obtain personal data concerning themselves that he/she has provided to Madeta in a structured, commonly used and machine-readable format, and the right to pass this to another controller, provided that:

• processing is based on consent or contract,
• processing is performed automatically.

The exercise of this right shall not adversely affect the rights and freedoms of others.

Right to object to processing

If the data subject considers that there is no legitimate interest in the processing of his/ her personal data, he/she has the right to object to such processing in writing.

Right to lodge a complaint

The data subject always has the right to lodge a complaint with the competent supervisory authority. This supervisory body is the Office for Personal Data Protection, which is located at Pplk. Sochora 27, 170 00 Prague 7.

Right to withdraw consent

The data subject has the right to withdraw consent to the processing of personal data at any time. Appeals must be in writing, comprehensible and definite

Automated processing and profiling

The data subject has the right not to be the subject of a decision based solely on automatic data processing, including profiling, which would have legal effects concerning him/her or similarly significantly affect him/her.

6. Exercise of individual rights

The rights specified in point 9 of this policy may be exercised by the data subject in writing to the address Rudolfovská tř. 246/83, 370 01 České Budějovice or to the email address madeta@madeta.cz.