Privacy policy

Basic Information on the Processing of Personal Data and Contact Details Rubber Steel Construction s.r.o., with its registered office at Za Pilou 114, 783 14 Bohuňovice, Company ID: 05266076, VAT ID: CZ05266076 (hereinafter referred to as the "Intermediary" or the "Controller"), hereby informs all visitors to this website, its business partners, prospective employees and clients about the processing of their personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR" or the "Regulation"), acting as a data controller or data processor under GDPR. The information contained in this document supplements the information provided to customers in concluded agreements. Personal data includes: 1) Identification data – first name, surname, username, password hash and password. 2) Contact details – telephone number, email address, delivery address and billing address. 3) Information contained in your account, newsletter preferences and similar settings. 4) Information about your orders – data provided by you, such as ordered services and payments for services. 5) Information about your behavior on the website. Identity and Contact Details of the Data Controller Rubber Steel Construction s.r.o., registered office at Za Pilou 114, 783 14 Bohuňovice, Czech Republic, Company ID: 05266076, VAT ID: CZ05266076, telephone: +420 736 147 188, email: petr.kostka@rscservis.cz Purposes of Personal Data Processing, Legal Bases, Legitimate Interests and Additional Information The purposes of personal data processing, information about the applicable legal bases, legitimate interests and information concerning the processing of personal data based on the client's freely given and active consent are always specified in the concluded agreement or in the terms and conditions published on the Intermediary's website. Personal data is also processed to comply with the Intermediary's legal obligations arising from tax regulations or other applicable legislation, as well as for purposes based on the Intermediary's legitimate interests, including: 1) Communication with prospective clients, particularly by email and other appropriate means. For this purpose, personal data, including contact details, identification data and information about the results of negotiations with such persons, may be processed for an indefinite period until the right to erasure is exercised. 2) Prevention of fraud and monitoring of established technological processes based on the Intermediary's legitimate interests. The processed data includes personal identification details, contact information, accounting records and information about services provided. 3) Recruitment of new employees who provide their personal data during job interviews. The personal data of unsuccessful applicants is retained for a maximum period of 6 months for the purpose of potentially contacting them with another job offer or inviting them to participate in another or repeated recruitment process, unless otherwise agreed. To demonstrate compliance with the prohibition of discrimination and the obligation of equal treatment under employment legislation, personal data may be processed based on the Intermediary's legitimate interest for a period of 3 calendar years following the year in which the recruitment process was completed. In the event of ongoing administrative, judicial or other proceedings, the data may be retained for the entire duration of such proceedings. 4) Direct marketing, which involves processing the personal data of existing customers for the purpose of directly contacting them with commercial offers or conducting research based on the Intermediary's legitimate interests. The Intermediary emphasizes that if a customer objects to direct marketing in relation to a particular service, the Intermediary will no longer process that customer's personal data for this purpose and will cease sending commercial offers or contacting the customer for direct marketing purposes. 5) Establishment, exercise and enforcement of legal claims in connection with complaints, legal disputes and enforcement proceedings. For this purpose, personal data may be processed for 3 years following the termination of the contractual relationship. If administrative or judicial proceedings are initiated, the data may be processed throughout the duration of such proceedings. The processed data includes identification details, contact information, accounting records and information about services provided. The legitimate interests involved are the protection of legal claims and monitoring the proper provision of services. 6) Performance of contracts with suppliers of goods and services to the Intermediary. For this purpose, personal data is processed for the duration of the contractual relationship based on the performance of the relevant contract. Following termination of the contractual relationship, the Intermediary may retain such data based on its legitimate interests for the protection of legal claims, internal records and monitoring for a period of 4 years (the 3-year limitation period plus one additional year), taking into account claims that may arise toward the end of the limitation period. If judicial, administrative or other proceedings are initiated, personal data will be processed to the necessary extent throughout such proceedings and for the remaining limitation period after their conclusion. The legitimate interests include the protection of legal claims and monitoring the proper provision of services. For accounting and tax purposes, personal data may be processed for up to 10 years following the end of the tax period in which the transaction occurred, in accordance with obligations imposed by accounting and value-added tax legislation. 7) Provision of services to clients and persons receiving those services. For this purpose, personal data may be processed for the duration of the contractual relationship based on the performance of the concluded agreement. The processed data includes identification details, contact information, accounting records and information about services provided. Following termination of the contractual relationship, personal data may continue to be retained based on legitimate interests for the protection of legal claims, internal records and monitoring for a period of 4 years (the 3-year limitation period plus one additional year), taking into account claims that may arise toward the end of the limitation period. If judicial, administrative or other proceedings are initiated, personal data will be processed to the necessary extent throughout such proceedings and for the remaining limitation period after their conclusion. The legitimate interests include the protection of legal claims and monitoring the proper provision of services. 8) Distribution of information, news and other commercial communications by email based on the Intermediary's legitimate interests, involving the processing of identification and contact details of existing clients. Personal data may be processed for an indefinite period until the contractual relationship between the Intermediary and the client ends. 9) Processing of personal data relating to third parties in connection with services provided by the Intermediary. In particular, the Intermediary processes identification details, contact information and information related to the services provided. For this purpose, personal data may be processed for 5 years following the termination of the contractual relationship with the client. Further details are provided in the section concerning the provision of services. 10) Persons subscribed to newsletters and other commercial communications based on their prior consent. Identification and contact details are processed in accordance with Act No. 420/2004 Coll. For this purpose, personal data may be processed for an indefinite period until the recipient unsubscribes. 11) Compliance with legal obligations is another reason for processing identification details, contact information and order-related data. The relevant legislation includes, in particular, Act No. 89/2012 Coll., the Civil Code; Act No. 634/1992 Coll., on Consumer Protection; Act No. 235/2004 Coll., on Value Added Tax; and Act No. 563/1991 Coll., on Accounting. For these purposes, the Intermediary processes personal data for the period required by the applicable legislation, for a maximum of 10 years, unless future legislation establishes a longer retention period. 12) The Intermediary also processes personal data based on its legitimate interests for the purpose of obtaining information that will help improve its services in the future, providing personalized offers and displaying targeted advertising on the website. Security All processed personal data is protected by appropriate organizational and technical measures. Security procedures, technical safeguards and physical restrictions are implemented to control access to and use of personal data stored on the Intermediary's servers. Access to personal data is restricted to authorized personnel who require such access for their work. Recipients of Personal Data Recipients of personal data are natural or legal persons, public authorities, agencies or other entities to whom personal data is disclosed. However, public authorities that may receive personal data as part of a specific investigation in accordance with the law of a Member State are not considered recipients. The processing of personal data by such authorities must comply with the applicable data protection rules for the relevant purposes. The Intermediary applies the highest possible standards of personal data security. Personal data is shared with contractual partners, such as legal advisers and IT service providers, only when strictly necessary and only to the extent required. Before sharing personal data, the Intermediary concludes appropriate data processing agreements with these entities to ensure that personal data is handled responsibly, protected against misuse and unauthorized disclosure, and processed only to the necessary extent. The Intermediary may transfer personal data to the following categories of recipients with whom appropriate data processing agreements have been concluded in accordance with GDPR: A. Entities that may process your personal data for the purpose of contract performance: The Intermediary may also transfer your personal data to other entities acting as independent data controllers, including service providers involved in delivering the services you have purchased. B. Entities that may process your personal data for the purpose of providing delivery and accounting services. C. Entities that may process your personal data for the purpose of protecting the Controller's property and legally protected interests, as well as the life and health of employees and clients. D. Entities that occasionally process personal data for marketing purposes or to improve service quality, including Google Analytics and Facebook Pixel. E. Entities that occasionally process personal data for purposes related to the fulfillment of employment law obligations. Personal Data Retention Period The basic retention period for personal data is always specified in the agreement concluded between the client and the Intermediary. Unless expressly stated otherwise: Personal data of prospective clients who have provided their personal data but have not concluded a contract is retained for 1 year for record-keeping purposes. Personal data of clients is retained for 5 years following the termination of the contractual relationship for record-keeping purposes. Additional Retained Data The Intermediary also retains other information and personal data provided by clients concerning other natural persons with whom they cooperate or whose data is necessary for the performance of the contractual relationship. Clients are obliged to inform such persons appropriately about the transfer of their personal data to the Intermediary. The Intermediary emphasizes once again that YOU CAN EASILY WITHDRAW YOUR CONSENT to the provision and processing of personal data by sending a notification to Rubber Steel Construction s.r.o. or by email to info@rscservis.cz. You may also submit any OBJECTIONS to the processing of personal data using these contact details. Your Rights Under the conditions established by GDPR, you have the following rights: Right of Access to Personal Data under Article 15 GDPR You have the right to obtain confirmation from the Controller as to whether personal data concerning you is being processed. If such data is being processed, you have the right to access that personal data and obtain the following information: - The purposes of processing. - The categories of personal data concerned. - The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients in third countries or international organizations. - The intended period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period. - The existence of the right to request rectification or erasure of personal data, restriction of processing, or to object to such processing. - The right to lodge a complaint with a supervisory authority. - Any available information about the source of the personal data, where the data was not collected directly from the data subject. - The existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) GDPR, and, at least in such cases, meaningful information about the logic involved, as well as the significance and expected consequences of such processing for the data subject. Right to Rectification under Article 16 GDPR You have the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement. Right to Erasure under Article 17 GDPR You have the right to request the erasure of your personal data, particularly where: - The personal data is no longer necessary for the purposes for which it was collected or otherwise processed. - You withdraw the consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing. - You object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object under Article 21(2) GDPR. - The personal data has been unlawfully processed. - The personal data must be erased to comply with a legal obligation under European Union or Member State law applicable to the Controller. - The personal data was collected in connection with the offer of information society services referred to in Article 8(1) GDPR. Right to Object under Article 21 GDPR You have the right to object to the processing of your personal data by the Intermediary. Such objections will be assessed, and where appropriate legal grounds exist, they will be upheld. In particular, you have the right to object at any time to the processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The Intermediary will no longer process the personal data unless it demonstrates compelling legitimate grounds for processing that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling related to direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes. Right to Data Portability under Article 20 GDPR You have the right to receive personal data concerning you that you have provided to the Controller in a structured, commonly used and machine-readable format. You also have the right to transmit such data to another controller without hindrance from the Controller to whom the personal data was provided, where: a) The processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR. b) The processing is carried out by automated means. Right to Information About a Personal Data Breach You have the right to receive information about a personal data breach under the conditions established by Article 34 GDPR. Right to Withdraw Consent You have the right to withdraw your consent to the processing of personal data in writing or electronically by contacting the Controller at the postal or email address specified in this document, in accordance with Article 7 GDPR. Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority under Article 77 GDPR if you believe that the processing of your personal data violates GDPR requirements. Right to Restriction of Processing under Article 18 GDPR You have the right to request that the Controller restrict the processing of your personal data in any of the following circumstances: - You contest the accuracy of the personal data, for a period enabling the Controller to verify its accuracy. - The processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead. - The Controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise or defense of legal claims. - You have objected to processing under Article 21(1) GDPR, pending verification of whether the legitimate grounds of the Controller override those of the data subject. Additional Information Regarding the Right to Lodge a Complaint The Intermediary informs you that you have the right to lodge a complaint with the Czech Office for Personal Data Protection if you believe that your right to personal data protection has been violated. Complaints may be submitted to: Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27 170 00 Prague 7 Czech Republic Complaints may also be submitted by email or through any other communication method accepted by the Office for Personal Data Protection. Further information is available at www.uoou.cz. Final Provisions By submitting an order through the online order form, you confirm that you have read and understood the Personal Data Protection Policy and accept it in its entirety. You express your consent to these conditions by selecting the relevant consent checkbox in the online form. By providing such consent, you confirm that you have read and understood the Personal Data Protection Policy and accept it in its entirety. The Controller reserves the right to amend these conditions. The updated version of the Personal Data Protection Policy will be published on the Controller's website or may be sent to the email address you have provided. 4. Further information about your rights can be found on the website of the Czech Office for Personal Data Protection: https://www.uoou.cz/6-prava-subjektu-udaj/d-27276. 5. If you have any questions, please do not hesitate to contact the Intermediary by email at info@rscservis.cz or by post at its registered office. 6. Personal data is stored on a server with data storage located within the European Union.