GDPR - Ochrana osobních údajů | COMAX

GDPR
Privacy

Dear customers, business partners and members of the public,

 

the document you are reading contains basic information about how we process your personal data. We appreciate you sharing your personal data with us and are committed to protecting it as much as possible. We also strive to be as transparent as possible with you about how we process your personal data. Due to new European Union legislation, this information memorandum has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

 

Information Memorandum on the Processing of Personal Data

In this memorandum we have tried to present the information to you as clearly as possible, which is why we have chosen a question and answer format. You will find out the information in the following order:

  1. Who is the data controller?

  2. Who is the data protection officer?

  3. For what purpose do we need the personal data?

  4. How was the personal data obtained?

  5. What categories of personal data are processed?

  6. What is the legal basis for processing the personal data?

  7. Whether we will pass the personal data on to someone else?

  8. Whether we will transfer the personal data to a third country or international organisation?

  9. How long will we handle the personal data?

  10. What are your rights in relation to the processing of personal data and how can you exercise them?

  11. Is personal data automatically evaluated?

This Information Memorandum sets out the basic information we are required to provide as a data controller. If you have any questions regarding the processing of your personal data, please do not hesitate to contact us at gdpr@mtcomax.cz , or by phone at +420 315 730 730. In all cases we can be contacted at our delivery address Velvary 420, 273 24 Velvary.

 

 

Who is the data controller?

The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, that law may determine the controller concerned or the specific criteria for its determination.

The controller of personal data is METAL TRADE COMAX, a.s., with registered office at Velvary 420, 273 24 Velvary, identification number 49684442, a company registered in the Commercial Register of the Municipal Court in Prague, file number B 11701.

 

 

Who is the Data Protection Officer?

The Data Protection Officer is a person who is experienced in data protection and does everything possible to ensure that processing takes place as it should, in particular in accordance with the relevant legislation. He or she is also the person best placed to deal with enquiries and requests relating to personal data.

The Trustee has decided that it is not required under the GDPR to appoint an official Data Protection Officer and has therefore only appointed a deputy who is responsible for managing the protection relating to the processing of personal data. This representative is Mr. Vladimír Slovák, who can be contacted at gdpr@mtcomax.cz or by phone at +420 315 730 730.

 

What purpose do we need personal information for?

The administrator carries out many activities that they would like you to know about. The processing that the controller carries out varies depending on the relationship you have with us.

If you are a candidate who would like to become part of our team, then we process your personal data on the basis of our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) and we use it to

  • recruit and provide a selection process for the position to be filled;

  • search for suitable candidates on the open market.

If you are a visitor to our premises, then we process your personal data on the basis of our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) and we use it to

  • carry out random checks on vehicles and persons;

  • control access to the company, including the registration of vehicles and persons.

If you are a visitor to our website, a participant in public or non-public events of our company, then we process your data on the basis of our legitimate interests or the legitimate interests of third parties (Art. f) and we use it to

  • publish articles, interviews, photos and videos on social media and YouTube, where this is solely to promote the company's products or brand;

  • managing the protection of property and persons on the Company's premises, where we take CCTV footage of your person in connection with your movement around the Company's premises

    and based on contractual obligations (Art. 6(1)(b), we use your personal data to

  • provide security for the leased non-residential premises;

  •  

  • arrange a sale by an agent (representative) of the company.

If you are a student who is undertaking a work experience placement with us, then we process your personal data on the basis of a contractual obligation (Article 6(1)(b) and use it to

  • fulfill the essence of the work experience contract between the school and us.

If you are a customer of ours, then we process your personal data on the basis of our legitimate interests or the legitimate interests of third parties (Art. 6 (1) (b) of Art. f) and we use it to

  • register participants at our public events;
  • evaluate website traffic and process checks for sending informational emails;

  • publish articles, interviews, photos and videos on social media and YouTube, where this is solely for the promotion of the company's products or brand

    and on the basis of a contractual obligation (Art. 6 para. 1 lit. b), we use your personal data to

  • rent non-residential premises;
  • prepare a draft contract based on your request;
  • prepare contracts for the disposal of company assets;
  • operate the complaints portal;
  • activities related to the sale of goods, such as delivering the goods ordered by you, contacting you for the possibility of picking up the manufactured goods, contacting you to send you a quotation, carrying out a survey to prepare an enquiry/quotation, preparing a sales contract and advance invoice, preparing a quotation and a laying plan, arranging a contract carrier, processing your enquiry or arranging a sale by an agent (representative) of the company.

If you are our suppliers or partners, then we process your personal data on the basis of our legitimate interests or the legitimate interests of third parties (Art. f) and we use it to

  •  

  • record attendees at our company's public events;

  • publish articles, interviews, photos and videos on social media and YouTube;

  • evaluation of website traffic and processing of control in sending informative emails

    and on the basis of contractual obligation (Art. 6(1)(b), we use your personal data to

  • provide construction and building activities within our company;

  •  

  • contact you in order to send you a quotation or to deliver goods to a customer.

Providing personal data to the controller is generally a legal and contractual requirement. When providing personal data for marketing purposes, which is not a fulfilment of the contractual and legal obligation of the controller, your consent is required. If you do not give consent to the controller to process your personal data for marketing purposes, this does not mean that the controller will refuse to provide you with its product or service on the basis of the contract as a result.

Consent (Art. 6(1)(a)(1)(b)) is not required. a) to the processing of personal data is used for the processing purposes set out below, and only if you have given us your consent:

  • on the basis of feedback from the customer or from the implementers, we will carry out a final photo documentation of the implementation, which we will then publish on our website, in catalogues or in our magazine, including your references, if you give them to us;

  • if you choose to subscribe to our website newsletters;

  • if you attend corporate or public events, training and workshops organised by us;

  • when you participate in trade fairs, exhibitions, excursions and tours organised by us where we get your contacts;

  • when you participate with us in the preparation and promotion of PR articles;

  • if you are participating in a field trip as a student, then you may leave us your contact information for the purpose of reaching out with a job offer.

Remember that you can withdraw this consent at any time and we will delete any personal information we hold about you that is subject to deletion. However, we may not be able to delete some data for which you have given us your consent to process, in particular if you have given your consent to use it in PR articles and videos produced for the purposes of marketing and promoting the company, in newsletters with your references that we email to clients if they request them, etc.

 

How was the personal data obtained?

The controller obtained the personal data directly from you, in particular from completed forms, mutual communication or concluded contracts. In addition, personal data may come from publicly available sources, registers and records, such as the commercial register, debtors' register, professional registers or, for example, the Land Registry. In addition, the controller may have obtained personal data from third parties who are authorised to access and process your personal data and with whom it cooperates, as well as from information from social networks and the Internet that you yourself have placed there.

 

What categories of personal data are processed?

To ensure your satisfaction with the proper performance of the undertaking, to ensure compliance with legal obligations, to provide a personalized offer of goods and services of the controller and for the other purposes listed above, we process the following categories of personal data as a data controller:

a) basic identification data - name, surname, date of birth, residential address, birth number and identification number, signature;

b) contact data - telephone number and email address;

c) information about your use of the controller's products and services - this is information about what products you have contracted with the controller and what products you are using now;

d) information from mutual communication - information from emails, from contact forms on the website;

e) billing and transaction data - this is mainly information appearing on invoices, agreed billing terms and payments received, bank account numbers;

f) information about the contract being executed - this includes in particular drawings, documentation, photo documentation, references;

g) for students information about - school, field of study, year of study, language skills, experience and type of potential cooperation;

h) information about checks carried out at entrances to the campus, or CCTV footage from the campus

 

What is the legal basis for processing personal data?

The lawfulness of the processing is determined by Article 6(1) of the GDPR, according to which the processing is lawful if it is necessary for the performance of a contract, for the fulfilment of a legal obligation of the controller, for the protection of the legitimate interests of the controller or if the processing is based on the consent you have given us.

The lawfulness of processing is further based, for example, on Act No. 563/1991 Coll, No. 89/2012 Coll., Civil Code, under which the controller defends its legitimate interests, or Act No. 235/2004 Coll, on value added tax.

 

Will we pass on personal data to anyone else?

In order to fulfil our obligations towards you, we must use data processors for some processing. We may transfer your personal data to processors, disclose it to third parties, or provide it to recipients who ask us for it and have lawful reasons for us to pass your data to them. The list of recipients of your personal data is complete and we will always inform you of any change in processors.

i) website traffic information - where the IP address of the access, where the page is accessed, time spent on the page, date and time of page opening, time of most frequent page opening, cookies are processed;

j) information from CVs that you provide and disclose to us via your CV.

 

List of processors/third parties or recipients

  • ADVENT, spol. s r. o., Prague 6, Na Beránce 57/2, Postal Code 16000, registered in the Commercial Register kept at the Municipal Court in Prague, Section C, Insert 33467

  • NAVISYS s.r.o., Florianova 1158/16, Královo Pole, 612 00 Brno, registered in the Commercial Register kept at the Regional Court in Brno, Section C, Insert 26585

  • Business Agents in individual countries (UK, FR, CR)

  •  

  • insurance recovery companies

  • Atradius Crédito y Caución S.A. de Seguros y Reaseguros, Branch Office for the Czech Republic, Karolinská 661/4, Karlín, 186 00 Praha 8, registered in the Commercial Register kept at the Municipal Court in Prague, Section A, Insert 77616

  • Credendo - Short-Term EU Risks úvěrová pojišt'ovna, a.s., Praha 4, Na Pankráci 1683/127, Postal Code 14000, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 9958

  • EULER HERMES SA, organizační složka, Praha 8, Molákova 576/11, Postal Code 18600, registered in the Commercial Register maintained by the Municipal Court in Prague, Section A, Insert 74831

  • Euler Hermes Services Czech Republic, s.r.o., Prague 8, Molákova 576/11, Postal Code 18600, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 69978

  • Coface Czech Credit Management Services, spol. s r.o., Prague 2, náměstí I.P.Pavlova 1789/5, Postal Code 12000, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 3426

  •  

  • Coface Czech Insurance Service s.r.o., náměstí I. P. Pavlova 1789/5, Nové Město, 120 00 Praha 2, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 128894

  • Advokátní kancelář LEUCHTER & LEUCHTEROVÁ, s.r.o., Mikulandská 122/4, Nové Město, 110 00 Prague 1, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 156919

  • BDO Advisory s.r.o., Karolinská 661/4, Karlín, 186 00 Praha 8, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 107235

  • BLESK Servis s.r.o., Ocelářská 1272/21, Libeň, 190 00 Prague 9, registered in the Commercial Register kept at the Municipal Court in Prague, Section C, Insert 118507

  • external transport companies (CZ and PL)

  • JABLOTRON ALARMS a.s., Pod Skalkou 4567/33, 46601 Jablonec nad Nisou; registered at the Regional Court in Ústí nad Labem, Section B, Insert 1957

  • LMC s.r.o., Jankovcova 1569/2c, 170 00 Prague 7, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 82484

  • SmartSelling a.s., Netroufalky 797/5, Bohunice, 625 00 Brno, registered in the Commercial Register kept at the Regional Court in Brno, Section B, Insert 7559

  • LESENSKY.CZ s.r.o., Štursova 583/49, Komín, 616 00 Brno, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 76249

Within the limits of the law, we must also provide personal data to state administration authorities, such as tax authorities, courts, law enforcement authorities or capital market supervisory authorities.

 

Will we transfer personal data to a third country or an international organisation?

We will not transfer personal data to countries outside the European Union or the European Economic Area or to any international organisation. Should such a situation arise, we will always seek your consent.

 

How long will we store personal data?

Personal data will be processed and stored for at least the duration of the contract. Certain personal data required, for example, for tax and billing obligations will be kept for longer, usually 5 years starting from the year following the occurrence of the fact stored.

  • Personal data email, first name, last name, job title, company, telephone, IP address, location of opening, time spent on the website, date and time of most frequent opening of the website, date of birth, knowledge and experience, field of education, RZ, the result of the check from the company's concierge, the visitor's signature, the visitor's signature, which are relevant for the exercise of the controller's legitimate interests, will be kept for a maximum of 3 years from the end of the contractual relationship with the controller.

  • Personal data taken for the purpose of protecting property and persons on the premises will be retained for a maximum period of 7 days from the time the record was taken.

  • Personal data processed for marketing purposes will be retained for a maximum of 3 years from the date of acquisition.

Personal data will never be retained for longer than the statutory maximum. After the archiving period has expired, the personal data will be securely and irretrievably destroyed so that it cannot be misused.

 

What are your rights in relation to the processing of personal data and how can you exercise them?

The controller does everything possible to ensure that the processing of your data is carried out properly and, above all, securely. The personal data to which the controller gains access is under continuous physical, electronic and procedural control. The controller has modern control, technical and security mechanisms in place to ensure maximum protection of the processed data against unauthorised access or transmission, against loss or destruction, as well as against other possible misuse. All persons who come into contact with personal data in the course of their work or contractual duties are bound by a legal or contractual obligation of confidentiality. You are guaranteed the rights described in this article, which you can exercise with the controller.

 

How can you exercise your rights?

You can exercise your individual rights by written request sent to our correspondence address Velvary 420, 273 24 Velvary with a certified signature, by data box or in person if you come to any of our branches where we will verify your identity. We must verify your identity so that we do not violate the privacy of another natural person in the steps leading to the exercise of your rights.

All communications and statements regarding the rights you have exercised are provided by the controller free of charge. However, if the request is manifestly unfounded or excessive, in particular because it is repetitive, the controller is entitled to charge a reasonable fee taking into account the administrative costs involved in providing the information requested. In the event of a repeated request for copies of the personal data processed, the controller reserves the right to charge a reasonable fee for the administrative costs for this reason.

The controller will provide you with a statement and, where appropriate, information on the measures taken as soon as possible and at the latest within one month. The controller is entitled to extend the time limit by two months if necessary and in view of the complexity and number of requests. The controller will inform you of the extension, including the reasons for it, within 30 days of receipt of the request.

 

Right to information about the processing of your personal data

You are entitled to request information from the controller as to whether or not personal data are processed. If personal data are processed, you have the right to request information from the controller, in particular on the identity and contact details of the controller, its representative and, where applicable, the data protection officer, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients of the personal data, the authorised controllers, a list of your rights, the possibility to contact the Data Protection Authority, the source of the personal data processed and automated decision-making and profiling.

If the controller intends to further process your personal data for a purpose other than that for which it was collected, it will provide you with information about that other purpose and other relevant information before that further processing. The information provided to you in exercising this right is already contained in this memorandum, but this does not prevent you from requesting it again.

 

Right of access to personal data

You are entitled to request information from the controller, whether or not your personal data is being processed and, if so, you have access to information about the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients, the period of retention of the personal data, information on your rights (rights to request the controller to rectify or erase, restrict processing, object to such processing), the right to lodge a complaint with the Data Protection Authority, information on the source of the personal data, information on whether automated decision-making and profiling is taking place and information concerning the procedure used as well as the relevance and foreseeable consequences of such processing for you, information and safeguards in the event of transfer of personal data to a third country or an international organisation. You have the right to be provided with copies of the personal data processed. However, the right to obtain this copy must not adversely affect the rights and freedoms of others.

 

Right to rectification

If there has been a change on your part, for example, in your residence, telephone number or other fact which may be considered personal data, you have the right to request the controller to rectify the personal data processed. In addition, you have the right to have incomplete personal data completed, including by providing a supplementary declaration.

 

Right to erasure (right to be forgotten)

In certain specified cases, you have the right to request that the controller erase your personal data. These cases include, for example, that the data processed is no longer necessary for the purposes mentioned above. The controller deletes personal data automatically after the period of necessity has expired, but you can contact the controller at any time with your request. Your request will then be subject to an individual assessment (despite your right to erasure, the controller may have an obligation or legitimate interest to retain your personal data) and you will be informed in detail about the processing.

 

Right to restriction of processing

The controller will only process your personal data to the extent strictly necessary. However, if you feel that the controller is, for example, going beyond the purposes for which it processes personal data as set out above, you can make a request that your personal data be processed solely for the strictly necessary lawful purposes or that the personal data be blocked. Your request will then be subject to an individual assessment and you will be informed in detail about the processing of your request.

 

Right to data portability

If you wish the controller to provide your personal data to another controller, or to transfer your personal data to another controller, you may request that the controller provide your personal data to another controller. to another company, the controller will transfer your personal data, in the appropriate format, to the entity designated by you, provided that no legal or other significant obstacles prevent it from doing so.

 

Right to object and automated individual decision-making

If you become aware or believe that the controller is processing personal data in breach of the protection of your privacy or in breach of the law (provided, that the personal data is processed by the controller on the basis of public or legitimate interest, or is processed for direct marketing purposes, including profiling, or for statistical purposes, or for purposes of scientific or historical interest), you may contact the controller and request an explanation or rectification of the deficiency. You can also object directly to automated decision-making, including profiling.

 

Right to lodge a complaint with the Office for Personal Data Protection

You can contact the supervisory authority at any time with your complaint or suggestion regarding the processing of personal data, namely the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7, website https://www.uoou.cz/.

 

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time, either by completing the form/checking the box/sending the revocation to the address of the controller's registered office or by using the link in the email communication, depending on how the consent was obtained.
 

Is personal data automatically evaluated?

Personal data is not automatically evaluated or otherwise processed, and cannot be used for profiling or automated decision-making in the marketing or other activities of the controller.

 

Concluding Provisions

All legal relationships arising from or in connection with the processing of personal data are governed by the laws of the Czech Republic, regardless of where the data was accessed. To resolve any disputes arising in connection with the protection of privacy between you and METAL TRADE COMAX, a.s., with its registered office at Velvary 420, 273 24 Velvary, identification number 49684442, a company registered in the Commercial Register of the Municipal Court in Prague, file number B 11701, the Czech courts shall have jurisdiction and shall apply Czech law.

 

We may and will periodically update the text of this Information Memorandum. We will notify you of any such changes at least 30 days before the changes become effective.

Cookie settings

You can view and set your preferences and cookie settings, as well as the list of cookies stored by this website, by following this link.