Dear customers and business partners,
This document contains basic information on how we process your personal data.
In view of the European Union legislation, this text has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR).
For maximum clarity, the text is structured in a question-and-answer format.
We present you with the basic information that we, as a personal data controller, are obliged to provide.
If you have any questions regarding the processing of your personal data, please do not hesitate to contact us using the following contact information: info@mhas.cz
A controller is a person who, alone or jointly with others, determines the purposes and decides how personal data will be processed.
The data controller is MEIXNER & HANUŠ a.s. Czech republic. The controller can be contacted at the email address info@mhas.cz.
A Data Protection Officer is a person experienced in the field of personal data protection who ensures that processing is carried out properly, in particular in accordance with the applicable legal regulations. They are also the most qualified person to handle inquiries and requests concerning personal data.
The DPO is Ms. Eva Majvaldová, who can be contacted at info@mhas.cz.
The controller processes personal data to:
Providing personal data to the controller is generally a statutory and contractual requirement. Regarding the provision of personal data for marketing purposes, which does not constitute the fulfillment of a contractual and legal obligation of the controller, your consent is required. If you do not grant the controller consent to process personal data for marketing purposes, it does not mean that the controller will refuse to provide you with its product or service under the contract as a result.
The controller also processes personal data to protect its legitimate interests. The controller's legitimate interests are in particular the proper performance of all contractual obligations of the controller, the proper performance of all legal obligations of the controller, direct marketing, protection of the controller's business and property, and last but not least, environmental protection and ensuring sustainable development.
In order to ensure the greatest possible protection of your privacy, you have the right to object to your personal data being processed exclusively for the most necessary statutory reasons or to have the personal data blocked. You can read more about your rights related to the processing of personal data in Article 11 of this text.
The controller obtained the personal data directly from you, in particular from completed forms, mutual communication, or concluded contracts. In addition, personal data may come from publicly available sources, registers, and records, such as the commercial register, debtor registers, professional registers, or the Land Registry. Furthermore, the controller may have obtained personal data from third parties who are authorized to access and process your personal data and with whom it cooperates, as well as from information on social networks and the internet that you have placed there yourself.
To ensure your satisfaction with the proper performance of obligations, to ensure compliance with legal obligations, to ensure a personalized offer of goods and services of the controller, and for other purposes listed above, the controller processes the following categories of personal data:
The lawfulness of processing is established by Article 6(1) GDPR, according to which processing is lawful if it is necessary for the performance of a contract, for compliance with a legal obligation of the controller, for the protection of the legitimate interests of the controller, or if processing takes place on the basis of consent you have granted us.
Our employees and, in necessary cases, the following cooperators and cooperating companies have access to your personal data:
We have a contract concluded with all these cooperators and companies, which binds them to handle the transferred personal data as required by the GDPR regulation and only to the minimum extent necessary.
We must also provide personal data to state administration authorities under statutory obligations, such as the tax administrator, courts, law enforcement authorities, or capital market supervisory authorities.
We will not transfer personal data to countries outside the European Union or the European Economic Area.
The controller's effort is to ensure that processing of your data is carried out properly and, above all, securely. You are guaranteed the rights described in this article, which you can exercise with the controller.
You can exercise individual rights by sending an email to info@mhas.cz or by calling the telephone number +420 465 466 711. You can also exercise your rights in the form of a written request sent to our correspondence address: U Dlouhoňovic 1397, Postcode 564 01 Žamberk.
All communications and statements regarding your exercised rights are provided by the controller free of charge. However, if the request is manifestly unfounded or excessive, in particular because of its repetitive character, the controller is entitled to charge a reasonable fee taking into account the administrative costs associated with providing the requested information. In the case of repeated requests for copies of processed personal data, the controller reserves the right to charge a reasonable fee for administrative costs for this reason.
The controller will provide you with a statement and, if applicable, information about the measures taken as soon as possible, but no later than within one month. The controller is entitled to extend this period by two months if necessary, taking into account the complexity and number of requests. The controller will inform you about the extension and the reasons for it.
You are entitled to request information from the controller as to whether or not personal data are processed. If they are processed, you have the right to request information, in particular regarding the identity and contact details of the controller, their representative and, if applicable, the DPO, the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients, legitimate interests, list of your rights, the possibility to contact the Office for Personal Data Protection, the source of the processed data, and automated decision-making and profiling.
If the controller intends to process your personal data for a purpose other than that for which they were collected, it will provide you with information about this other purpose and other relevant information prior to such further processing.
The information provided to you as part of exercising this right is already contained in this text. However, this does not prevent you from requesting it again.
You are entitled to request information from the controller as to whether or not your personal data are processed, and if so, you have access to information about the purposes of processing, categories of personal data concerned, recipients or categories of recipients, storage period, information about your rights (rectification, erasure, restriction, objection), the right to lodge a complaint with the Office for Personal Data Protection, the source of data, and whether automated decision-making and profiling take place, as well as the logic involved and consequences of such processing. You have the right to obtain a copy of the processed personal data. However, the right to obtain this copy must not adversely affect the rights and freedoms of others.
If, for example, your residence, telephone number, or other facts that can be considered personal data have changed, you have the right to request the controller to rectify the processed personal data. In addition, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
In certain specified cases, you have the right to request that the controller erase your personal data. Such cases include, for example, that the processed data are no longer necessary for the purposes mentioned above. The controller erases personal data automatically after the necessity period expires, but you can contact the controller with your request at any time. Your request is then subject to individual assessment (despite your right to erasure, the controller may have an obligation or legitimate interest to retain your personal data) and you will be informed in detail about its resolution.
The controller processes your personal data only to the minimum extent necessary. If you feel that the controller, for example, exceeds the above purposes for which it processes personal data, you can submit a request that your personal data be processed exclusively for the most necessary statutory reasons or that the personal data be blocked. Your request is then subject to individual assessment and you will be informed in detail about its resolution.
If you wish the controller to provide your personal data to another controller or another company, the controller will transfer your personal data in a corresponding format to the entity designated by you, provided there are no legal or other significant obstacles to doing so.
If you find or believe that the controller processes personal data in conflict with the protection of your private and personal life or in conflict with legal regulations (provided that the personal data are processed by the controller on the basis of public or legitimate interest, or are processed for direct marketing, including profiling, or for statistical, scientific, or historical purposes), you can contact the controller and ask for an explanation or remediation of the situation.
You can also object directly to automated decision-making and profiling.
You can contact the supervisory authority with your initiative or complaint regarding the processing of personal data at any time, namely the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7, website https://www.uoou.cz/.
You have the right to withdraw your consent to personal data processing at any time, either by filling out a form/unchecking a box/sending a withdrawal to the registered office of the controller, or by using a link in email communications.
Personal data are evaluated automatically and may be used for profiling or automated decision-making in the marketing activities of the controller. The controller uses the following methods for this purpose:
As a result of these activities by the controller, your behavior on the website will be mapped and evaluated, which represents a certain intrusion into your right to privacy. At the same time, however, this evaluation helps ensure that you receive only those advertising offers regarding the controller's products and services in which you might be interested based on the results of the evaluation.