Privacy Policy

Introduction

These Principles contain basic information on the processing of personal data carried out by the controller, in particular, though not exclusively, in connection with a contractual or non-contractual relationship with the controller, the provision or receipt of services or goods, and the operation of these websites.

Please do not send any of your personal data if you do not wish it to be used in the manner described in these Principles.

Controller

In relation to your personal data, the controller is Hyverr s.r.o., Company ID No. 06696236, with its registered office at Velkopřevorské náměstí 488/5, Malá Strana, 118 00 Prague 1 (the “Controller”).

Data Protection Officer

The Data Protection Officer for the group of undertakings formed by the above controllers is Ing. Lukáš Bajgar.

Processing of Personal Data

Personal data are processed to the extent in which the relevant data subject has provided them to the Controller, in connection with the conclusion of a contractual or other legal relationship with the Controller, or where the Controller has otherwise collected them and processes them in accordance with applicable legal regulations or for the performance of the Controller’s legal obligations.

Personal data will not be used for decision-making based solely on automated processing, including profiling.

Sources of Personal Data

The source of the personal data processed and collected is primarily the data subject.

The Controller may also collect personal data from third parties, such as public authorities, business partners, or publicly available sources and databases.

Categories of Personal Data

The following personal data may be processed:

• Basic identification data, which are or may be necessary for the conclusion of a contract, in particular first name and surname, residential address or registered office, function or job position.
• Contact data, in particular first name and surname, telephone number, e-mail address and delivery address.
• Other personal data provided for the purpose of being contacted by the Controller or establishing cooperation.
• Service-related data, whose processing is necessary for the provision of services or the supply of goods or services, as well as data provided in connection with the provision of services or the supply of goods or services and the performance of a contract.
• Website usage data, relating to the use of the websites.
• Any other data provided at the data subjects’ own discretion for a specific processing purpose.

Categories of Recipients of Personal Data

Personal data may be disclosed to other companies within the group of companies of which the Controller forms part, in particular where such company provides certain services for the Controller.

Personal data may also be transferred to an external person ensuring the operation of the Controller’s technical equipment (in particular software and hardware), and such person may also be one or more of the other group companies of which the Controller also forms part.

The Controller’s advisers and external collaborators, or those of other companies within the group of companies of which the Controller also forms part, e.g. tax advisers, legal advisers, etc., may have access to certain personal data, but only if they need such personal data for the fulfilment of the processing purpose.

The above recipients must provide sufficient and trustworthy guarantees regarding the technical and organisational security of personal data protection.

The Controller does not intend to transfer personal data to a third country, i.e. a country outside the European Union, or to an international organisation.

Purposes and Legal Bases for Processing Personal Data

• Processing for the performance of a contract, where the Controller needs to know and process certain personal data, in particular for the purpose of entering into and performing a contract concluded with the Controller, or for handling a request submitted through a contact or other web form on the Controller’s websites; in such case, other data stated in such form may also be processed. The legal basis for such processing is the performance of a contract, or another applicable purpose depending on the nature of the request made via the Controller’s websites.
• Processing of enquiries, similarly concerning necessary data communicated to the Controller through a contact form or in another manner in connection with an enquiry for the Controller’s services. The legal basis for the processing of such personal data is taking steps prior to entering into a contract and, where applicable, the performance of the contract, or the Controller’s legitimate interest in responding to the message.
• Processing for compliance with legal obligations, where the Controller needs to know and process certain data in order to comply with obligations imposed on the Controller by applicable legal regulations; within the Czech Republic this includes, in particular though not exclusively, Act No. 563/1991 Coll., the Accounting Act, Act No. 586/1992 Coll., the Income Taxes Act, and Act No. 235/2004 Coll., the Value Added Tax Act. Personal data will be retained for the period stipulated by legal regulations, otherwise for the period necessary to fulfil and demonstrate compliance with legal obligations.
• Processing based on legitimate interests, where the Controller processes certain data necessary for the protection and exercise of its rights and legally protected interests, for example compensation for damage or the recovery of receivables.
• Processing based on consent, provided that you have granted such consent. This may include, in particular, personal data processed for marketing communications, newsletters, etc.

Period of Processing and Retention of Personal Data

Where the Controller processes personal data for the purposes of performing a contract or dealing with a submitted request, the personal data are processed for the duration of the contractual relationship, or for the time necessary to deal with the submitted request, and subsequently for five years after termination of the contract so that the Controller may defend any legal claims, and thereafter for any period required by legal regulations.

Where the Controller processes personal data for the purposes of complying with legal obligations, it processes them for the period stipulated by the relevant law.

Where the Controller processes personal data for the purposes of protecting the Controller’s legitimate interests, such personal data are retained for the limitation period stipulated by legal regulations, but for at least three years.

Where the Controller processes personal data on the basis of consent, it is entitled to process them in accordance with the purpose and for the period stated in the consent, or until the consent is withdrawn. Please note that the withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

Rights of Data Subjects

Under the conditions laid down by legal regulations, in particular Chapter III of the GDPR, you have:

• The right of access to all your personal data processed by the Controller, including the right to obtain confirmation from the Controller as to whether or not your personal data are being processed, and information on the purposes of processing, the categories of personal data concerned, the recipients to whom the personal data have been or will be disclosed, the envisaged period of processing, the existence of the right to request from the Company rectification or erasure of personal data concerning you or restriction of processing of your personal data, or to object to such processing, the right to lodge a complaint with a supervisory authority, any available information on the source of the personal data where they are not obtained from the data subject, whether automated decision-making, including profiling, takes place, and appropriate safeguards where data are transferred outside the EU.
• The right to rectification or erasure of personal data; you have the right to request rectification where inaccurate data are processed, or completion of incomplete personal data, and the right to request erasure where any of the grounds for erasure within the meaning of Article 17 GDPR apply, in particular where the data have been processed unlawfully.
• The right to restriction of processing within the meaning of Article 18 GDPR, in particular where an objection to processing has been raised and it has not yet been verified whether the Controller’s legitimate grounds override those of the data subjects.
• The right to data portability within the meaning of Article 20 GDPR, under which, subject to the conditions laid down, you have the right to transmit the personal data provided to another controller.
• The right to object to the processing of personal data with the Controller under the conditions laid down by legal regulations, in particular Article 21 GDPR.
• The right to withdraw consent at any time in writing, where personal data are processed on the basis of consent granted, i.e. by sending an e-mail or letter to the Controller, without any additional costs. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• The right to lodge a complaint with a supervisory authority, which in the Czech Republic is the Office for Personal Data Protection, if you believe that the processing of your personal data has infringed the GDPR.

If you have any doubts as to compliance with obligations related to the processing of your personal data, you may contact the Data Protection Officer whose contact details are given above, or lodge a complaint with the Office for Personal Data Protection.

Security of Personal Data

The Controller has implemented technical and organisational measures within the meaning of Article 32 GDPR that are necessary and at the same time appropriate to ensure that all processing is carried out in accordance with legal regulations, in particular the GDPR, and that the protection of the rights and freedoms of data subjects is ensured in connection with the processing of personal data. These measures consist in minimising the processing of personal data, carrying out pseudonymisation as quickly as possible, ensuring transparency, necessity and proportionality of the processing of personal data, and enabling the Controller to create and improve security features.

The Controller’s implemented technical and organisational measures are reviewed and updated as necessary.

Conclusion

These Principles become effective on 1 May 2023.

Please note that these Principles may be amended or updated. Any changes to these Principles shall become effective upon their publication on the Controller’s websites.