Information on Personal Data Processing
In compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “Regulation”), we would like to inform you about personal data processing.
1. Our contact details for matters related to personal data protection
1.1. Our company, ExTech s.r.o., acts as a so-called personal data controller. If you have any questions, requests or objections related to personal data processing, do not hesitate to contact us on the contact details provided below:
Contact details for written communication:
285 63 Tupadly
Contact details for electronic communication:
1.2. Our company has no data protection officer.
2. When do we process your personal data?
2.1. Your personal data can be processed in the following cases:
2.1.1 if you are a visitor to our website,
2.1.2 if you are our business partner – a self-employed person,
2.1.3 if you are employees of our business partners, in which case your personal data is disclosed to us by your employer who informed you of such data processing.
3. Legal basis for personal data processing, method and purpose of processing, storage period
We are entitled to process your personal data even without your consent:
- within the scope necessary for the discharge of our obligations arising from a contract,
- within the scope necessary for the discharge of a legal duty imposed on us by a legal regulation, e.g. law,
- within the scope necessary for the purposes of our legitimate interests.
Hereunder, detailed information on individual legal bases for personal data processing are explained:
3.1. Processing for the purpose of a contract that you have concluded with us as our business partner
3.1.1 We process personal data to be able to conclude with you – a self-employed person – a contract (Art. 6, paragraph 1, point b) of the Regulation). In this way we process your identification data (name, surname) and data related to your address (such as address of residence, or a different postal address, e-mail address, telephone number), or any other descriptors if you disclose such data in the contract or related communication (academic degree).
3.1.2 The purpose of the processing of personal data is the conclusion of the contract and the subsequent discharge of our obligations arising from the contract or payment for services or goods delivered by you.
3.1.3 The storage period: Over the period required for the discharge of your obligations arising from the respective contract.
3.2. Processing within the scope necessary for the discharge of a legal duty imposed on us by a legal regulation
3.2.1 In addition, we process your personal data as it is required for the discharge of legal duties imposed on us (Art. 6, paragraph 1, point c) of the Regulation).
3.2.2 We issue and receive tax documents that we are required to retain and archive for a period imposed by legal regulations, in particular by the Accountancy Act (Act No. 563/1991 Coll.) and Value Added Tax Act (Act No. 235/2004 Coll.). Further duties can possibly arise from other legal regulations.
3.2.3 The purpose of the processing of your personal data is the discharge of our legal duties imposed by accounting and tax regulations.
3.2.4 The storage period: We only retain personal data for a necessary period and archive it over statutory time limits imposed on us by legal regulations.
3.3. Processing necessary for the purpose of conclusion and fulfilment of a contract with your employer or other person you are representing
3.3.1 We process your personal data also to have a possibility to conclude a contract with a contractual partner you are representing (mainly as a member of the statutory body of a legal entity, as its employee or business agent) and to communicate therewith within the discharge of a concluded contract, eventually from other legal reasons, which must be disclosed to you.
3.3.2 The purpose of processing – the above-mentioned processing is necessary for the purpose of our legitimate interests, consisting of the interest in conclusion and discharge of the contract concluded with a contractual partner and in ensuring the necessary communication with such partner (Art. 6 paragraph 1 point f) of the Regulation).
3.3.3 The storage period – your personal data processed for the above-mentioned purpose are being processed for the term of duration of contract concluded with the relevant contractual partner, eventually for the term during which you represent such partner. Further processing of these personal data in cases, when a relevant law requires so and for the term required by such law, is not affected.
3.4. Processing necessary for the purposes required by our other legitimate interests
3.4.1 Our web server setting includes so-called logging, within the framework of which logs concerning errors and also requests for access upon any required loading of the website or different content are automatically recorded. IP addresses are logged in this manner as well. This standard procedure is necessary for the correct operation of the web server and therefore it concerns processing required by our legitimate interests (Art. 6, paragraph 1, point f) of the Regulation).
3.4.2 The purpose of the processing – logging of accesses to the web server, including IP addresses – is to ensure diagnostics and proper operation of the web server, removal of errors and detecting and eliminating possible attacks on the web server (such as DDoS attacks or attempts to detect the server vulnerability via robots). We partly anonymize IP addresses and evaluate full IP addresses only when dealing with the web server operation problems or a third-party attack.
3.4.3 The storage period: The logs are stored on a temporary basis and are permanently erased no later than in 90 days.
3.5. Cookies and data concerning the website visits
3.5.1 To get information on the visit rate of our website www.quantretail.com, we use the Google Analytics service, but within the framework of this service, we apply the anonymization of IP addresses. This means that we do not process any personal data of visitors to our website.
3.6. Social networking plugin
3.6.1 At www.quantretail.com, we use so-called plugins of social networks Facebook, LinkedIn, Pinterest and Twitter. These are the buttons through which you can share a link to a specific article on your selected social network:
3.6.2. The placement of the plugin on the website is not a technical means of monitoring, the plugin does not make any contact with your browser, does not determine the IP address, etc. In this context, we do not collect or process any personal data.
3.6.3. However, if you decide to share an article and click on the plugin, you will be redirected to the website of the relevant social network operator with whom you have entered into a separate contractual relationship during registration and user account creation. In such a case, your personal data will probably be processed by the social network operator, we have no control over such processing of personal data and we do not participate in it in any way.
4. Where we process and to whom we disclose your personal data?
4.1. We process personal data in the Czech Republic, or in EU Member States where necessary.
4.2. We usually do not disclose your personal data to any third parties, i.e. personal data recipients, unless it is required for the fulfilment of the purpose of the contract that we concluded with our business partners, or where necessary for the discharge of our duties imposed by legal regulations.
4.3. Personal data recipients may refer to suppliers, insurance companies, external legal representatives, tax authorities, tax advisers and auditors.
5. Your rights related to your personal data processing
5.1. We process your personal data in a correct and transparent way, in compliance with legal regulations. Your rights applicable in relation to your personal data processing are explained below.
5.2. Right to access your personal data and have it rectified
5.2.1 You have the right to access your personal data concerning you as the data subject, specifically under conditions provided in Article 15 of the Regulation.
5.2.2 If you believe that the personal data that we process in relation to your person is inaccurate or incomplete, you are authorized to request for rectification or completion thereof.
5.3. Rights to erasure (“right to be forgotten”), right to restrict processing
5.3.1 You are authorized to request that we erase your personal data concerning your person without any undue delay, but only for some of the reasons specified in Art. 17 of the Regulation.
5.3.2 You are authorized to require a restriction of processing, namely in any case specified in Art. 18 of the Regulation.
5.4. Right to personal data portability
5.4.1 You are authorized to acquire your personal data, processed on the basis of your consent or for the purpose of a contract that you have concluded with us (Art. 3.1.) in a structured, commonly used and machine-readable format, and where required, to hand over such data to a third party without us preventing you from doing it.
5.4.2 In addition, you have the right to request that we hand over your personal data to a third party acting as the personal data controller, provided that this is technically feasible.
5.5. Right to withdraw your consent to personal data processing
5.5.1 If you have provided us with your consent to personal data processing for purposes requiring such consent, you are authorized to withdraw such consent at any time. The lawfulness of processing based on consent given prior to its withdrawal is not affected by such withdrawal.
5.6. Right to object to personal data processing concerning you
5.6.1 You are authorized to object to the processing of your personal data processed on the basis of Art. 6, paragraph 1, point f) of the Regulation, i.e. for the purposes of our legitimate interests; our legitimate interests are forming a legal ground of the processing for the purposes of the web server (see Art. 3.3).
5.7. Right to file a complaint with a supervisory authority
5.7.1 You are authorized to file a complaint with a supervisory authority, namely in case when you believe that personal data processing breaches legal regulations. Such a complaint may be filed with the supervisory authority, being:
(Czech) Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27
170 00 Prague
5.8. How to exercise these rights of yours?
5.8.1 You may exercise your rights to personal data protection either in writing or by e-mail, namely at the contact details provided in Art. 1 above. We would like to inform you that where in doubts we are authorized to verify the identification of the person who submitted such request or objection. The rights as per Art. 5 may not be exercised over the telephone.