Skip to main content

Privacy Policy

Last updated 22 February 2022

Information on the Processing of Personal Data

Dear Customers and Business Partners,

This document contains basic information on how we process your personal data.

In view of new European Union legislation, this text has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR).

For maximum clarity, this text is organized in a question-and-answer format.

Information is presented in the following order:

  1. Who is the personal data controller?
  2. For what purpose do we need personal data?
  3. What are our legitimate interests?
  4. How was the personal data obtained?
  5. What categories of personal data are processed?
  6. What is the legal basis for processing personal data?
  7. Will we transfer personal data to anyone else?
  8. Will we transfer personal data to a third country or international organization?
  9. How long will we store personal data?
  10. What are your rights related to the processing of personal data, and how can you exercise them?
    • 10.1 Right to information about the processing of your personal data.
    • 10.2 Right of access to personal data.
    • 10.3 Right to rectification.
    • 10.4 Right to erasure (right to be forgotten).
    • 10.5 Right to restriction of processing.
    • 10.6 Right to data portability.
    • 10.7 Right to object and automated individual decision-making.
    • 10.8 Right to file a complaint with the Office for Personal Data Protection.
    • 10.9 Right to withdraw consent.
  11. Is personal data evaluated automatically?
  12. The company reserves the right to update this document.

We present to you the basic information that we, as a personal data controller, are required to provide.

If you have any questions regarding the processing of your personal data, please do not hesitate to contact us using the following contact information: Ing. Miroslav Ulrich, email: gdpr@czech-gen.cz.

1. Who is the personal data controller?

The controller is the entity that alone or jointly with others determines the purposes and decides how personal data will be processed.

The personal data controller is FARMAK, a.s. The controller can be contacted at the email address gdpr@czech-gen.cz.

2. For what purpose do we need personal data?

The controller processes personal data for:

  • ensuring the conclusion and subsequent performance of contractual obligations between the controller and you (Art. 6(1)(b) GDPR). Additional statutory obligations arise from such a relationship, and the controller must therefore process personal data for this purpose as well (Art. 6(1)(c) GDPR);
  • protecting its legitimate interests (Art. 6(1)(f) GDPR), which include offering products and services.

Providing personal data to the controller is generally a legal and contractual requirement. Regarding the provision of personal data for potential marketing purposes, which does not constitute the fulfillment of a contractual or statutory obligation of the controller, your consent is required. If you do not grant consent to the processing of personal data for marketing purposes, it does not mean that the controller will refuse to provide its product or service under a contract as a result.

3. What are our legitimate interests?

The controller also processes personal data to protect its legitimate interests. The controller's legitimate interests primarily include the proper performance of all contractual obligations, the proper fulfillment of all legal obligations, direct marketing, the protection of the controller's business and assets, and last but not least, environmental protection and ensuring sustainable development.

In order to ensure maximum protection of your privacy, you have the right to object to your personal data being processed solely for essential legal reasons or to have your personal data blocked. You can read more about your rights related to personal data processing in Section 10 of this text.

4. How was the personal data obtained?

The controller obtained personal data directly from you, primarily from completed forms, mutual communication, or concluded contracts.

In addition, personal data may also originate from publicly available sources, registers, and records, such as the Commercial Register, the Debtors' Register, professional registers, or the Real Estate Register.

Furthermore, the controller may have obtained personal data from third parties authorized to access and process your personal data with whom it cooperates, as well as from information on social networks and the internet that you posted yourself.

5. What categories of personal data are processed?

To ensure your satisfaction with the proper performance of obligations, to ensure fulfillment of statutory duties, to provide personalized offers of goods and services of the controller, and for the other purposes listed above, the controller processes the following categories of personal data:

  • basic identification data: first name and last name;
  • contact data: phone number and email address;
  • billing data: address, bank account details, etc.

For employees (or job applicants), the Controller may process the following categories of personal data:

  • Identification and contact data: first name, last name, date and place of birth, marital status, personal identification number, title, nationality, address, phone number, signature, etc.;
  • Descriptive data: education, foreign language skills, professional qualifications, knowledge and skills, number of children, portrait photograph, military service, previous employment, health insurance company, membership in interest organizations, criminal record check, etc.;
  • Economic data: bank details, salary, executions/foreclosures, taxes, etc.;
  • Employment data: job classification and position, records of work and work activities, workplace, job evaluations, awards, etc.;
  • Operational and location data: typically data from electronic systems related to a specific data subject, e.g., electronic communication data, use of company phone, CCTV footage, etc.;
  • Data on data subject activities: data on attendance at trade fairs and conferences, project involvement, business travel details, etc.;
  • Data on third parties: address and identification data of a family member, spouse, child, partner, etc.;
  • Special categories of personal data: (sensitive personal data capturing information about health status, etc.).

6. What is the legal basis for processing personal data?

The lawfulness of processing is defined by Article 6(1) of the GDPR, according to which processing is lawful if it is necessary for the performance of a contract, for compliance with a legal obligation of the controller, for the protection of the controller's legitimate interests, or if processing takes place based on the consent you have granted us.

7. Will we transfer personal data to anyone else?

Our employees have access to your personal data, and where necessary, so do our associates and partner companies, specifically:

  • software providers: ALTEC a.s., ESKON s.r.o.
  • Consulting and external trainers: Brokl Consulting s.r.o.
  • Catering services: CZECH-GEN GASTRO s.r.o.
  • Other service providers: NZ SERVIS, spol. s r. o.

We have a contract concluded with all these partners and companies that obligates them to handle the transferred personal data as required by the GDPR and only to the extent necessary.

Within our statutory obligations, we must also provide personal data to state administration authorities, such as tax administrators, courts, law enforcement agencies, or capital market supervisory authorities.

8. Will we transfer personal data to a third country or international organization?

We will not transfer personal data to countries outside the European Union or the European Economic Area.

9. How long will we store personal data?

Personal data will be processed and stored at least for the duration of the contract. Certain personal data required, for example, for tax and billing obligations, will be retained longer, generally 10 years starting from the year following the occurrence of the stored fact, but the controller will always retain it in accordance with the internal document "Filing and Retention Rules" (Spisový a skartační řád), which we will provide to you upon request.

Personal data important for exercising the legitimate interests of the controller will generally be stored for 5 years from the end of the contractual relationship with the controller, but the controller will always retain it in accordance with the internal document "Filing and Retention Rules", which we will provide to you upon request.

Personal data will never be stored longer than the maximum period permitted by law. After the expiration of the archiving period, which complies with the internal document "Filing and Retention Rules" provided upon request, personal data will be safely and irreversibly destroyed so that it cannot be misused.

10. What are your rights related to the processing of personal data, and how can you exercise them?

The controller strives to ensure that the processing of your data is carried out properly and, above all, securely. You are guaranteed the rights described in this article, which you can exercise with the controller.

You can exercise individual rights by sending an email to gdpr@czech-gen.cz. You can also exercise your rights via a written request sent to our correspondence address or to our data box (datová schránka).

All communications and statements regarding your exercised rights are provided by the controller free of charge. However, if a request is manifestly unfounded or excessive, particularly because it is repetitive, the controller is entitled to charge a reasonable fee reflecting the administrative costs associated with providing the requested information. In the event of repeated requests for copies of processed personal data, the controller reserves the right to charge a reasonable administrative fee for this reason.

The controller will provide you with a response and, where applicable, information on measures taken as soon as possible, but no later than within one month. The controller is entitled to extend this period by two months if necessary, taking into account the complexity and number of requests. The controller will inform you of any extension, including the reasons for it.

10.1 Right to information about the processing of your personal data

You are entitled to request information from the controller as to whether personal data is being processed or not. If personal data is processed, you have the right to request information, particularly regarding the identity and contact details of the controller, its representative, and, if applicable, the data protection officer (DPO), the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients of personal data, authorized controllers, the list of your rights, the option to contact the Office for Personal Data Protection, the source of processed personal data, and automated decision-making and profiling.

If the controller intends to further process your personal data for a purpose other than that for which it was obtained, it will provide you with information about this other purpose and other relevant information prior to such further processing.

The information provided to you within the scope of exercising this right is already contained in this text. However, this does not prevent you from requesting it again.

10.2 Right of access to personal data

You are entitled to request information from the controller as to whether your personal data is being processed, and if so, you have access to information regarding the purposes of processing, categories of personal data concerned, recipients or categories of recipients, retention period of personal data, information about your rights (rights to request rectification or erasure from the controller, restriction of processing, objection to such processing), the right to lodge a complaint with the Office for Personal Data Protection, information on the source of personal data, information on whether automated decision-making and profiling take place, information regarding the procedure used, as well as the significance and envisaged consequences of such processing for you, and information and guarantees in the case of personal data transfers to a third country or international organization. You have the right to receive copies of the processed personal data. However, the right to obtain this copy must not adversely affect the rights and freedoms of others.

10.3 Right to rectification

If, for example, your residence, phone number, or any other fact considered personal data changes on your side, you have the right to request the controller to rectify the processed personal data. In addition, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

10.4 Right to erasure (right to be forgotten)

In certain specified cases, you have the right to request that the controller erase your personal data. Such cases include, for example, situations where the processed data is no longer necessary for the purposes mentioned above. The controller automatically erases personal data once it is no longer necessary, but you may contact the controller with your request at any time. Your request is then subject to individual assessment (despite your right to erasure, the controller may have an obligation or legitimate interest to retain your personal data), and you will be informed in detail about its resolution.

10.5 Right to restriction of processing

The controller processes your personal data only to the extent strictly necessary. However, if you feel that the controller is, for example, exceeding the above purposes for which personal data is processed, you may submit a request that your personal data be processed solely for essential legal reasons or that the personal data be blocked. Your request is subject to individual assessment, and you will be informed in detail about its resolution.

10.6 Right to data portability

If you wish the controller to provide your personal data to another controller or company, the controller will transfer your personal data in an appropriate format to the entity specified by you, provided there are no legal or other significant obstacles preventing it.

10.7 Right to object and automated individual decision-making

If you discover or suspect that the controller is processing personal data in violation of the protection of your private and personal life or in violation of legal regulations (provided that the personal data is processed by the controller based on public or legitimate interest, or for direct marketing purposes, including profiling, or for statistical purposes, or for scientific or historical research purposes), you may contact the controller and request an explanation or the elimination of the resulting improper state.

If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.

You may also object directly to automated decision-making and profiling.

10.8 Right to file a complaint with the Office for Personal Data Protection

You may at any time contact the supervisory authority with your initiative or complaint regarding personal data processing, namely the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), located at Pplk. Sochora 27, 170 00 Prague 7, website: https://www.uoou.cz/.

10.9 Right to withdraw consent

You have the right to withdraw your consent to personal data processing at any time by sending a withdrawal to the registered office address of the controller.

11. Is personal data evaluated automatically?

Personal data is not evaluated automatically and therefore cannot be used for profiling or automated decision-making in the controller's marketing activities.

12. The company reserves the right to update this document

The company reserves the right to update the wording of the "Information on the Processing of Personal Data" document, and previous versions can be provided upon request.

In Olomouc, May 25, 2018

‍