Information on Personal Data Processing
The company ANITA B s.r.o., with its registered office at Průmyslová 2453/7, 680 01 Boskovice, Czech Republic, Company ID (IČO): 255 84 448, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 35619 (hereinafter referred to as the "Company"), hereby provides information on the purpose, scope, and duration of the management and processing of personal data within the Company, as well as on the rights pertaining to data subjects in this connection.
1. Legislative Framework of Personal Data Protection
Rights and obligations relating to personal data are governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the "GDPR").
2. Definition of Terms
Personal Data means any information relating to an identified or identifiable natural person.
Data Subject means the natural person to whom the personal data relates.
Controller of personal data is the Company. The Controller determines the purposes and means of the processing of personal data.
Processing of personal data means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, etc. – in short, any handling of provided personal data by the controller.
Processor of personal data is an entity/individual that processes personal data on behalf of and according to the instructions of the Company on the basis of a contract.
3. Processed Personal Data
The Company collects and processes the following personal data:
- identifying personal data (first name, surname, maiden name, residential address, date of birth, email address, telephone number, etc.);
- information on the conclusion or non-conclusion of a contract / entry into a business relationship between the data subject and the Company;
- identifying information of children obtained based on the consent of a parent or other legal representative authorized to act on behalf of the child;
- personal data obtained or to be obtained by the Company in connection with the performance or non-performance of an agreed contract / course of a business relationship with the data subject (including data submitted via contact and inquiry forms).
The Company strictly does not collect or process special categories of personal data (sensitive data) as defined in Article 9 of the GDPR, with the exception of children's personal data.
4. Period of Personal Data Processing
The Company processes personal data for the duration of the contractual/business relationship to which the personal data relates and subsequently for the period necessary for managing the contract/business relationship, but no longer than 3 years from the termination of the last contract/business relationship.
The above time limitation does not apply to situations where a specific retention period is stipulated by statutory law, compliance with which is the reason or one of the reasons for processing personal data.
5. Purposes of Personal Data Processing
The Company processes personal data for the following purposes:
- handling inquiries, questions, and messages submitted via website forms;
- identification of contractual/business partners or persons associated with these entities (e.g. statutory representatives, contact persons, etc.);
- exercising rights and fulfilling obligations arising from contracts between the Company and data subjects;
- marketing purposes of the Company, including sending newsletters and utilizing external marketing services;
- administration of contracts and business relationships by the Company, including processing warranty claims and complaints.
6. Rights of Data Subjects
Under Articles 15 to 22 of the GDPR, data subjects have the following rights, which may be exercised in writing (including by email to info@garudan.cz) upon meeting statutory requirements:
- right of access to personal data,
- right to rectification of inaccurate or incomplete personal data,
- right to erasure of personal data ("right to be forgotten"),
- right to restriction of processing,
- right to data portability,
- right to object to processing, and
- right not to be subject to automated individual decision-making, including profiling.
If the Company breaches its obligations as a data controller, the data subject has the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz).
7. Consent to Personal Data Processing
The Company generally obtains and processes personal data only for purposes where prior consent of the data subject is not required under the GDPR.
If the Company intends to process personal data in a manner for which consent is required, it will obtain consent prior to commencing such processing.
Consent to personal data processing may be revoked by the data subject at any time, and the Company is obligated to terminate processing for which consent was revoked. Revocation of consent does not affect the legality of processing carried out prior to its revocation, nor does it affect processing that does not require consent under the GDPR or is required by applicable law.
8. Personal Data Processors
The Company may disclose personal data to contracted processors/service providers (IT and hosting providers, accounting and marketing agencies, shipping carriers). The current list of processors is available in a separate document on the page Personal Data Processors.
9. Publication of Information
Current information regarding personal data processing by the Company is available on the Company's websites (https://www.garudan.eu/information-on-the-processing-of-personal-data and https://eshop.garudan.cz/dokument/informace-o-zpracovani-osobnich-udaju/).