GDPR

INFORMATION CONCERNING PERSONAL DATA PROTECTION

(information memorandum on processing personal data of applicants for employment, potential, existing, and previous clients, contracting partners, sub-contractors, processing for marketing purposes and purposes of claims application)

IPS s.r.o., with registered seat at Sokolovská 668/136d, Karlín, 186 00 Praha 8, Identification number: 26466821, registered in the Company Register kept by the Municipal Court in Prague, Section C, File 84156 (hereafter referred to as the „Controller“ or „Company“), processes your personal data, i.e. for the purposes for which you granted our Company, as the Controller, consent to processing it, and/or for purposes based on other legal bases of personal data processing. This information memorandum provides more detailed information on processing your personal data such as information on your rights as the data subject as per the regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereafter referred to as the „GDPR“). Our Company is the Controller of your personal data, which means that our Company determined the purposes and means of processing your personal data.

1. OUR COMPANY CONTACT DATA

Business company: IPS s.r.o.

Address: Sokolovská 668/136d, Karlín, 186 00 Praha 8, the Czech Republic

Email: gdpr@ips-ag.com

Telephone: +420225990932

2. WHAT PERSONAL DATA WE PROCESS

2.1.  Common personal data: Our Company as the Controller processes such personal data that you provide for us by filling in an electronic form on our website of www.ips-ag.com, via e-mail, telephone, in writing or by other means, while namely the following personal data is concerned: name, surname, title, date of birth, identification number, address of residence, address of headquarters, e-mail, telephone number, state citizenship and bank account number, and, where applicable, photographs and videos.

2.2.  Special categories of personal data: Our Company as the Controller does not process special categories of personal data (sensitive data).

3. PURPOSES OF PERSONAL DATA PROCESSING (HOW WE TREAT YOUR PERSONAL DATA) AND LEGAL BASES OF SUCH PROCESSING

3.1.  Personal data for a specific purpose: Within the frame of our operations, i.e. upon provision of our services we process your personal data always for a specific, pre-determined purpose, while each purpose of processing requires only some of your personal data. That means that processing of specific personal data always depends on the given purpose, for which our Company processes the given personal data. On the other hand, if we are not provided the appropriate personal data required for the given purpose, our Company will not be able to provide you with the appropriate service or will only be able to provide it to a limited extent, which may effectively be undesirable for you.

3.2.  Purposes of processing and applicable legal basis: The legal basis for processing your personal data depends on the category of personal data being processed and on the purpose for which we process the given personal data. Your personal data is processed for the following purposes and on the basis of the

Purpose of processing:

Legal grounds of processing:

Employee recruitment (processing identification and contact data and qualification and/or professional data of applicants, in order to be able to include applicants in tenders and potentially offer them employment)

Processing personal data for the purpose of performance of a contract and within the steps prior to entering into a contract pursuant to the article 6 section 1 letter b) GDPR

Database of job applicants for potential future contact (processing identification and contact data and qualification and/or professional data of applicants, to be able to invite the given applicant, in case a suitable vacancy occurs in the future, to participate in a tender or offer employment)

Consent to the processing of personal data as per the article 6 section 1 letter a) GDPR

Marketing purposes (namely distribution of a newsletter, assessment of client satisfaction, distribution of offers and advertisements for products and services offered by our Company)

Consent to the processing of personal data pursuant to the article 6 section 1 letter a) GDPR

 

(in case you are our previous or current client while you have not grant our Company consent to personal data processing for marketing purposes, our Company processes such data for the given purpose, however, solely for direct marketing, based on legitimate interest as per the article 6 section 1 letter f) GDPR)

Company’s clients (processing personal data of clients for the purpose of preparing and entering into contractual documentation, which the client requires to enter into with our Company, and further for processing personal data of clients necessary for fulfilling the contract entered into by and between the client and our Company)

Processing personal data for the purpose of performance of a contract and within the steps prior to entering into a contract pursuant to the article 6 section 1 letter b) GDPR

Accounting purposes (processing personal data of Company business partners and subcontractors who are natural persons, including contact data of business partners and subcontractors, for the purpose of executing contractual and business rights and obligations)

Processing personal data for the purpose of performance of a contract and within the steps prior to entering into a contract pursuant to the article 6 section 1 letter b) GDPR

Exercise of legal claims (processing personal data for the purpose of exertion of legal claims of our Company in court, out-of-court, arbitration, administrative, distrainment, and insolvency proceedings)

Processing personal data on the basis of legitimate interest as per the article 6 section 1 letter f) GDPR

Identification and contact data (basic contact data of representatives of legal and other natural entities we acquire from public domain sources designated for that purpose, personally from such persons and from other persons)

Processing personal data on the basis of legitimate interest as per the article 6 section 1 letter f) GDPR

Presentation of the Controller and promotion of services provided by the Controller (processing of photographs and/or videos from work and non-work events organized by the Controller, but without further identification and other personal data associated with the photograph and/or video, for the purpose of presentation of the Controller or promotion of the services provided by the Controller through printed and/or electronic media, the Controller’s web sites and/or Controller’s social networks)

Consent to the processing of personal data as per the article 6 section 1 letter a) GDPR

3.3.  Processing personal data on the basis of legitimate interest: GDPR enables our Company as the Controller processing personal data even without our Company being granted consent to processing such personal data or our Company processing personal data on the basis of other legal bases such as performance of a contract or fulfilment of obligations as per a special law. Pursuant to article 6 section 1 letter f) of the GDPR, our Company is entitled to process personal data also on the basis of legitimate interest.

3.4.  Specific purposes of processing on the basis of legitimate interest: You are entitled to raise objections against personal data processing on the basis of legitimate interest as per the article 6 section 1 letter f) GDPR, while details on the said right are stated also in the item 6.1.6 below. Should you apply the right to rise objections against a specific type of processing, our Company is not entitled to continue processing the personal data, unless it proves necessary legitimate reasons for such processing, which outweigh your interests, rights, and freedoms, or unless it proves that the reason for personal data processing is proving, applying, and/or defending its rightful claims.

3.4.1. Legitimate interest for marketing purposes: The legitimate interest of our Company in processing your personal data (namely title, name, surname, residence and e-mail) for marketing purposes (distribution of a newsletter, distribution of offers and advertisements for products offered by our Company to our clients) consists in enabling our Company’s development and growth through promoting our Company’s services and products, while our experience evidences that clients who utilised our services and products appreciated our attitude and professionalism, while overall satisfaction of clients with the employees and partners of our Company is apparent. Given the sphere and segment, in which our Company operates, processing personal data by our Company for the purpose of promotion of our Company is an inseparable means of acquiring business opportunities with clients and customers who are satisfied with our services. Given our individual approach, our Company strives for processing, within the frame of the said marketing purposes, solely basic contact personal data of data subject who voluntarily provided such personal data for us and who are our clients.

3.4.2.  Legitimate interest in enforcing legal claims: A legitimate interest of our Company in processing your personal data for the purpose of enforcing legal claims of our Company consists our Company needing to process appropriate personal data of data subjects in order to effectively and in accordance with applicable legal regulations apply its legal claims in court, out-of-court, arbitration, distrainment, and insolvency proceedings.

3.4.3.   Identification and contact data: Numerous representatives of legal entities as well as other natural persons provide our Company with their identification and contact data within the frame of business communication and/or with an outlook of future co-operation. Similarly, our Company processes personal data of data subjects whose identification and contact data is made public by and/or provided by other entities for the purpose of potential business co-operation with our Company and/or companies operating within a similar business segment as our Company, i.e. within a similar business segment as our partners and clients. Our Company has a legitimate interest in processing such personal data as it is directly related to development and operation of our Company’s main business activities.

4. RECIPIENTS AND PERSONAL DATA RECIPIENT CATEGORIES

4.1. List of personal data recipients: Your personal data may be provided for the following recipients:

4.1.1. collaborators of our Company who are not employees and who secure operation of our Company and provision of our Company’s services;

4.1.2. employees of our Company;

4.1.3. marketing and PR agencies for the purpose of promoting services and products provided by our Company;

4.1.4. insurance companies, their agents, and brokers (in case the clients requires that in relation to our services and/or products provided by our Company insurance services be provided as well);

4.1.5. providers of IT services who secure for our Company full IT services and infrastructure including a website;

4.1.6. members of the Company.

4.2. State administration bodies and other third parties: Your personal data can be provided also for any appropriate body operating within the frame of penal proceedings, prosecution, court, regulator, supervision and control bodies, government agency, distrainment officer, insolvency administrator or another third party on condition our Company believes such provision of personal data to be:

4.2.1. in accordance with generally applicable legal regulations or the GDPR; or

4.2.2. necessary for the purpose of exercise, establishment or defence of a legal right or claim of our Company; or

4.2.3. necessary for the purpose of protecting vital interests of our Company or vital interests of any other party.

4.3. Other entities: We may also provide your personal data for buyers and/or potential buyers (and their representatives and advisors) in relation to any reorganisation, restructuring, merger, and/or sale and/or another transfer of our Company’s assets on condition we inform the recipient that they are obligated to use your personal data only for the purposes stated in this information memorandum.

4.4. Provision of personal data as requested by data subjects: We may also provide your personal data for other recipients, provided you grant our Company your consent of such provision of personal data or request our Company to provide such personal data of yours.

5. PERIOD OF PERSONAL DATA ARCHIVING

5.1. Your personal data shall be archived no longer than for the period necessary for the purpose for which our Company processes your personal data; however, that does not apply if a generally applicable legal regulation permits or requires that we archive the given personal data for a longer period.

5.2. We archive individual sets of your personal data for the following periods:

Purpose

Period of archiving

Employee recruitment

For the period of tender duration, i.e. up to the moment the given job applicant rejects an employment offer or our Company decides not to make an employment offer to the given applicant

Database of job applicants for the purpose of potential future contact

For the period of consent validity (3 years), i.e. up to the moment of consent repeal

Marketing purposes

For the period of consent validity (3 years), or up to the moment of consent repeal

 

In case of processing personal data on the basis of a legitimate interest for a period necessary for fulfilling the processing purpose, however, no longer than 5 years

Company clients

For the period of validity of the legal basis as per the article 6 section 1 letter b) GDPR (performance of a contract) and consequently for 5 years for the purpose of archiving as per a special law

Accounting purposes

For the period of validity of the legal basis as per the article 6 section 1 letter b) GDPR (performance of a contract) and consequently for 5 years for the purpose of archiving as per a special law

Exercise of legal claims

For the period necessary for exercise of rights and claims of our Company, at least for the period of lapse of time duration as per the Civil Code, however, no longer than the period of 10 years from termination of the underlying legal agreement (e.g. from cancellation and/or fulfilment of contract). In case court or administrative proceedings is initiated, our Company shall process your personal data for the necessary period for which the given court or administrative proceedings lasts.

Identification and contact data

For the period necessary for establishing contact with the said persons, however, no longer than 5 years from acquisition thereof

Presentation of the Controller and promotion of services provided by the Controller

For the period of consent validity (5 years), or up to the moment of consent repeal

6. YOUR RIGHTS AS THOSE OF A DATA SUBJECT IN RELATION TO PROCESSING YOUR PERSONAL DATA

6.1.  Individual rights of data subjects: As well as our Company has its rights and obligations in relation to personal data protection, you also have rights in relation to protection of your personal data (personal data concerning you). The following rights are concerned:

6.1.1. Right to access to personal data: You are entitled to acquire from our Company a confirmation of whether or not our Company processes your personal data, what personal data it processes, for what purposes, what the period of archiving such data is, where our Company acquired such data from, for whom our Company provides such data, who else, apart from our Company, processes the given personal data, and how automated decision-making including profiling upon processing your personal data takes place, and what other rights you have in relation to processing of your personal data. All of the information stated is provided within this information memorandum, however, should you not be sure about whether or not or what personal data of yours and/or how our Company processes, you are entitled to access such information. Within the frame of the said right of access, you can ask our Company for a copy of the personal data processed, while our Company shall send you the first copy for free and further copies provided shall be subject to a fee appropriate to administrative costs involved.

6.1.2. Right to rectification: Should you find that our Company processes your data that is imprecise, incorrect or incomplete, you are entitled to have our Company rectify and/or amend such personal data.

6.1.3. Right for erasure (right to be forgotten): In the following cases, you are entitled to have the personal data processed by our Company erased without any undue delay:

6.1.3.1. your personal data is no longer required for the purposes for which our Company acquired or otherwise processed it; or

6.1.3.2. you repealed consent to processing your personal data, while processing of such personal data was conditioned by your consent, and simultaneously our Company has no other reason or legal bases for processing of such personal data (e.g. for the purpose of exercise of rights and claims by our Company); or

6.1.3.3. you apply your right to raise objections to processing of your personal data (more details on the appropriate right stated in the item 6.1.6 below), which our Company processes on the basis of legitimate interest and our Company determines that it does not have any other legitimate interests, which would entitle our Company for further processing of such personal data; or

6.1.3.4. our Company processes your personal data illegally; or

6.1.3.5. in order to fulfil a legal obligation stipulated in a generally applicable legal regulation, which applies to our Company; or

6.1.3.6. personal data is acquired in relation to offer of services by an information company addressed directly to a child.

Simultaneously, it is necessary to inform you that even though any of the above-stated cases is concerned, our Company is not obligated to erase your personal data (personal data concerning you) provided its processing is necessary:

6.1.3.7. for the purpose of exercise of the right to freedom of expression and to information; or

6.1.3.8. for the purpose of fulfilling a legal obligation of our Company as per a generally applicable legal regulation; or

6.1.3.9. for the purpose of archiving, scientific and/or historical purposes and/or for statistical purposes; or

6.1.3.10. for the purpose of proving, exercise and/or defending legal claims of our Company.

6.1.4. Right to restriction of processing: In certain cases, apart from the right to erasure, you are also entitled to restriction of processing of your personal data, through which you can claim in specific cases to have your personal data identified and keep such personal data from being subject to any further processing operations for a certain period of time. Our Company is obligate to restrict processing of your personal data in case

6.1.4.1. you question correctness of the personal data, i.e. during a period enabling our Company to verify personal data correctness; or

6.1.4.2. processing of your personal data is illegal and you disagree to erasure of such personal data and instead claim restriction of its use; or

6.1.4.3. our Company does not need your personal data anymore for the purpose of processing, but you need the personal data to prove, apply, and/or defend your legal claims; or

6.1.4.4. you use your right to raise an objection to processing of your personal data (more details on the given right are provided in the item 6.1.6 below), i.e. until verification, or rightful reasons on the part of our Company surmount your rightful reasons.

In case processing of your personal data was restricted based on this right to restriction of processing, such personal data, except for archiving, can be processed by our Company only based on your consent or for the purpose of proving, exercise, and/or defending legal claims of our Company, or for the purpose of protecting rights of another natural person or legal entity, or for the reason of an important public interest of a state that is an European Union member or a contracting party to the European Economic Area Treaty.

6.1.5. Right to data portability: You are entitled to acquire all your personal data you provided for our Company on condition our Company processes such data on the basis of personal data processing consent or on the basis of performance of a contract, while it is solely such personal data that our Company processes using automated means (electronically) that must be concerned. We shall provide your personal data for you in a structured, commonly used and machine-readable format, while you are entitled to transfer such personal data directly to another controller if technically viable.

6.1.6. Right to raise objection: You are entitled to raise an objection to processing of your personal data, which is executed on the basis of a public interest or legitimate interest, including an objection to profiling, which is based on a legitimate interest. Our Company shall not process your personal data any further unless it proves necessary rightful reasons for processing thereof, which outweigh your interests, rights and freedoms, or unless our Company evidences reasons for proving, exercising and/or defending its legal claims.

If our Company processes your personal data for direct marketing purposes, you are entitled to anytime raise an objection to processing of such personal data for the purpose of such marketing, including profiling to the extent in which it is related to such direct marketing. Should you raise an objection to processing of your personal data for the purpose of direct marketing, our Company shall not process such personal data for such purpose any longer.

6.1.7. Method of rights exercise: You can exercise the above-stated rights through the contact data of our Company, which is stated in the item 1 above.

6.1.8. Right to file a complaint with the Office: In order to apply the above-stated rights, you can also file a complaint with the Office for Personal Data Protection regarding processing of your personal data by our Company. Headquarters of the Office for Personal Data Protection are at the address of Pplk. Sochora 727/27, 170 00 Praha 7 – Holešovice, the Czech Republic, while other information is available at the website of: https://www.uoou.cz/

7. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS

7.1.  The Controller shall not transfer your personal data to third countries (countries that are not members of the European Union or a contracting party to the European Economic Area Agreement) or international organisations, unless

7.1.1. The European Commission decided that such a third country, a territory or one or more specified sectors within such a third country, or such an international organisation ensures an adequate level of protection,

7.1.2. the Company provides suitable guarantees, and on condition enforceable rights of data subjects and effective legal protection of data subjects are available.

8. RIGHT TO REPEAL CONSENT OF PERSONAL DATA PROCESSING AT ANY TIME

8.1. In case you granted our Company your consent to the processing of some of your personal data (the legal basis for processing of some of your personal data by our Company is an consent or an explicit consent), you are entitled to repeal such an consent at any time, i.e. through contact data of our Company stated in the item 1 above. Repealing an consent has no impact on lawfulness of processing based on an consent before it is repealed.

9. CHANGES TO THIS INFORMATION MEMORANDUM

9.1. This information memorandum on personal data protection can be updated on an on-going basis following changes to legal, technical and/or business development. Upon updating this information memorandum on personal data protection we shall take suitable measures to inform you of such changes, depending on significance of the changes made. Equally, we shall ask you for consent to any significant changes to this information memorandum on personal data protection in case it is required by generally applicable regulations concerning personal data protection.