Praguekabinet, i.e. PhDr. Gabriela Pecićová, ID No. 71504770, place of business 130 00 Prague - Žižkov, Řehořova 973/7, operating a brick-and-mortar shop under the name Praguekabinet, at 110 00 Prague 1, Platnéřská 13, and also the Internet shop www.praguekabinet.com, as the personal data controller, hereby provides information regarding the manner and scope of personal data processing, including the scope of personal rights of the data subject related to the processing of their data by Praguekabinet.
Praguekabinet processes personal data in accordance with European Union law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive Q5/46/EC (General Data Protection Regulation; hereinafter referred to as "GDPR"), as well as in accordance with international treaties to which the Czech Republic is bound, in particular in accordance with the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data No. 108, promulgated under No. 115/2001 Coll. of Int. Treaties, and in accordance with relevant national legislation.
Definitions of the terms used:
1. personal data – personal data is any information relating to an identified or identifiable data subject; a data subject is deemed to be identified or identifiable if the data subject can be directly or indirectly identified;
2. data subject – a data subject is a natural person to whom the personal data relates;
3. data controller – a data controller is any entity that determines the purpose and means of personal data processing, carries out the processing and is responsible for it;
4. data processor – a data processor is any entity which, on the basis of a specific law or by virtue of a mandate from the data controller, processes personal data pursuant to this Act;
5. recipient – a recipient is any entity to whom personal data is disclosed;
6. personal data processing – the processing of personal data is any operation or set of operations which the data controller or data processor carries out systematically with personal data, whether by automated means or by other means; the processing of personal data includes, in particular, the collection, storage on a storage medium, disclosure, adaptation or alteration, retrieval, use, transmission, dissemination, publication, retention, exchange, sorting or combining, blocking and liquidation;
7. public records – for the purposes of this document, a public record is (i) the public register pursuant to Act No. 304/2013 Coll., on Public Registers of Legal Entities and Individuals, as amended, i.e. the Federal Register, the Foundation Register, the Register of Institutions, the Register of Unit Owners' Associations, the Commercial Register and the Register of General Benefit Companies; (ii) and other registers within the meaning of Act No. 111/2009 Coll., on Basic Registers, as amended.
Purpose and scope of personal data processing:
Praguekabinet only processes accurate personal data that it has obtained in accordance with the GDPR, whereby Praguekabinet collects and processes this personal data only for the stated purpose, within the scope specified below, for the duration of the contractual relationship and subsequently for three years after its termination or for a period of one year if no contract is concluded.
Basic purposes of personal data processing:
• performance of a purchase contract with the data subject [Article 6(1)(b) of the GDPR] - e.g. processing of an order for goods, customer support, withdrawal from a contract, complaints;
• compliance with a legal obligation that applies to Praguekabinet [Article 6(1)(c) of the GDPR] - e.g. keeping records of tax documents;
• the purposes of Praguekabinet's legitimate interests [Article 6(1)(e) of the GDPR] - e.g. delivery of the newsletter to Praguekabinet customers (according to point 47 of the GDPR grounds, processing of personal data for direct marketing purposes can be considered as processing carried out for the legitimate interests of the data controller).
Scope of personal data processing:
Praguekabinet processes personal data within the following scope:
• In the case of sales in the brick-and-mortar shop, the shop is monitored by camera systems with online transmission and recording. The cameras are installed for prevention reasons and to clarify possible illegal activities. The operator of the camera system is Praguekabinet. The camera recordings are normally stored for 48 hours. If an unlawful act occurs within the monitored area, the police may be contacted and the records in question may be handed over to the relevant authority (police, court, etc.). In this case, the recordings are not deleted, but kept as evidence until the final conclusion of the case.
In the case of sales in the e-shop, Praguekabinet processes personal data necessary for the delivery and billing of products, processing of withdrawal from the purchase contract and complaints, namely identification data (title, name, surname), address data (delivery address, possibly billing address), contact data (telephone number, email address, account number for refunding the purchase price).
Sources of personal data:
Praguekabinet obtains personal data exclusively from the data subject within the framework of contract negotiations.
Processors and recipients:
In addition to Praguekabinet and its employees, personal data may also be processed by Praguekabinet's data processors for the purposes described above on the basis of personal data processing agreements concluded in accordance with the GDPR. Praguekabinet's data processors are:
• Christian-Element, spol. s r. o., on whose platform Praguekabinet operates its e-shop;
• persons who provide legal services to Praguekabinet and other persons who provide or receive services in connection with the performance of Praguekabinet's contractual or statutory obligations.
Praguekabinet processes personal data both manually and automatically. The protection of personal data is technically and organizationally secured by Praguekabinet in accordance with the GDPR. Praguekabinet requires the same safeguards from personal data processors with whom it has concluded personal data processing agreements.
Praguekabinet informs that personal data may be transferred upon lawful request to third parties who have the legal authority to require such transfer of personal data.
Praguekabinet does not transmit personal data for marketing purposes of third parties. The personal data processed is neither transferred abroad nor accessible from abroad.
Rights of data subjects:
• Right to information: The data subject has the right at any time to request information about their personal data processed by Praguekabinet, their origin, the recipients or categories of recipients to whom the data has been transmitted, and the purpose of the personal data storage. In the case of a request for a copy of the personal data processed, reasonable administrative costs may be charged for any additional copies other than the first copy. This does not apply to information provided by electronic means.
• Right to withdraw consent: The consent given for the processing of personal data may be withdrawn by the data subject at any time without giving any reason, with effects for the future. In order to withdraw consent, it is sufficient to send an e-mail to info@praguekabinet.com or a notice to the postal address of the brick-and-mortar shop.
• Right to correction: The data subject may request that their inaccurate or incorrect personal data be amended.
• Right to deletion and restriction of processing: The data subject has the right to deletion and restriction of the processing of their personal data. In order to exercise this right, it is sufficient to send an e-mail to info@praguekabinet.com or a notice to the postal address of the brick-and-mortar shop. If the deletion would conflict with any statutory, contractual, fiscal, commercial-law retention obligations or other statutory grounds, it is possible to merely restrict the processing of the personal data instead of deleting it. The data subject shall be informed of the deletion or restriction of processing.
• Right to data transferability of personal data: Upon the data subject's request, Praguekabinet will provide the data subject with a copy in a commonly used format.
• Right to object: The data subject has the right to object at any time and without providing any reasons against the processing of their personal data for the purposes of direct marketing by Praguekabinet. In order to exercise this right, it is sufficient to send an e-mail to info@praguekabinet.com or a notice to the postal address of the brick-and-mortar shop. On this basis, the data subject shall be excluded from the direct marketing of Praguekabinet.