Privacy Policy

We have prepared this Privacy Policy to explain how we collect, process, use and protect personal data. In protecting privacy and personal data, we act exclusively in accordance with applicable legislation, namely Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”), and other applicable legislation governing this area.

1. Who is the controller of personal data, and what categories of data subjects do we process personal data about?

Personal data controller:

Company: MARSTON-CZ s.r.o., Company ID No.: 26226642, registered office: Hvězdárenská 860/2, Žabovřesky, 616 00 Brno, registered in the Commercial Register maintained by the Regional Court in Brno under file No. C 38273 (the “Controller”).

Categories of data subjects:

• Customers and suppliers of the Controller within business relationships
• Employees of the Controller,
• Service providers and persons working for the Controller under other contractual relationships,

2. What personal data do we process about data subjects?

Identification data – personal data used to uniquely identify a data subject, i.e. first name, surname, title, date of birth, permanent address and signature; for suppliers or customers who are self-employed individuals, also tax identification number and company identification number.

Contact details – personal data enabling us to contact a data subject in the performance of contractual obligations (contact address, email address, telephone number and, where applicable, payment details – bank account number).

Health-related personal data are processed to a limited extent, as required of the Controller by applicable law, primarily when processing employee personal data (disability pension, occupational injuries, fitness for work). In fulfilling employment-related obligations, we may also process other employee personal data (such as clothing size, etc.).

CCTV footage – to protect our legitimate interests under Article 6(1)(f) of the Regulation (preventing unlawful conduct and theft and protecting our property), we monitor selected areas of our production premises, including selected workplaces, using CCTV. Employees have been informed about the CCTV systems. The processing of recordings is also governed by the Controller’s internal policy, which describes this type of personal data processing in more detail.

To protect our legitimate interests under Article 6(1)(f) of the Regulation, we also process data on employees’ movements at workplaces within our production premises to prevent unlawful conduct and theft, protect property and ensure employees fulfil their employment obligations. This processing is further governed by the Controller’s internal policy, which describes it in greater detail.

In order to comply with legal obligations under Article 6(1)(c) of the Regulation towards public authorities and other bodies (in particular courts, enforcement officers, health insurers and the Czech Social Security Administration), we may process additional personal data, such as personal identification numbers, civil judgments and enforcement orders.

3. From what sources do we obtain personal data?

We obtain personal data directly from data subjects in the course of business or employment relationships. We also obtain personal data from third parties, primarily when fulfilling legal obligations towards courts, enforcement officers or the police, and where applicable from other third parties in accordance with the Regulation, especially from public sources while respecting the purpose of processing. We also obtain personal data through the operation of CCTV systems. Their operation at our production premises is described in the Controller’s internal policy.

4. How and for how long do we process personal data?

We process personal data both automatically in electronic information systems and in paper form. However, no solely automated decision-making (without human involvement), including profiling, takes place. Personal data are protected at all times against unauthorised interference, loss, destruction and misuse. Everyone who comes into contact with the data, particularly our employees and processors, is bound by confidentiality obligations.

We retain personal data for as long as necessary to safeguard all rights and obligations arising from a contractual relationship, i.e. for the duration of potential claims under the contract (statutory limitation periods), and for any additional period required by generally binding legislation (such as accounting record-keeping obligations). CCTV footage and data from workplace movement monitoring are retained only for the necessary period specified in our internal policies.

5. On what legal grounds and for what purposes do we process personal data?

When negotiating or performing a contract with a data subject (employee, supplier or customer), we process personal data under Article 6(1)(b) of the Regulation for the purpose of performing that contract. After the contractual relationship ends, these data may continue to be processed to protect our legitimate interests under Article 6(1)(f) of the Regulation, particularly to recover outstanding debts, for the applicable limitation periods.

On the basis of our legitimate interests under Article 6(1)(f) of the Regulation (see above), we also process CCTV recordings and data concerning employees’ movements in the workplace.

Where personal data are processed for our legitimate interests under Article 6(1)(f) of the Regulation, the data subject has the right to object under Article 21. If an objection is raised, we will cease processing unless we demonstrate compelling legitimate grounds overriding the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.

We also process personal data to comply with legal obligations under Article 6(1)(c) of the Regulation, for example obligations towards public authorities (tax authorities, courts, enforcement officers and notaries) and statutory obligations under specific legislation.

6. Right to withdraw consent where personal data are processed on the basis of consent

The foregoing does not prevent us from processing certain personal data on the basis of the data subject’s explicit consent under Article 6(1)(a) of the Regulation. Where we process personal data on this basis, the data subject may withdraw consent at any time, in whole or in part. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Consent may be withdrawn in the same way it was given, or in person or in writing to MARSTON-CZ s.r.o., Jahodová 533/56, Brno 620 00, by email to haluzova@marston.cz or by telephone on 774 400 008.

From the date on which we are notified of withdrawal of consent, we may process personal data only to the extent supported by another legal basis, in particular compliance with legal obligations or the protection of rights and legal claims as described above.

7. What statutory rights does a data subject have in relation to personal data processing?

Right of access to personal data:

A data subject has the right to obtain confirmation from the Controller as to whether their personal data are being processed and, if so, to access those data and the information specified in Article 15 of the Regulation.

Right to rectification or erasure, or restriction of processing:

In the cases specified by the Regulation, a data subject may ask the Controller to correct or complete inaccurate or incomplete personal data, request erasure where there is no longer a valid reason for processing, or request restriction of processing while issues concerning the Controller’s processing are resolved.

Right to object:

A data subject may object at any time, on grounds relating to their particular situation, to processing based on the legitimate interests of the Controller or other persons under the Regulation. Such legitimate interests may include the protection of the Controller’s rights and legal claims.

Right to data portability:

Subject to the conditions of the Regulation, a data subject has the right to obtain their personal data from the Controller and transmit them to another controller.

Right to lodge a complaint with a supervisory authority:

A data subject has the right to lodge a complaint with a supervisory authority if they believe that processing of their personal data infringes the Regulation. The competent authority is the Czech Office for Personal Data Protection.

Where processing is based on consent, the data subject may withdraw that consent at any time; examples include marketing consent or any processing of customers’ health-related personal data. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of your rights, you may use the contact details in Section 8 below. We will inform the data subject of the outcome of their request and the measures taken without undue delay (the Regulation sets a deadline of one month from receipt). A more detailed description of data subjects’ rights is freely available on our website at www.marston.cz.

8. Where can data subjects exercise their rights or raise objections to personal data processing?

Data subjects may object to processing, withdraw or modify consent, or exercise any of their rights in one of the following ways:

• In person at: Jahodová 533/56, Brno 620 00
• By calling the free information line: 774 400 008
• By email to: haluzova@marston.cz

9. To whom do we disclose personal data?

We process personal data ourselves through our employees or through processors appointed under an appropriate agreement in accordance with Article 28 of the Regulation. In all cases, we ensure that both we as Controller and our processors comply with the obligations imposed by applicable legislation, and that the security of transferred personal data is not compromised or the data misused.

Processors / recipients of personal data include in particular:

• Public authorities and other institutions in fulfilment of legal obligations, especially administrative authorities, courts and tax authorities, etc.
• Service providers (FINUM s.r.o. – external accounting company, Petr Pavlát – CCTV system, AUTOCONT CZ s.r.o. – IT services, SPWeb – website maintenance)
• Other entities to whom personal data may be disclosed with your prior consent or at your instruction;

10. When do we transfer personal data to third countries?

We do not transfer the personal data we process to third countries or to any international organisation.

11. Do we carry out automated decision-making or profiling?

No solely automated decision-making (without human involvement), including profiling, takes place in the processing of personal data.

12. How can you contact us?

If you have any questions about personal data processing, you can contact us in writing, by email or by telephone using the details below.

• MARSTON-CZ s.r.o., Jahodová 533/56, Brno 620 00
• Email: haluzova@marston.cz
• Tel.: 774 400 008

What do the terms used in this Policy mean?

Personal data – any information relating to an identified or identifiable data subject; a data subject is identifiable if they can be identified directly or indirectly;

Data subject – a natural person to whom the personal data relate;

Controller – an entity that determines the purposes and means of processing personal data, carries out the processing and is responsible for it;

Processor – any entity that processes personal data pursuant to a specific law or on the Controller’s instructions;

Recipient – any entity to which personal data are disclosed;

Processing of personal data – any operation or set of operations systematically performed on personal data by a controller or processor, whether by automated or other means, in particular collection, recording on information media, disclosure, adaptation or alteration, retrieval, use, transmission, dissemination, publication, storage, exchange, sorting or combination, blocking and destruction.

This Privacy Policy has been valid and effective since 25 May 2018. The current valid version is published on our website www.marston.cz or is available at the company’s registered office.

Information provided by the Controller on data subjects’ rights and how to exercise them

Pursuant to Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “Regulation”).

Controller: MARSTON-CZ s.r.o., Company ID No.: 26226642, registered office: Hvězdárenská 860/2, Žabovřesky, 616 00 Brno, registered in the Commercial Register maintained by the Regional Court in Brno under file No. C 38273.

List of rights granted to data subjects

Chapter III of the Regulation governs the rights that a data subject (a person whose personal data are processed by the Controller) may exercise against the Controller during the processing of their personal data.

These are the following rights of the data subject:

A) Data subject’s right of access to personal data

1. The data subject has the right to obtain confirmation from the controller as to whether personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:

 a) the purposes of the processing;

 b) the categories of personal data concerned;

 c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

 d) the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;

 e) the existence of the right to request rectification or erasure of personal data, restriction of processing or to object to such processing;

 f) the right to lodge a complaint with a supervisory authority;

 g) any available information as to the source of the personal data where they are not collected from the data subject;

 h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the Regulation and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

2. Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer.

3. The controller shall provide a copy of the personal data undergoing processing. For further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic form unless otherwise requested.

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

B) Right to rectification

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

C) Right to erasure (“right to be forgotten”)

1. The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies:

 a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

 b) the data subject withdraws consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) of the Regulation, and there is no other legal ground for processing;

 c) the data subject objects to the processing under Article 21(1) of the Regulation and there are no overriding legitimate grounds for processing, or the data subject objects under Article 21(2);

 d) the personal data have been unlawfully processed;

 e) the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;

 f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the Regulation.

2. Where the controller has made the personal data public and is obliged under paragraph 1 to erase them, the controller shall, taking account of available technology and implementation costs, take reasonable steps, including technical measures, to inform controllers processing the personal data that the data subject has requested erasure of any links to, or copies or replications of, those personal data.

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

 a) for exercising the right of freedom of expression and information;

 b) for compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or for performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

 c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the Regulation;

 d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the Regulation, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;

 e) for the establishment, exercise or defence of legal claims.

D) Right to restriction of processing

1. The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

 a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify their accuracy;

 b) the processing is unlawful and the data subject opposes erasure and requests restriction of their use instead;

 c) the controller no longer needs the personal data for processing purposes, but they are required by the data subject for the establishment, exercise or defence of legal claims;

 d) the data subject has objected to processing pursuant to Article 21(1) of the Regulation pending verification of whether the controller’s legitimate grounds override those of the data subject.

2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims, the protection of the rights of another natural or legal person, or reasons of important public interest of the Union or of a Member State.

3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.

E) Notification obligation regarding rectification or erasure of personal data or restriction of processing

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 of the Regulation to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

F) Right to data portability

1. The data subject has the right to receive personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

 a) the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) of the Regulation, or on a contract under Article 6(1)(b); and

 b) the processing is carried out by automated means.

2. In exercising the right to data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. The exercise of the right referred to in paragraph 1 shall be without prejudice to Article 17 of the Regulation. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

G) Right to object

1. The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

2. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

4. The data subject shall be explicitly informed of the right referred to in paragraphs 1 and 2, presented clearly and separately from other information, at the latest at the time of the first communication with the data subject.

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise the right to object by automated means using technical specifications.

6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the Regulation, the data subject, on grounds relating to their particular situation, has the right to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

H) Automated individual decision-making, including profiling

1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

2. Paragraph 1 shall not apply if the decision:

 a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

 b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or

 c) is based on the data subject’s explicit consent.

3. In the cases referred to in paragraph 2(a) and (c), the data controller shall implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1) of the Regulation, unless Article 9(2)(a) or (g) applies and suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests are in place.

Exercising the rights granted

A data subject may exercise all the rights listed above against the Controller in person during office hours at MARSTON-CZ s.r.o., Jahodová 533/56, Brno 620 00, in writing at the same address, by email to haluzova@marston.cz or by telephone on 774 400 008. The Controller must respond to the request and inform the data subject of the measures taken within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. The Controller must inform the data subject of any extension and the reasons for the delay within one month of receiving the request. Where a request is made electronically, the information shall be provided electronically where possible, unless the data subject requests otherwise.

If the Controller does not take the action requested, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

All information and actions are provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may either:

a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action; or

b) refuse to act on the request.

Where the Controller has reasonable doubts concerning the identity of the natural person making a request to exercise the rights above, it may request additional information necessary to confirm the identity of the data subject.