Personal Data Processing Information
DONATI LEGAL s.r.o., Business ID No.: 174 17 635, with its registered office at Lomnického 1705/7, Nusle, 140 00 Praha 4, entered into the Commercial Register maintained at the Municipal Court in Prague under File No. C 371397, e-mail: info@donati-legal.cz (hereinafter the “Company”), pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter the “Regulation”), would hereby like to inform all our clients and business partners if they are natural persons (hereinafter “Data Subjects”) of the processing of their personal data.
This Privacy Policy applies to
(i) processing of personal data carried out by the Company during your use of the website https://www.donati-legal.cz/,
(ii) processing of personal data carried out by the Company during communication with you via e-mail or telephone,
(iii) processing of personal data by the Company during the duration of the business relationship with clients and suppliers,
(iv) processing of personal data in the fulfillment of the Company’s legal obligations and on
(v) processing of personal data that is necessary for the purpose of protecting the legitimate interests of the Company.
This information does not apply to the personal data of legal entities, including their name, legal form and contact information for the legal entity.
Types and sources of personal data the Company processes
The Company hereby informs the Data Subjects that it primarily processes the following types of personal data:
a) identification and contact data;
b) invoicing information;
c) payment details;
d) information about their business activities (especially ongoing/completed/pending judicial/distraint/administrative proceedings, information about criminal proceedings and criminal matters if applicable, information on financial situation, bank account);
e) information on participation in events organized by the Company;
f) data shared in mutual communication (whether in person, in writing, over the telephone or otherwise).
The data listed in points a) through f) above (at least basic data) is essential for us to meet our contractual obligations, and thus providing that data is mandatory.
The above-stated personal data processed by the Company comes from the following sources:
a) data provided by the client upon entering into a contract with the Company or during the performance of said contract;
b) data from public sources, lists and records, e.g. the Commercial Register, Trade Licensing Register, Insolvency Register, court file; or
c) data provided by the client on the basis of a consent to personal data processing and receiving commercial communications.
In what manner and for what purpose does the Company process personal data?
The Company processes personal data automatically in its IT systems as well as manually by means of its employees or the recipients’ employees.
Processing personal data is necessary in order to perform under the agreement made between the Company and the client regulating the exercise of the related rights and performance of the related obligations of the Company and individual clients. The Company does not use the data listed above to make decisions purely on the basis of automated processing or profiling pursuant to Article 22(2) of the Regulation.
The personal data may also be used for direct marketing purposes (especially in the form of electronic commercial communications) on the basis of the Company’s legitimate interest. The Company uses personal data for direct marketing purposes with prior consent. The client can raise an objection to such processing without charge or revoke the consent in written form sent to the Company’s registered address or in electronic form to the Company’s email address.
Who are the recipients of the personal data?
If so stipulated in the contract, the Company can publish identifying data on a client or representative in its promotional materials and other related documents.
The Company discloses its clients’ personal data only in justified cases and in the scope absolutely necessary to the following recipients:
- The Company’s contractual partners ensuring the day-to-day operations of the Company and performance of the contractual relationship between the Company and clients, primarily as follows:
- IT service providers;
- providers of our information system;
- providers of postal services (client’s name and address);
- translation providers and marketing agencies;
- and other providers of legal, administrative and technical services that we use for the performance of our contractual obligations to our clients;
- Other subjects in cases where the Company is required to provide the data by legal regulations or as necessary to protect the Company’s legitimate interests (e.g. to courts, Czech Police Force);
- The Company can disclose your personal data to another country in justified cases and in the scope absolutely necessary. This cooperation involves disclosure of personal data within the European Union in connection with particular judicial proceedings, especially in communication with the relevant courts and government offices.
Length of processing and storing personal data
The Company processes and stores the above-mentioned personal data on clients for the duration of the contractual relationship between the Company and client. After this contractual relationship ends, the data will still be processed and stored for the duration of the statute of limitations for any relating claim of the Company or its clients. After this period has passed, the Company will destroy the clients’ personal data unless it is entitled or obliged to continue processing and storing the data on the basis of another legal title.
The clients’ personal data listed above will be stored with the Company for a period of three years after the contractual relationship ends or until consent is revoked for the purposes of direct marketing performed on the basis of the Company’s legitimate interest or the Data Subject’s consent.
The Company will archive the documents with clients’ personal data in cases where it is required to do so by a binding legal regulation for the prescribed length of time.
Clients’ rights
The Company hereby informs its clients that pursuant to the Regulation every Data Subject has the following rights with regard to the Company as of March 4, 2021:
1. the right to access your personal data and receive a copy of the processed personal data (provided that this does not negatively impact the rights and freedoms of other persons);
2. the right to correct or add to inaccurate personal data concerning the client, including by providing an additional statement; and
3. the right to erasure of your personal data in one of the following situations:
(a) the personal data is no longer needed for the purposes for which it was collected or otherwise processed;
(b) the client revoked the consent based on which the personal data was processed, and there are no other legal grounds for processing it;
(c) the client objected to being the subject of a decision based on automated processing of their personal data, and there is no overriding legitimate reason for their processing in this manner, or the client objected to the processing of their personal data for the purposes of direct marketing;
(d) the client’s personal data was processed unlawfully;
(e) the client’s personal data must be deleted in order to meet the legal obligations stipulated in EU law or a member state’s law applying to the controller;
(f) the client’s personal data was collected in connection with an offer of information society services
4. the right to request that the Company restrict the processing of the personal data if:
(a) the client denies the accuracy of their personal data, for the period necessary for the Company to verify the accuracy of said data;
(b) the data processing is unlawful and the client refuses the deletion of their personal data and requests instead that its use be restricted;
(c) the company no longer needs the client’s personal data for processing, but the client requests the personal data in order to determine, exercise or defend their legal claims; and
(d) the client raised an objection against processing pursuant to Article 21(1) of the Regulation, then until it can be verified whether the Company’s legitimate reasons outweigh those of the client;
5. the right to transferability of their personal data processed both on the basis of consent or a contract and also in automated form;
6. the right to file a free objection to the processing on the basis of the Company’s legitimate interests, in particular against direct marketing on the basis of the Company’s legitimate interests;
7. the right to be informed in the event of a security breach affecting the clients’ personal data that is likely to result in a high risk for the rights and freedoms of natural persons including the client; and
8. the right not to be the subject of a decision based exclusively on automated processing, including profiling, that has legal effects for the Customer or significantly affects the Customer in a similar way;
The client can contact the Company regarding the Company’s handling of its clients’ personal data to get answers to any questions or clarify any ambiguities regarding how we handle your personal data in writing at the Company’s postal address or by email. The client also has the right to contact the Data Protection Office directly, with its registered office at Pplk. Sochora 27, 170 00 Praha 7 (other contact information here: www.uoou.cz) or file a complaint with said office. Every client hereby acknowledges that they have been informed via the above information from the Company regarding their rights and protecting their rights pursuant to Article 13 and 15 through 22 of the Regulation.
