Zlatohorská s.r.o.

IČO: 26857243, DIČ: CZ26857243
CZ-793 76 Zlaté Hory, Myslivecká 840, Tel.: 605 554 554

Statement on the processing of personal data

Statement on the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the information of the data subject, hereinafter GDPR.

I. Controller of personal data

The company Zlatohorská s.r.o., náměstí Myslivecká 840, 793 76 Zlaté Hory, Company ID: 26857243, VAT ID: CZ26857243, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 50549, hereinafter the “Controller”, hereby informs you in accordance with Article 12 GDPR about the processing of your personal data and about your rights.

II. Scope of the processing of personal data

Personal data are processed to the extent to which the relevant data subject provided them to the Controller, or which the Controller collected by means of a camera system, and are processed in accordance with the applicable legal regulations or the fulfilment of the controller’s legal obligations.

III. Categories of personal data that are the subject of processing

address and identification data used for the unique and unmistakable identification of the data subject (e.g. first name, surname, birth number, date of birth, address) and data enabling contact with the data subject (e.g. telephone number, contact address, e-mail address)
descriptive data (e.g. bank details)
CCTV recording
data provided beyond the scope of the applicable laws, processed on the basis of consent given by the data subject (e.g. a copy of an identity card)

IV. Categories of data subjects

Employee
host
job applicant
service supplier

V. Categories of recipients of personal data

Controller
state and other authorities in the course of fulfilling legal obligations laid down by the applicable legal regulations
financial institutions

VI. Purpose of the processing of personal data

the purposes contained in the data subject’s consent
protection of the Controller’s rights
archiving carried out on the basis of the law
selection procedure for vacant posts
fulfilment of legal obligations by the Controller
protection of important interests of the Controller

VII. Manner of processing and protection of personal data

The processing of personal data is carried out by the Controller. Processing takes place at his registered office by individually authorised employees. Processing is performed by means of computer equipment, or manually in the case of personal data in paper form, while observing all security principles for the administration and processing of personal data. For this purpose the Controller has adopted technical and organisational measures to ensure the protection of personal data so that there can be no unauthorised or accidental access to personal data, their alteration, destruction or loss, unauthorised transfers or processing. All parties to whom personal data may be disclosed respect the data subject’s right to privacy and are obliged to proceed in accordance with the applicable legal regulations concerning the protection of personal data.

VIII. Period of processing of personal data

The period of processing of personal data corresponds to the time strictly necessary to ensure the rights and obligations arising both from the applicable legal regulations and from the needs of the Controller.

IX. Information

The Controller processes data with the consent of the data subject except in cases laid down by law where the processing of personal data does not require the data subject’s consent. In accordance with Article 6(1) GDPR the controller may process the following data without the data subject’s consent:

the data subject has given consent for one or more specific purposes
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
processing is necessary for compliance with a legal obligation to which the Controller is subject
processing is necessary in order to protect the vital interests of the data subject or of another natural person
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller
processing is necessary for the purposes of the legitimate interests pursued by the relevant controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data

X. Rights of the data subject

In accordance with Article 12 GDPR the Controller or the DPO (the data protection officer appointed by the Controller) informs the data subject, at the data subject’s request, of the right of access to personal data and of the following information:

the purpose of the processing
the categories of personal data concerned
the recipients or categories of recipients to whom the personal data have been or will be disclosed
the planned period for which the personal data will be stored
all available information about the source of the personal data
where not obtained from the data subject, whether automated decision-making, including profiling, takes place

Any data subject who finds or believes that the Controller is processing his or her personal data in a manner that is contrary to the protection of the data subject’s private and personal life or contrary to the law, in particular if the personal data are inaccurate with regard to the purpose of their processing, may:

ask the Controller or the DPO for an explanation
require the controller to remedy the situation that has arisen

If the Controller does not grant the data subject’s request, the data subject has the right to turn directly to the supervisory authority, namely the Office for Personal Data Protection.

Privacy Policy