Continue to main content

Privacy Policy

State Investment and Development Company, a.s. (hereinafter referred to as “SIRS”), ID No.: 21 33 38 58, Na Poříčí 1046/24 Nové Město, 110 00 Prague 1, strives to comply with all applicable laws and regulations regarding personal data protection.

This document expresses the basic policy of SIRS regarding the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and describes the basic principles by which SIRS processes the personal data of business partners, employees, and other individuals (hereinafter referred to as the “Data Subject”).

1. Introductory Information

1.1.

For the purposes of personal data processing, SIRS is the Data Controller that determines the purposes and means of processing. In its role as a controller, it processes the personal data of Data Subjects as part of all its main activities, which are primarily business activities carried out in accordance with the purpose of SIRS’s establishment, as well as marketing and promotional events for the public. To ensure its operations, SIRS processes the personal data of business partners within contractual relationships and accounting, and further, the personal data of employees related to their employment.

1.2.

SIRS processes the personal data of Data Subjects in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “GDPR”).

1.3.

The Data Subject provides SIRS with their personal data in a lawful manner depending on the purpose of their processing:

  • for compliance with a legal obligation to which SIRS is subject,
  • for the purposes of the legitimate interests pursued by SIRS,
  • for the performance of a contract between the Data Subject and SIRS,
  • with the consent of the Data Subject to the processing of their personal data.

1.4.

Consent to the processing of personal data is granted by the Data Subject in cases where another legal basis cannot be used for the purpose of processing, especially in the case of interference with the privacy of the Data Subject. SIRS accepts the Data Subject’s consent as a freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. The Data Subject has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the Data Subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

1.5.

Failure to grant potential consent or its withdrawal has no consequences on the concluded contractual relationship with SIRS or on the use of SIRS products and services for which this consent is not required.

2. Purpose of Processing Personal Data

2.1.

Personal data of Data Subjects must be collected only for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The Data Subject is transparently informed about the purpose of the processing.

2.2.

The personal data of the Data Subject are processed by SIRS within all its main activities, within established contractual relationships, and during the management of personnel and payroll agendas, including processing operations for fulfilling SIRS’s obligations arising from legal regulations, accounting, operational records, retention for a specified period, control, and audit.

3. Categories of Processed Personal Data

3.1.

SIRS collects, processes, and stores the following categories of personal data of Data Subjects:

  • 3.1.1. Address and identification personal data – especially name, surname, title, date of birth, personal identification number, residence, telephone number, email, contact address.
  • 3.1.2. Descriptive personal data – especially data of the Data Subject relating to membership or provided services, contractual relationship, transaction data.
  • 3.1.3. Other data – e.g., photographs and camera recordings.

4. Method of Processing and Storage of Personal Data and Retention Period

4.1.

SIRS processes the personal data of the Data Subject manually or by automated means and securely stores them in paper or electronic form. Following the purpose of processing, the personal data of the Data Subject are kept in the records of business partners, in accounting and personnel files.

4.2.

When processing personal data, SIRS does not apply automated decision-making using exclusively automatic means (applications, software, algorithms, etc.).

4.3.

SIRS retains documents containing personal data for the period strictly necessary to ensure all rights and obligations arising from a contract or an employment relationship, and further for the period for which it is obliged to retain the data under generally binding legal regulations. These periods are determined by the internal archiving and shredding plan. The Data Subject is transparently informed about the retention period of their personal data in connection with the purpose of processing.

5. Transfer of Personal Data

5.1.

SIRS may transfer the obtained personal data of the Data Subject to a third party only on the basis of a lawful basis, especially for the performance of a task arising from a legal regulation. The Data Subject is transparently informed about the individual recipients of their personal data.

5.2.

With the consent of the Data Subject, or in the event that they do not effectively raise an objection after receiving a notification about the legitimate interest of SIRS, their personal data may also be transferred to other entities.

5.3.

In specific cases of processing activities, SIRS shall mandate a Data Processor who provides sufficient guarantees, in particular regarding expert knowledge, reliability, and security of processing. The carrying out of processing by a processor is governed by a contract that binds the processor to SIRS, taking into account the specific tasks and obligations of the processor in connection with the processing. The Data Subject is informed about the transfer of their personal data to a processor within the given purpose.

6. Rights of the Data Subject

6.1.

Based on a request, the Data Subject will receive from SIRS all legally required information about the processing of their data, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language.

6.2.

Where personal data relating to a Data Subject are collected directly from them, SIRS shall, at the time when personal data are obtained, provide the Data Subject with the following information:

  • the identity and the contact details of SIRS and, where applicable, of its representative,
  • the purposes of the processing for which the personal data are intended as well as the legal basis for the processing,
  • the legitimate interests pursued by SIRS in cases where the processing is based on this legal basis,
  • the recipients or categories of recipients of the personal data, if any, including any potential processor,
  • where applicable, the intention of SIRS to transfer personal data to a third country or international organization, including a reference to the appropriate safeguards,
  • the period for which the personal data will be stored by SIRS, or if that is not possible, the criteria used to determine that period,
  • the existence of the right to request from SIRS access to and rectification or erasure of personal data or restriction of processing concerning the Data Subject, and to object to processing as well as the right to data portability,
  • where the processing is based on the Data Subject’s consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal,
  • the right to lodge a complaint with a supervisory authority,
  • whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the personal data and the possible consequences of failure to provide such data,
  • the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

6.3.

Where SIRS intends to further process the personal data for a purpose other than that for which the personal data were collected, it shall provide the Data Subject prior to that further processing with information on that other purpose.

6.4.

SIRS is not obliged to provide the Data Subject with information on processing if and to the extent that the Data Subject already possesses the information.

6.5.

If SIRS carries out processing necessary for compliance with a legal obligation, it may also provide information to the Data Subject by publishing the information in a manner that allows remote access.

6.6.

Where personal data have not been obtained directly from the Data Subject, SIRS shall provide the Data Subject with the same information and additionally:

  • the categories of personal data concerned,
  • the source from which the personal data originate, and if applicable, whether it came from publicly accessible sources.

6.7.

In the case of obtaining personal data from someone other than the Data Subject, SIRS will not apply the information obligation if the obtaining or disclosure is expressly laid down by a legal regulation to which SIRS is subject and which provides appropriate measures to protect the Data Subject’s legitimate interests.

6.8.

A Data Subject who finds out or believes that SIRS as a controller, or another person who processes personal data for SIRS, carries out the processing of their personal data in violation of the GDPR, may request an explanation or demand that SIRS or the processor remedy the situation thus arisen. If SIRS or the relevant processor fails to comply with the request, the Data Subject may contact the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), whereas the right of the Data Subject to contact the Office for Personal Data Protection directly is not affected thereby.

6.9.

The Data Subject has the following additional rights:

  • 6.9.1. to obtain from SIRS, if the conditions are met, information about the processing of their personal data (information about the identity and contact details of SIRS and its potential representative, and particularly the purposes of the processing for which the personal data are intended, the legal basis for processing, potential recipients or categories of recipients of the personal data, and other information necessary to ensure transparent and fair processing of their personal data);
  • 6.9.2. to obtain from SIRS access to personal data, i.e., to obtain from SIRS confirmation as to whether or not personal data concerning the Data Subject are being processed, and, where that is the case, the Data Subject has the right to access the personal data and further information to the legal extent;
  • 6.9.3. to the rectification of their inaccurate personal data, or to have incomplete personal data completed;
  • 6.9.4. to the erasure of their personal data, provided that the legal conditions are met, e.g., if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or e.g., if the Data Subject withdraws their consent on which the processing is based;
  • 6.9.5. to the restriction of processing of personal data by SIRS, if the legal conditions are met;
  • 6.9.6. to data portability, i.e., to receive the personal data concerning them, which they have provided to SIRS, in a structured, commonly used and machine-readable format;
  • 6.9.7. to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them;
  • 6.9.8. not to be subject to a decision based solely on automated processing, including profiling, unless the Data Subject provides consent, except in cases where automated processing is required by a legal regulation;
  • 6.9.9. to lodge a complaint with a supervisory authority.

6.10.

SIRS is entitled to require personal identification from the Data Subject when submitting a request to exercise any of the aforementioned rights. The request can be accepted in person with identification on the spot at the SIRS office, in writing with a certified signature, or electronically with a certificate.

6.11.

In cases where requests from a Data Subject are manifestly unfounded or excessive, in particular because of their repetitive character, SIRS is entitled to charge a reasonable fee for providing information on the processed personal data of the Data Subject, not exceeding the costs necessary for providing the information. For the same reasons, the request may also be refused.

7. Final Provisions

7.1.

The Data Subject can obtain all information regarding the processing of their personal data in person at the SIRS registered office or electronically via a data box (hdsw5ez) or by e-mail at info@sirsdevelopment.cz.