Purpose, objective and scope of activities

 

By this document, Hotel PAYER, U HADÍCH LÁZNÍ 1153/44, Teplice, Company Registration Number: 646 51 410 (data controller) hereby undertakes to apply and comply with the principles set out below in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“GDPR”) in relation to data subjects (employees, suppliers and customers).

 

Description of the principles adhered to by the organisation:

Transparency and fairness

•  We ensure that all information and communications relating to the processing of such personal data are easily accessible and understandable, and are provided using clear and simple language.

Purpose limitation

• We collect personal data only for relevant purposes (specific, unambiguous and legitimate).
• We do not process personal data in a manner that is incompatible with these purposes.
• In the event of a change of purpose:
• we monitor the link between the purposes and the circumstances under which the personal data were collected,
• we monitor the nature of the personal data (whether special categories are being processed),
• we monitor and minimise the potential consequences of the intended further processing for data subjects, and ensure that appropriate safeguards are in place

Data minimisation for the necessary period

• When processing personal data, we adhere to and apply the principles of proportionality, relevance and limitation to the extent necessary in relation to the purpose for which we process the personal data.
• We always assess whether any interference with the data subject’s rights resulting from the processing is: proportionate and legitimate in relation to the purpose of the processing.
• If it transpires that the processing of specific personal data for a particular purpose is unnecessary, or if such processing of personal data is not in accordance with the GDPR, we do not process such personal data.

Accuracy

• We always ensure that the personal data we process is accurate and updated as necessary.
• We ensure that any personal data which is inaccurate is erased or rectified without delay: we take all reasonable steps to ensure that personal data which is inaccurate, having regard to the purposes for which we process it, is erased or rectified without delay.

Integrity and confidentiality

• We declare that the manner in which personal data is processed will ensure the appropriate security of personal data, including its protection, by means of suitable technical or organisational measures against: unauthorised or unlawful processing and against accidental loss, destruction or damage (‘integrity and confidentiality’).

Responsibility of the data controller

• As the data controller, we accept responsibility for:
• processing personal data in accordance with the principles of the GDPR, and we are able to demonstrate such compliance.
• If we (the data controller) process personal data through a third party – a data processor – the latter is: authorised to process personal data only on our (the data controller’s) instructions, except where required by Union law or the law of a Member State (e.g. the Czech Police or OLAF).

Rights of data subjects (employees, suppliers, customers)

• We (the data controller) take such appropriate measures to ensure that data subjects (employees, suppliers, customers):
• are provided with all information obtained from the data subject,
• all communications are made in accordance with the data subjects’ rights, namely:
• in a concise, transparent, intelligible and easily accessible manner, using clear and plain language.
• We shall provide the information in writing or by other means – for example, in electronic form (where appropriate).
• As the data controller, we will provide the data subject, upon their request, with information on the measures taken, namely:
• without undue delay – within 1 month (this period may be extended by a further 2 months, provided the data subject is informed of the reasons for the extension).
• We provide information and all communications free of charge; however, if requests submitted by the data subject are manifestly unfounded or excessive, or are repetitive, the data controller may charge a reasonable fee taking into account the administrative costs or refuse to comply with the request (the data controller shall provide evidence of the manifestly unfounded or excessive nature of the request).

The data subject’s right of access to personal data

• The data subject (employees, suppliers, customers) has the right to obtain from the data controller confirmation as to whether or not personal data relating to them are being processed, and, where that is the case, has the right to access those personal data and the following information:
  • the purposes of the processing and the categories of personal data concerned,
  • the recipients or categories of recipients,
  • the envisaged period for which the personal data will be stored or the criteria used to determine this,
  • information on the source of the personal data, where it has not been obtained from the data subject, and information on whether automated decision-making, including profiling, is taking place.
  • The data subject (employees, suppliers, customers) has the right to request that the data controller rectify or erase their personal data, restrict its processing, or object to such processing.
  • The data subject (employees, suppliers, customers) has the right to lodge a complaint with the supervisory authority.
  • We (the data controller) undertake to provide the data subject (employees, suppliers, customers) with a copy of the personal data being processed. We charge a reasonable fee for any further copies of the data provided upon request, based on administrative costs.
  • We provide the information in the same form as that in which the request was made, unless the data subject requests otherwise.
  Where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards.

Right to rectification of personal data

•  We (the data controller) are aware that the data subject (employees, suppliers, customers) has the right (without undue delay) to have their personal data rectified and to have it completed.

Right to erasure of personal data

• We (the data controller) are aware that the data subject (employees, suppliers, customers) has the right (without undue delay) to have their personal data erased, and the data controller is obliged to do so, in particular where:
• the personal data are no longer necessary for the purposes for which they were collected,
• the data subject (employees, suppliers, customers) withdraws their consent to processing,
• the data subject objects to the processing, the personal data has been processed unlawfully,
• there is a legal obligation to do so.

The data subject’s right to restriction of processing of personal data

• The data subject (employees, suppliers, customers) has the right to have the data controller restrict processing in any of the following cases:
• the data subject disputes the accuracy of the personal data,
• the processing is unlawful and the data subject refuses to have the personal data erased and requests, instead, that its use be restricted,
• the data controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims,
• the data subject has objected to the processing, pending verification of whether the data controller’s legitimate grounds override those of the data subject,
• Personal data may only be stored unless:
• they are processed solely with the data subject’s consent, or for the purpose of establishing, exercising or defending legal claims, for the purpose of protecting the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State
•  
• A data subject (employees, suppliers, customers) who has obtained a restriction on processing shall be notified in advance by the controller that the restriction on processing will be lifted.

Right to data portability

• The data subject (employee, supplier, customer) has the right to obtain the personal data concerning them which they have provided to the data controller, namely:
• in a structured, commonly used and machine-readable format; and the right to transmit those data to another data controller, provided that:
• the processing is based on consent or a contract and is carried out by automated means,
• the right to have personal data transferred directly from one data controller to another, where technically feasible,
• the exercise of the right to data portability does not affect the right to be forgotten:
• The data subject (employee, supplier, customer) has the right to obtain the personal data concerning them which they have provided to the data controller, namely:
• in a structured, commonly used and machine-readable format, and the right to transmit those data to another data controller, provided that:
• the processing is based on consent or a contract and is carried out by automated means,
• the right to have the personal data transferred directly from one data controller to another, where technically feasible,
• the exercise of the right to data portability shall not affect the right to be forgotten:
• this right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

The data subject’s right to object

• Every data subject has the right to lodge a complaint with a supervisory authority in the European Union if they consider that the processing of their personal data infringes the Personal Data Protection Act and/or the General Data Protection Regulation. The competent supervisory authority in the Czech Republic is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.