INFORMATION AND PRINCIPLES OF PERSONAL DATA PROCESSING

Act No. 110/2019 Coll., on the Processing of Personal Data (hereinafter referred to as the “Act”)

I. Personal Data Controller

GDX Invest s.r.o., with its registered office at Nemanická 2722, České Budějovice 3, 370 10 České Budějovice, Company ID No.: 02467674, tel.: +420 722 075 630, data box ID: esnbqzs (hereinafter referred to as the “Company” or the “Controller”), acting as the controller¹ of personal data, hereby provides information under the Act about the manner and extent of the processing of personal data, including the scope of the related rights of data subjects. Unless otherwise stated by law, reference is made to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”).

¹ The personal data Controller determines the purposes and means by which personal data are processed, collected, recorded, classified or disclosed, and is responsible for ensuring that such processing of your personal data is carried out properly.

II. Scope of Personal Data Processing

Personal data are processed to the extent to which the data subject concerned has provided them to the Controller in connection with entering into a contractual or other legal relationship with the Controller, or to which the Controller has otherwise collected them and processes them in accordance with applicable legislation or in fulfilment of the Controller’s statutory obligations under the Act.

III. Sources of Personal Data

Directly from data subjects who provide their personal data voluntarily (e.g. when entering into a contractual relationship, from email, in-person or telephone communications addressed to the Controller concerning reservations and accommodation itself). These sources are a fundamental prerequisite not only for establishing or modifying a contractual relationship but also primarily serve the unambiguous identification of data subjects. The relevant information is determined by generally binding regulations as essential particulars for dealings between contracting parties and for the Company’s compliance with the law, and consists in particular of personal data provided and data derived from them;

Publicly accessible registers, lists and records (e.g. the Commercial Register, Trade Register, publicly available telephone directories and others);

CCTV systems administered or owned by the Controller and operated for the purpose of protecting persons and the Controller’s property against possible unlawful acts by other persons.

IV. Categories of Personal Data Subject to Processing

• Identification data are always classified according to the type of data subject and the purpose of personal data processing, and their scope is determined by what is necessary for the purposes of processing: identification data include, in particular, first name, surname, title, date of birth, identity document number, VAT ID, permanent or temporary address or registered office, signature, citizenship, nationality, previous educational information, etc. Identification data also include personal data that enable us to identify you unambiguously.
• Contact details: in particular a contact or delivery address, telephone number, email address, etc. Contact details also include personal data enabling us to contact you. More detailed information on the specific categories of personal data that we process can be found in the document by which you either give us consent to personal data processing or by which we inform you about personal data processing when providing/performing a contractual relationship – rentals or leases of accommodation facilities, sales of real estate or other processing purposes – on the basis of our contractual or statutory obligations or legitimate interests.
• Descriptive, authentication and payment data (e.g. bank details or login/registration details, payment and reservation data),
• other data necessary to perform a contract, and data provided beyond the requirements of applicable laws and processed within the scope of consent granted by the data subject (processing photographs, use of personal data for recruitment procedures, etc.),
• special categories of data: in particular information about your health, only if you provide such personal data yourself or if required by the applicable laws of the Czech Republic.
• data on your behaviour on our website (for more information, see the Cookie Policy published at https://www.korzodelta.cz/zasady-cookies-eu/).

V. Categories of Data Subjects

Accommodation provider, accommodated person, guest, prospective customer, seller, buyer, employee of the Controller, external collaborator (a natural person, whether engaged in business or not), partner of the Controller, carrier, service supplier or any other person in a contractual relationship with the Controller, job applicant, natural persons involved in personal data processing, and other data subjects.

VI. Categories of Personal Data Recipients

Public administration authorities (police, foreign police, enforcement officers and others), i.e. state and other bodies in connection with compliance with statutory obligations imposed by applicable legislation (authorities, institutions, etc.) or on the basis of your consent to the processing of personal data; where relevant, regional public health authorities and other state and local government organisations; partner, sister or parent companies when providing services to you; persons providing postal and email distribution; supplier companies providing IT administration, website administration, Christmas greetings, possible satisfaction surveys and technical processing operations (suppliers of information systems and applications); and other processors acting for the Controller or other possible recipients in the Czech Republic, abroad and in EU Member States. More detailed information on processors and recipients of personal data can be found in the document by which you give consent to the processing of personal data, or by which we inform you about the processing of personal data in the course of providing/selling our product or a specific service on the basis of our contractual obligations or legitimate interests.

VII. Purposes of Personal Data Processing

The purposes of processing the personal data of data subjects are:

• negotiating a contractual relationship and performing a contract – conclusion and performance of a lease, rental agreement or other contractual relationship necessary to provide the services you request;
• accommodation reservations;
• accommodation registration card (record of accommodation);
• sale of real estate and related business activities;
• property maintenance;
• customer support;
• collecting and evaluating information relating to the services provided by us;
• handling requests and enquiries associated with the above purposes of processing the personal data of data subjects;
• where applicable, registration to receive news, invitations and promotional communications from the Company;
• recruitment of employees and selection procedures for vacant positions;
• negotiation, conclusion and performance of lease and rental agreements pursuant to Act No. 89/2012 Coll., the Civil Code.

Internal administrative needs and internal record-keeping, and the protection of the rights and interests of the Controller, recipient or other persons concerned (e.g. debt collection, claims for compensation, administrative proceedings under special legislation and compilation of statistics).

• statutory archiving,
• fulfilment of the Controller’s statutory obligations and activities,
• protection of the vital interests of the data subject,
• improving the Controller’s website based on its use,
• statistical reporting.

VIII. Manner of Processing and Protection of Personal Data

Processing is carried out only by employees, at the Controller’s workplaces and registered office and branches, and also with the assistance of processors and computer equipment or, where applicable, manually in the case of personal data in paper form, in compliance with all security principles and technical or organisational measures for the management and processing of personal data.

IX. Retention Period for Personal Data

In accordance with the time limits laid down in the relevant contracts, the Controller’s filing and retention/disposal rules or applicable legislation, personal data are processed for the period strictly necessary to ensure the rights and obligations arising both from contractual relationships and from applicable legislation. The Controller undertakes to comply with these periods.

X. Information for Data Subjects

The Controller processes data with the consent of the data subject, except in cases provided for by law where the processing of personal data does not require the data subject’s consent under the Act, unless otherwise provided due to statutory exceptions or the GDPR.

In accordance with the Act and Article 6(1) GDPR, the Controller may process the following data without the data subject’s consent:

• the data subject has given consent to processing for one or more specific purposes,
• processing is necessary for the performance of a contract to which the data subject is party or for taking steps at the request of the data subject prior to entering into a contract,
• processing is necessary for compliance with a legal obligation to which the Controller is subject,
• processing is necessary to protect the vital interests of the data subject or another natural person,
• processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.

XI. Technical and Organisational Measures for the Security of Data Subjects’ Personal Data

1. The Controller has adopted and maintains, in particular, the following measures to ensure an appropriate level of security for personal data:

• all persons granted access to personal data have been or will be informed of their obligations and properly trained by the Controller in personal data processing before such access is granted;
• the functionality and effectiveness of measures to ensure personal data security are regularly checked to the necessary extent through internal audits and reviews of measures and documentation;
• records are created that make it possible to determine and verify when and by whom personal data were recorded or otherwise processed;
• encryption and/or anonymisation of personal data is carried out;
• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, given the technical measures implemented and their regular monitoring;
• the ability to restore the availability of personal data;
• a process of regular testing, assessment and evaluation of the effectiveness of measures implemented to ensure the security of processing has been introduced;
• the ability to ensure protection of the integrity of communications networks;
• antivirus protection and monitoring of unauthorised access;
• secure data transmission enabling recipients to be clearly identified by means of appropriate tools;
• when personal data are processed, data in electronic form will be stored exclusively on secure servers or secure data storage media.

2. The Controller continuously adopts additional safeguards for the technical and organisational security of personal data, in particular measures to prevent unauthorised or accidental access to personal data, accidental or unlawful destruction, loss, alteration or unauthorised disclosure (hereinafter referred to as a “personal data breach”), at its discretion and taking account of the state of the art.

XII. Rights of Data Subjects

1. The basic and essential requirements for requests to exercise data subject rights are published in the document Requirements for Exercising Data Subject Rights, available on all our websites. That document lists data subject rights and also provides forms for exercising them, available at [email protected] or at the Controller’s workplace.

2. In accordance with Section 28 of the Act, the Controller will, at the request of the data subject, inform them of the right of access to personal data and of the following information:

• the purpose of processing and the categories of personal data concerned,
• the recipients or categories of recipients to whom personal data have been or will be disclosed, the envisaged period for which the personal data will be stored and all available information concerning the source of the personal data,
• where the data were not collected from the data subject, whether automated decision-making, including profiling, is carried out, as well as information on rights to request rectification, restriction of processing or erasure of personal data and on the source of the data.

3. Any data subject who discovers or believes that the Controller or a processor is processing their personal data in a manner contrary to the protection of their private and personal life or contrary to the law, particularly where personal data are inaccurate in relation to the purposes of processing, may:

• request an explanation from the Controller and require the Controller to remedy the situation. This may involve, in particular, blocking, rectifying, supplementing or erasing personal data,
• if the data subject’s request under paragraph 1 is found to be justified, the Controller will remedy the unsatisfactory situation without undue delay,
• if the Controller does not comply with the data subject’s request under paragraph 1, the data subject has the right to contact the supervisory authority directly, namely the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, tel.: +420 234 665 800, or email: [email protected],
• the procedure under paragraph 1 does not prevent the data subject from submitting their complaint directly to the supervisory authority,
• contact details of the Controller’s Data Protection Officer: Martin Trávníček, MBA, email: [email protected], or the Controller’s registered office address.