Information on the processing of personal data of customers and suppliers of goods and services
Introductory information
The company GINZEL, spol. s r.o. processes personal data of customers and suppliers who are self-employed individuals (hereinafter “Customers and Suppliers”), based on and in accordance with the applicable legal regulations, especially Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of self-emplyed individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also the “Regulation”), for the specified purposes as well as by the methods and means of processing, which always correspond to the relevant legal basis within the meaning of Article 6 of the Regulation.
This Information on the processing of personal data of Customers and Suppliers contains both transparent information within the meaning of Articles 13 and 14 of the Regulation, as well as instructions on the rights of data subjects under Articles 15 to 22 of the Regulation.
Data Controller
The company GINZEL, spol. s r.o., with its registered office at Husovo nám.12, ZIP code 267 12 Loděnice, Company ID: 25411357, acts as the data controller in relation to the personal data of Customers and Suppliers (hereinafter also the “Controller”).
The Controller bears responsibility for the processing of personal data of Customers and Suppliers and other groups of data and has adopted internal organizational, technical, and other measures to secure and protect the processed personal data, regulated in the Internal Regulation on Personal Data Protection at the company GINZEL, spol. s r.o. (hereinafter the “Internal Regulation”).
Customers and Suppliers have the right to contact the company GINZEL, spol. s r.o., as the Controller with all inquiries concerning the processing and protection of personal data and to exercise their data subject rights with the Controller, namely:
- in writing by letter/notice sent to the Controller’s registered office, Contact Point for Personal Data;
- electronically to the email address of the Contact Point for Personal Data: ;
- by telephone at tel. no.: +420 311 671 768;
- in person at the Controller’s registered office, Contact Point for Personal Data.
Data Processors
The Controller has not contractually appointed any processors to further process the personal data of Customers and Suppliers.
Purposes of personal data processing
The Controller processes selected personal data of Customers and Suppliers for the following purposes:
- performance of commercial contracts/negotiation of commercial contracts;
- fulfillment of obligations arising from tax legislation;
- protection of property and personal safety (e.g., camera system recordings – during negotiations and/or delivery of goods/services).
Legal bases for processing personal data
The legal bases for processing personal data of Customers and Suppliers pursuant to Article 6 of the Regulation with respect to the above purposes are:
- performance of contract;
- legitimate interests of the Controller;
- compliance with legal obligations of the Controller.
Methods and means of processing personal data
Personal data of Customers and Suppliers are processed by the Controller using the following methods and means:
- automated processing;
- in software systems (address and identification data of customers and suppliers);
- manual processing;
- in paper or electronic form – commercial contracts (including orders/confirmations), delivery notes, tax documents.
Camera systems
Camera systems are operated by the Controller on the premises of GINZEL, spol. s r.o., equipped with image recording functionality.
The camera systems consist of individual cameras placed to monitor the following areas: selected indoor warehouse spaces and outdoor handling area.
The camera system is operated by the Controller under the following conditions:
- purpose of processing: protection of property and personal safety;
- legal basis: legitimate interests of the Controller;
- with or without the consent of data subjects;
- data subjects affected: employees; customers and suppliers (entrepreneurs); clients and other natural persons present on the premises (trainees/students, visitors);
- categories of personal data: descriptive – image recordings (faces, figures);
- location of recordings: directly at the registered office/premises;
- retention period: 14 days from the date of recording;
- technical system security and physical protection: dedicated room for storage of recordings; recordings are technically blocked; access rights are restricted.
Areas monitored by camera systems are visibly marked with information signs containing pictograms and brief text.
Scope of personal data processing
Regarding the scope of data categories processed, the Controller processes the following personal data of Customers and Suppliers:
- name and surname, or business name, registered office, company ID, VAT ID, email address, phone number;
- image recordings (from camera system).
Retention period of personal data
The retention period or processing duration of personal data of Customers and Suppliers by the Controller is as follows:
- for the duration of the contractual relationship;
- for the duration of obligations arising from tax legislation / 5 years;
- for 14 days from the date of image recording (camera systems).
Rights of data subjects
Customers and Suppliers as data subjects have the following rights towards the Controller under Articles 15 to 22 of the Regulation:
- the right of access to personal data, including the right to request information about the processing of their personal data from the Controller;
- the right to rectification of personal data if the data are inaccurate;
- the right to erasure of personal data (“right to be forgotten”);
- the right to restriction of personal data processing;
- the right to object to the processing of personal data;
- the right not to be subject to automated individual decision-making, including profiling (with exceptions).
In addition, the data subject has the right to file a complaint with the supervisory authority, which is:
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7