CONSENT TO PROCESSING OF PERSONAL DATA

As the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) is entering into effect, personal data of natural persons provided to our company PBS INDUSTRY, a.s. (hereinafter the “controller”) beyond the scope of statutory obligations will not be able to be processed by the controller after 25 May 2018 without the granting of the consent of such persons (data subjects).

Purposes of Processing. By granting consent, the data subject grants the controller consent to the processing of his/her personal data, i.e. in particular his/her name and surname, email address, telephone contact, banking information and other identification, contact, descriptive or other personal data that the data subject has provided or will provide to the controller, exclusively for the controller’s marketing and business purposes. Marketing and business purposes are considered to mean the classification of data, retention of data on typical behavior, developing anonymized analyses, as well as a set of activities whose purpose is to inform of the controller’s products and services, of events being organized, fairs and exhibitions being held that relate to the controller’s sector/activity, creating targeted offers, as well as an actual appeal on behalf of the controller with a commercial offer of products and services, in writing, by telephone or by electronic means through contact details that the data subject has provided the controller with. By granting consent to the processing of his/her personal data, the subject also consents to the processing of such data by a third party distinct from the controller (i.e. a processor of personal data) that the controller authorizes to process personal data.

Duration of Processing of Personal Data. By consenting to the processing of personal data, the data subject grants consent to processing for a duration of ten (10) years, unless such consent to the processing of personal data is withdrawn by the data subject in the manner as set out below.

Voluntary Nature of Consent. Consent to the processing of personal data is granted by the data subject voluntarily and without charge. The granting of such consent is not a precondition to the provision of any services or products.

Withdrawal of Consent. The provision of this consent to the processing of personal data is voluntary and the data subject can withdraw it at any time and free of charge, by way of an express, comprehensible and definite statement made either through an email message sent to the following address: info-gdpr@pbstre.cz or in writing to the controller’s address (correspondence address): PBS INDUSTRY, a.s., Průmyslová 162, Jejkov, 674 01 Třebíč, these being the controller’s contact details. There is no risk of penalties or other disadvantage as a result of the withdrawal of consent.

The withdrawal of consent shall not affect the legality of the processing based upon the consent that had been given prior to its withdrawal. Further, the withdrawal of consent shall not affect the controller’s obligation to process personal data on the basis of legal grounds other than consent (i.e., in particular, if processing is necessary for the performance of a contract, for the fulfillment of a legal obligation, or due to other reasons as set out in the relevant legal regulations).

Manner of Processing. The controller will process your personal data on the basis of the granted consent to the processing of personal data only for the purpose and within the scope as set out above. The controller will process personal data by automated means as well as manually. The controller keeps records of activities in the course of which the processing of personal data occurs. Personal data will be processed in accordance with all of the valid legal regulations for the protection of personal data under the law of the Czech Republic and EU law.

Access to Personal Data. Personal data may be disclosed to the controller’s employees, as well as to third parties who provide guarantees of the implementation of appropriate technical and organizational measures in such a way so that the given processing of personal data fulfills the requirements of the relevant legal regulations on the protection of personal data under the law of the Czech Republic and EU law. Processors of personal data process personal data only within the scope of the controller’s instructions, such processors being primarily IT systems administrators, software providers and other processors with whom a processing agreement has been entered into, regulating the rights and obligations in the processing of personal data. Personal data will not be transferred to processors outside of the territory of the EU. The controller is also obligated, in cases set out in the relevant legal regulations, to transfer personal data to administrative authorities, courts or other public authorities.

Your Rights. Under the relevant legal regulations on the protection of personal data, subjects whose personal data a controller is processing on the basis of their consent have the following rights:

• the right of access to all personal data being processed, i.e. the right to obtain, primarily from the controller, a confirmation as to whether it is processing your personal data, to obtain information on the purposes of processing and categories of personal data being processed, information on the recipients to whom personal data have been or will be disclosed, or to obtain a copy of the personal data provided that the rights and freedoms of other persons will not be adversely affected,
• the right to withdraw their consent to the processing of personal data at any time – consent to the processing of personal data for marketing and business purposes can be withdrawn at any time after its effective date, with reservations and in the manner as set out above (see “Withdrawal of consent”),
• the right to have processed personal data corrected (specified or filled in),
• the right to the erasure of personal data, unless the controller proves legitimate grounds for the processing of the personal data,
• the right to the restriction of processing of personal data until the settlement of a motion or repudiation in regard to the accuracy of personal data by the data subject, or of the grounds for the processing thereof, by sending a written request to the same address as in the case of withdrawal of consent,
• the right to obtain the personal data being processed and to transfer such personal data to another controller (the right to the portability of personal data), in a structured, commonly used and machine-readable format, as well as the right to request the transfer of such data to another controller, if the person acting on behalf of the relevant controller is properly specified and can be authorized,
• the right to be informed of a breach of personal data security in cases set out in the relevant legal regulations for the protection of personal data,
• the right to lodge a complaint with the Office for Personal Data Protection (address: Pplk. Sochora 27, 170 00 Praha 7, tel. no. +420 234 665 111, email: posta@uoou.cz, www.uoou.cz).