PRINCIPLES OF PERSONAL DATA PROCESSING

Administrator:
HELDENBURG s.r.o.
V Zahradách 16/842 Praha 8
ID n.: 26509245

The Administrator proceeds to the protection of personal data of individuals pursuant to Act No. 110/2019 Coll., on the protection of personal data and amending certain acts, as amended (hereinafter referred to as the “Regulation”) as one of its priorities. The acquisition and processing of personal data is not the main objective and subject activities of the Administrator, which is the organization of seminars, courses and other events. The Administrator shall implement, observe and regularly update measures aimed at ensuring maximum protection of the data subjects' personal data processed by the controller. These measures include the following principles of personal data processing, which summarize basic information on what personal data the Administrator processes in its activities, for what time period, for what purpose and for what reason for processing under the Regulation.

The principles of personal data processing are based on Article 5 of the Regulation.

1. PERSONAL DATA of natural persons processed by the Administrator

   The administrator usually processes personal data:

   • name surname,
   • email address,
   • photo(s) which have been taken during events

    

2. PURPOSES, TIME AND LEGAL REASONS FOR PROCESSING

   Personal data is always processed only to the extent necessary for the purposes for which such personal data is needed. The processing of personal data always occurs on the basis of a legal reason and within its limits.
   The Administrator processes personal data to:

   • keep a register of participants (data subject) of the seminar and the subsequent possibilities of these subjects to participate in the event
   • increase security of provided services
   • send information about courses / seminars or other events organized by the Administrator
   • fulfill Accounting and tax records
   • fulfill other legal obligations

    

   Specifically, personal data is processed for the following purposes:

   • e-mail for primary communication with participants
   • email, name and surname as filled in on the registration form

    

   The Administrator processes personal data for the following reasons:

   • the data subject has given their consent to the processing of their personal data for one or more specific purpose (eg publication of photographs on the website);
   • processing is necessary for the performance of the contract (meaning participation in the seminar) or for carrying out pre-contractual measures at the request of the data subject;
   • legitimate interest;
   • processing is necessary to comply with the legal obligation of the Administrator;

    

   In the case of processing of personal data with the consent of the data subject, the provision of the data is entirely voluntary and the consent granted can be withdrawn at any time.

   However, this does not affect the legality of the processing carried out prior to the withdrawal of consent.

   The Administrator processes personal data only for as long as it is necessary for the purpose (eg holding a seminar) or for a period set by law.

   All personal data is processed only for the above purposes.

3. TRANSMISSION TO AND PROCESSING OF PERSONAL DATA BY A THIRD PARTY

   If the Administrator uses services of specialized entities, such as marketing agencies, IT service providers and other suppliers, these persons are usually in the position of a personal data processor who operate exclusively in accordance with the instructions of the

   At the moment the data used by Administrator are not being processed by any specialized entities.

   Administrator. The processors for the Administrator are in particular:
   the Administrator transmits personal data also in the case of fulfilling a legal obligation (eg at the request of the Police of the Czech Republic) or while protecting their rights.

   The transfer of personal data to third parties shall always take place in accordance with the relevant legislation and in compliance with the highest standard of personal data protection, ensuring that the rights of data subjects are properly preserved and that their privacy is protected.

4. DATA SUBJECT RIGHTS

   Right of access to personal data
   Right to lodge a complaint with the Supervisory Authority.
   The data subject shall have the right of access to personal data and may ask the Administrator:

   • whether it processes their personal data,
   • the purposes of processing,
   • the categories of personal data concerned,
   • the planned processing time,
   • to correct or delete personal data,
   • to limit their processing or to object to such processing,
   • the source of the personal data, if not obtained from the data subject,
   • if automated decision making, including profiling, takes place.

    

   Upon the data subject's request, the Administrator shall provide a copy of the personal data processed. If the data subject repeatedly requests a copy of the processed personal data or the data subject's request is manifestly unreasonable or disproportionate, the Administrator is entitled to reject the request.

   Right to correct inaccurate data
   The data subject has the right to correct inaccurate personal data processed by the controller.

   Right to delete personal data
   The data subject may at any time request the deletion of their personal data. The Administator shall delete all personal data of the data subject without undue delay if it determines that the data subject's request is justified and the Administarotor does not have to process the personal data for a legal obligation.

   Right of processing limitation
   The data subject shall have the right to have the Administrator to restrict processing in any of the following cases:

   • during the time necessary for the Administrator to verify the accuracy of disputed personal data;
   • the processing is not in accordance with the terms and the data subject chooses not to delete personal data and requests instead to restrict their use;
   • the Administrator no longer needs personal data for processing purposes, but the data subject requires them to identify, exercise or defend legal claims;
   • the data subject has disputed the processing and until the dispute is resolved;

    

   Where processing has been restricted in accordance with the above points, such personal data may, except for storage, be processed only with the consent of the data subject or for the purpose of determining, exercising or defending legal claims, of an important public interest of the Union or a Member State.

   The data subject who has requested the processing restriction pursuant to the above points shall be notified by the Administrator in advance if the processing restriction will be lifted.

   Right to portability of personal data
   Each data subject shall have the right to obtain their collected personal data in a structured, commonly used and machine-readable format. Each data subject shall also have the right to request that the Administaror transfer such data to another controller, but this right may be exercised only in specified cases, provided that the processing of personal data is carried out automatically and is based on:

   • the consent of the data subject pursuant
   • performance of a contract to which the data subject is a party pursuant

    

   Right to object to the processing of personal data and Right to lodge a complaint
   The data subject has the right to object to the processing of his personal data by the Administrator. Unless it is shown that there is a valid reason for processing that outweighs the interests or rights and freedoms of the data subject, the Administrator shall terminate the processing of the personal data in question without undue delay.

   Every data subject has the right to file a complaint regarding the processing of personal data with the Supervisory Authority, namely the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, website www.uoou.cz.

5. CONTACTS AND REQUESTS OF DATA SETS

   The data subject may exercise his rights under the Regulation at the controller's contact address, which is: HELDENBURG s.r.o. V Zahradách 16/842 Praha 8. All requests related to the processing of personal data must be sent in electronic form to the e-mail address info@heldenburg.cz, where the subject of the e-mail must include the abbreviation “ GDPR 'or in paper form to the contact address

   The data subjects' request shall specify what it relates to and what rights the data subject wishes to use.
   The controller may only disclose the personal data of the data subject to the data subject to whom the personal data concerned relates. If the Administrator has doubts about the identity of the person requesting information, he / she can request additional information necessary to confirm the identity of the data subject (submitting the request).