II. Information about the processing of personal data
II.1. Information about the personal data controller
Your personal data controller is the Czech Philharmonic (Česká filharmonie), registered office: Alšovo nábřeží 79/12, 110 00 Praha 1, Company ID: 000 23 264, a public-benefit corporation.
II.2. Purposes of and legal basis for processing
II.2.1. Processing of personal data without your consent
This usually involves situations when you are required to provide personal data as a condition in order for us to be able to provide you with our products and/or services, or when we are entitled to process your personal data obtained in some other manner.
(a) By law, we are entitled to process your personal data without your consent for the following purposes in order to comply with our legal obligations:
(i) to prevent damages to the assets of our organisation;
(ii) to prevent the perpetration of fraud against our organisation;
(iii) to perform any duties involving client identification and due diligence under the Act on the Prevention of Money Laundering and Terrorist Financing;
(b) conclusion or performance of an agreement with you.
This mainly involves the actual realisation of contractual relations or other contractual performance between you and our organisation. Personal data are necessary inter alia to make possible the realising of contractual relations without excessive legal risks, including negotiations with you over the concluding or amending of an agreement.
(c) protection of rights and of legally protected interests, especially for:
(i) protecting the rights and legally protected interests of our organisation, collecting receivables, securing or otherwise claiming receivables, and the advancement and development of services provided;
(ii) negotiations with parties interested in the assignment of a client’s debt or in some other form of succession or transfer of receivables, including associated implementation, and other subsequent dealings with third parties, and in particular the informing of providers of related credit protection etc.;
(iii) the resolution of disputes, and in particular for lawsuits or other dispute resolution.
(d) our own legitimate interests.
This mainly involves situations where there is a contractual and/or customer relationship between you and our organisation.
II.2.2. Processing of personal data with your consent
This generally involves situations when you voluntarily consent to our processing of your personal data. On the basis of your consent, our organisation processes your personal data for the following purposes:
(a) exercising rights and performing duties arising from an agreement with you; this is a situation where your personal data is processed for the performance of an agreement;
(b) client care; these are activities that do not represent contractual performance or any other legal framework for the processing of personal data and that include the following:
(i) market research;
(ii) monitoring clients’ behaviour on our organisation’s website in connection with the services offered (this purpose does not involve the mere obtaining of information about the behaviour of users visiting the website of our organisation by means of cookies as described below in the paragraph on electronic means of communication and mobile applications);
(c) offering of products and services; this mainly involves the dissemination of information and the offering of our organisation’s products and services by various means (mail, electronic media including e-mail and messages sent to mobile devices, telephone calls, and through the website).
Providing personal data for the purposes of contractual performance and providing personal data for the purposes of our caring for you as a customer are our contractual requirements, and failure to provide the data may result in failure to conclude an agreement or our inability to provide adequate customer care.
II.3. Extent of processing of clients’ personal data
Our organisation processes your personal data to the extent necessary for the attaining of the purposes set forth above. We process contact information (contact addresses, telephone numbers, e-mail addresses, fax numbers, or other similar contact information), identifying information (first and last name, date of birth, address of permanent residence, and also the Company ID number and VAT number for clients who are individual entrepreneurs), and surveillance video.
II.4. Manner of processing of the personal data of individual entrepreneurs
The manner in which our organisation processes your personal data includes manual and automated processing in the information systems of our organisation and in material form.
Your personal data are processed primarily by the employees of our organisation and, to the extent necessary, by third parties. Before any forwarding of your personal data to a third party, we always enter into a written agreement with that party containing the same guarantees for the processing of personal data with which our organisation complies in accordance with its legal duties.
II.5. Recipients of personal data
Access to your personal data is granted mainly to the employees of our organisation in connection with the performance of duties at work that require them to handle the personal data of clients, but only to the extent that is necessary in the particular case in question and while complying with all security measures.
In addition, your personal data are forwarded to third parties that take part in the processing of the personal data of our organisation’s clients; they may also be granted access to these personal data for other reasons in compliance with legislation.
In particular, the forwarding of personal data is directed towards:
(a) the law firm that represents us;
(b) our accounting and tax consultancy agency;
(c) our marketing agency;
(d) processors who provide us with server, website, cloud, and IT services.
Before any forwarding of your personal data to a third party, we always enter into a written agreement with that party containing regulation of the processing of personal data with the same guarantees for the processing of personal data with which our organisation complies in accordance with its legal duties.
II.6. Duration of personal data processing
Our organisation processes clients’ personal data only for as long as is necessary for the purposes of their processing. We continually evaluate whether there is an ongoing need for the processing of particular personal data for a definite purpose. If we determine that data are no longer needed for any of the purposes for which they have been processed, we delete them. With regard to certain purposes for the processing of personal data, however, we have already made an internal evaluation of the usual period during which personal data may be used, and once that period has lapsed, we make an especially careful evaluation of the need for processing the relevant personal data for the purpose in question. At the same time, in this context:
(a) we process personal data for contractual performance for the duration of the contractual relationship with the client; thereafter, the personal data in question may usually be used for a period of ten years;
(b) we process personal data for the offering of products and services for the duration of the contractual relationship; thereafter, the personal data in question may usually be used for a period of ten years;
(c) we process personal data for client care for the duration of the contractual relationship with the client; thereafter, the personal data in question may usually be used for a period of ten years;
(d) we process personal data for protection of rights and guarding of legally protected interests in the form of video surveillance; thereafter, the personal data in question may usually be used for a period of 14 days.
II.7. The right to revoke consent
In this notification, we have explained the reasons for which we need your personal data and that we may process them for some purposes only with your consent. You are not required to grant our organisation permission to process your personal data, and you are also entitled to revoke that permission. We would remind you that we are entitled to process some personal data for certain purposes even without your consent. If, in such a case, you revoke your consent, we will terminate the processing of the personal data in question for purposes requiring relevant permission, but we may be entitled or even required to continue to process the same personal data for other purposes.
If you wish to revoke your consent to the processing of personal data, please contact us at our headquarters at the address Alšovo nábřeží 79/12, 110 00 Praha 1 or by e-mail at email@example.com.
II.8. Sources of personal data
We obtain clients’ personal data mainly:
(a) from the clients themselves;
(b) from publicly available sources (public registers, records, or lists);
(c) from parties potentially interested in our organisation’s services in connection with marketing events and campaigns;
(d) from our own activities through the processing and evaluation of clients’ other personal data;
(e) from surveillance video.
II.9. Your rights in connection with the processing of your personal data
You can exercise all of your rights at our headquarters at the address Alšovo nábřeží 79/12, 110 00 Praha 1 or by e-mail at firstname.lastname@example.org. You can also lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection (www.uoou.cz).
II.9.1. The right of access means that you may at any time demand that we provide confirmation about whether or not personal data that apply to you are being processed, and if so, for what purposes, to what extent, to whom they are made accessible, for how long we will be processing them, whether you are entitled to their correction, deletion, limitation on their processing, or to raise an objection. You may also demand information about the sources from which we have acquired the personal data and whether automatic decisions including profiling, if any, are made on the basis of the processing of your personal data. You also have the right to receive a copy of your personal data. This is provided free of charge the first time. Thereafter, we may require payment of a reasonable fee to compensate for administrative costs.
II.9.2. The right to correction means that at any time you may demand that we correct or supplement your personal data if they are inaccurate or incomplete.
II.9.3. The right to deletion means that we must delete your personal data if (i) they are no longer necessary for the purposes for which they were compiled or otherwise processed, (ii) their processing is illegal, (iii) you raise an objection to their processing, and there exist no overriding legitimate grounds for their processing, or (iv) we are required to do so by law.
II.9.4. The right to limitation on processing means that until we have resolved any points under dispute regarding the processing of your personal data, we must limit the processing of your personal data such that we may only keep them stored, and we may, if necessary, use them for the purpose of determining, exercising, or defending legal claims.
II.9.5. The right to raise an objection means that you may raise an objection to the processing of your personal data, which we process for purposes of direct marketing or on the grounds of a legitimate interest. If you raise an objection to processing for the purposes of direct marketing, you personal data will no longer be processed for those purposes.