Information on the Processing of Customers’ Personal Data
Based on EU Regulation 2016/679 (hereinafter “GDPR”), we provide you with information on the processing of customers’ personal data that occurs in connection with our heat treatment of metals services.
1. Contact details
The controller of personal data is:
Galvamet spol. s r.o.
Jasenice 783
Vsetín 755 01
Contact details for the person responsible for personal data protection: referent.ochrany@galvamet.cz
tel.: +420 724 928 420
2. Personal Data Processing Table
|
Name of processing |
Purpose of processing |
Categories of personal data |
Legal basis |
Legal basis details |
Retention period |
Other recipients |
Source of data |
|
Order details |
Ensuring delivery of the order |
Contact and billing details |
Performance of a contract |
For the duration of the contract |
None |
Data subject |
|
|
Legal obligation |
Value Added Tax Act |
10 years |
|||||
|
Processing of personal questionnaire |
Preparation of an employment contract |
Identification and contact details |
Performance of a contract |
Employment contract |
For the duration of the employment contract |
None |
Data subject |
|
Legitimate interest |
Company management |
||||||
|
Consent |
Until consent is withdrawn |
||||||
|
Customer records, etc. – Address book
|
Company management via the QI system
|
Contact and billing details
|
Conclusion or performance of a contract
|
10 years
|
None
|
Data subject
|
|
|
Supplier records
|
Supplier records for orders
|
Contact and billing details
|
Legitimate interest
|
10 years
|
None
|
Data subject
|
- Explanations to the table and processing
Legal bases – these are statutory justifications for processing and are defined in GDPR Articles 6 and 9.
Retention period – means the period for which we are entitled or obliged to process and retain your data.
Other recipients – here we indicate any further recipients to whom data is disclosed. If “None” is stated, it means we do not disclose it to anyone.
Source of data – here we indicate from whom we obtained the personal data. If “Data subject” is stated, it means we obtained it directly from the person concerned.
We do not intend to transfer your personal data outside the EU or to any international organization.
In cases where processing is based on the legal basis “Conclusion or performance of a contract”, we require your personal data to conclude the contract and subsequently perform it; without it, the contract cannot be concluded.
In cases where processing is based on the legal basis “Legal obligation”, we must process your personal data based on statutory requirements for the period specified by the relevant law, and during this period we may not restrict or delete such processing.
Your personal data will be processed only for the purposes listed in the table.
We obtain personal data directly from data subjects.
- Description of data subjects’ rights
As a data subject (a natural person whose data is processed), you have the following rights regarding your personal data:
|
Right |
Explanation |
|
Request a record |
This is a record of the data we keep about you, i.e. the right of access. We will provide the record in a format according to our capabilities. You do not have the right to demand a record in a format specified by you. Exceptions where we must not provide the record are cases concerning documents whose disclosure would endanger the rights and freedoms of other persons. This concerns personal data of other persons, protection of trade secrets, intellectual property, etc. |
|
Request rectification
|
If you discover that we keep inaccurate, outdated or incomplete data about you, please request their correction or completion. |
|
Request erasure
|
We must erase personal data where we would otherwise store it beyond the specified retention period or if we had no valid legal basis. By law, we must not erase personal data where processing is carried out on the basis of performance of a contract or a legal obligation. |
|
Right |
Explanation |
|
Request restriction of processing |
This concerns processing based on legitimate interest. Restriction of processing will occur in the event of an objection and will last for the duration of the assessment of the objection. |
|
Object to processing |
An objection may be lodged in cases where processing is carried out on the basis of legitimate interest. An objection to the sending of commercial communications will always be upheld. In cases where your name or other contact details are used in the interest of providing services, the possibility of misuse is almost excluded and such activities are necessary. We therefore consider this legitimate interest to prevail and do not uphold objections. |
|
Withdraw consent to processing |
This is possible in cases where processing is carried out on the basis of consent. If you have given consent to processing and withdraw it, processing will be terminated. |
|
Request a record in a portable format
|
You may request a record in a portable format only in cases of processing based on the legal bases of performance of a contract or consent. You may request only those data that you have provided to us and that we keep in electronic form, and you do not have the right to demand a specific format. We will provide it in XLS format with named columns. |
|
Object to automated decision-making |
We do not carry out any processing based on automated decision-making. |
|
Lodge a complaint with the supervisory authority
|
If we do not respond to your request within 1 month, you may lodge a complaint with the Office for Personal Data Protection. |
How to exercise your rights
If you wish to exercise any of these rights, you can submit a request as follows:
At the company reception, your identity will be verified by your ID card or passport, a request will be drawn up with you, and a date for processing will be communicated. Without identity verification, it is not possible to accept the request.
On the date of processing, after identity is verified again, you will be provided with a written Notification of the result of the request and related materials.
For a request for more than one copy, we are entitled to charge a fee corresponding to administrative costs.
Acts related to the exercise of data subjects’ rights are carried out free of charge.
However, if requests are found to be manifestly unfounded or excessive, in particular because they are repetitive, we may:
a) impose a reasonable fee taking into account administrative costs; or
b) refuse to comply with the request.
If you want to submit a request electronically:
a) send it by e‑mail to referent.ochrany@galvamet.cz with a valid electronic signature; without this identity confirmation it cannot be accepted.
b) Or send it from your data mailbox to the data mailbox wdj7k69
Please include:
1) Identification data – first name, surname, date of birth
2) Which right you are exercising – see the chapter Description of data subjects’ rights
3) Clarification of the request – e.g., correct data in the case of rectification
4) Telephone – for any clarifications and to agree on the next steps
If there are doubts about your identity, we are entitled to ask you to provide additional information to confirm your identity.
