Basic summary
VAFO PRAHA, sro processes your personal data as it is necessary for the fulfillment of contractual relationships regarding your participation in the loyalty system. If you have indicated on the loyalty card your consent to the processing of your personal data for the purpose of sending commercial communications (marketing offers), your personal data will also be processed for this purpose. You can revoke this consent at any time and commercial communications will no longer be sent to you. Your personal data will be collected by the operator of the retail establishment (personal data processor), based on a personal data processing agreement concluded between VAFO PRAHA, sro and such processor.
1. Identity and contact details of the controller
The administrator of your personal data is the company VAFO PRAHA, sro, with its registered office at K Brůdku 94, 252 19 Chrášťany, Company ID: 614 99 587, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 30564 (hereinafter referred to as the "Administrator").
The contact details of the administrator are as follows: delivery address K Brůdku 94, 25219 Chrášťany, e-mail address osobniudaje@vafo.cz, telephone number 257952141.
The administrator has not appointed a data protection officer.
2. Legal basis for processing personal data
The legal basis for processing your personal data is that such processing is necessary for the performance of a contract between you and the controller or for the controller to take steps prior to entering into such a contract within the meaning of Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "Regulation").
If you have indicated on the loyalty card your consent to the processing of your personal data for the purpose of sending commercial communications (marketing offers), the legal basis for the processing of your personal data is also your consent given to the controller within the meaning of Article 6(1)(a) of the Regulation.
3. Purpose of processing personal data
The purpose of processing your personal data is to fulfill the contract between you and the administrator regarding your participation in the loyalty system.
If you have indicated your consent to the processing of your personal data for the purpose of sending commercial communications (marketing offers) on the loyalty card, the purpose of processing your personal data is also to send commercial communications to you by the administrator.
The controller does not make any automatic individual decision-making within the meaning of Article 22 of the Regulation.
4. Period of storage of personal data
Your personal data will be processed for the duration of the effects of the rights and obligations under the contract, and for the period necessary for archiving purposes in accordance with the relevant generally binding legal regulations, but no longer than for the period specified by generally binding legal regulations.
The period for which your personal data processed by the controller for the purpose of sending commercial communications to you (Article 3.2) will be stored is four (4) years from the date of your consent to such processing, but no longer than until you withdraw your consent to the processing of your personal data for this processing purpose.
5. Other recipients of personal data
Other recipients of your personal data will be persons providing technical services related to the operation of the loyalty system for the administrator, including the operation of software and data storage, as well as store operators who participate in the loyalty system as partners (personal data processors).
Other recipients of your personal data processed by the controller for the purpose of sending commercial communications to you (Article 3.2) will be persons forming the controller's group and persons providing marketing services for the controller in accordance with the controller's instructions (personal data processors).
Other recipients of your personal data will be providers of advertising tools and tools for e-mailing and marketing automation.
The Administrator does not intend to transfer your personal data to a third country (a country outside the EU) or an international organization, except for the transfer of your personal data for the purpose of sending commercial communications to you (Article 3.2) to the United States of America to SendGrid, Inc., with its registered office at 1801 California Street, Suite 500 Denver, Colorado 80202. SendGrid, Inc. is a certified entity under the EU-US Privacy Shield within the meaning of Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 issued pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield.
6. Rights of the data subject in the event of processing in connection with participation in a loyalty scheme
Under the conditions set out in the regulation, you have the right to request access to your personal data from the controller, the right to rectify or erase your personal data, or to restrict their processing, and the right to the portability of your personal data.
If you believe that the processing of your personal data has violated or is violating the regulation, you have the right, among other things, to file a complaint with the supervisory authority.
You are not obliged to provide personal data. Providing your personal data is a necessary requirement for concluding and fulfilling the contract (participation in the loyalty system) and without providing your personal data, it is not possible to conclude the contract or for the administrator to fulfill it.
7. Rights of the data subject in the event of processing for the purpose of sending commercial communications.
In the case of personal data processed by the controller for the purpose of sending commercial communications to you (Article 3.2):
You are not obliged to provide personal data. Providing your personal data is not a legal or contractual requirement, nor is it a requirement that is necessary to conclude a contract.
You have the right to withdraw your consent to the processing of your personal data given to the administrator at any time. However, this does not affect the lawfulness of the processing of your personal data before such withdrawal of consent. You can withdraw your consent to the processing of your personal data by clicking on the hyperlink provided in each commercial communication message sent by the administrator or by writing a message by e-mail to the administrator's address: osobniudaje@vafo.cz.
You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling, where profiling is related to such direct marketing. If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for these purposes.