1 General Provisions
2 Data Controller and Contact Details
The controller of your personal data is CTP Invest, spol. s r.o., with its registered office at Central Trade Park D1 1571, 396 01 Humpolec, ID: 261 66 453, registered in the Commercial Register maintained by the Regional Court in České Budějovice, file C 15647.
Updated contact details and other information on all companies of the CTP group can be found at https://www.ctp.eu/contact.
3 Personal Data of Business Partners and Their Contact Persons
3.1 Purposes of the processing and retention period
We may process personal data relating to you as our Business Partner and/or Business Partner’s board members, employees, sub-contractors and/or other contact persons provided to us (the “Contact Persons”) in order to perform the contractual obligations arising from an agreement (such as lease, supply, vendor or any other agreement) and to ensure more effective communication between the contractual parties. It follows that the personal data are processed mainly for the following purposes:
3.1.1 Fulfilment of contractual obligations. Personal data are processed for the purpose of performance of the agreement that you, as a Business Partner, have concluded with us, and further also for potential warranty claims related to goods and services that you provide us with and for maintaining records of our suppliers. The data are stored for the period of existence of the contractual relationship between you and us. Provision of personal data in these cases is an indispensable condition for the conclusion and performance of the agreement and without the personal data it is impossible to enter into, maintain or perform the agreement.
3.1.2 Effective communication. We process personal data relating to you (our Business Partner and/or Contact Persons) for the purpose of ensuring effective communication between you, as our Business Partner, and us, as well as for the purpose of ensuring effective administration of our contractual relationship. This may include, for example, communication with you and your employees and workers, defects management, ensuring the security of all persons on our premises, preventing damage to the property of our tenants, suppliers and other persons and mitigating the damage already incurred, etc. The personal data necessary for this purpose is retained primarily for the period of the duration of our relationship.
3.1.3 Accounting records. Some personal data may be included in the accounting records (mainly invoices). According to applicable laws of the Czech Republic (e.g. Accounting Act, VAT Act), we have obligations to keep these records for the period of 10 years. If we have a legal obligation to archive these records, we archive them together with your personal data stated therein.
3.1.4 Determination, exercise and defense of legal claims. Following the termination of our contractual relationship we may continue to process the personal data that are necessary for the protection of our rights and for the potential defense of our legal claims, including collection of outstanding payments. The personal data that are no longer needed, or there is no longer a legal basis for their retention, are irreversibly rendered anonymous or destroyed in a secure manner. If disputes arise and we must defend ourselves, act or even make claims against you or third parties, we may retain the personal data that we deem reasonably necessary for processing for these purposes, for a period of time in which such a claim can be pursued.
3.2 Extent of personal data processing
We process personal data that we have obtained directly from our Business Partners or you as a Contact Person. In order to ensure that we process only data that are accurate and up-to-date, we may regularly update the data also from public sources (mainly the commercial register, the trade licensing register, ARES, the insolvency register and Business Partners’ web sites).
The scope of personal data that we usually process for the purposes described above includes: name, company name, work position, phone number, email address and/or other information relating to the performance of the agreement between the Business Partner and us, including, but not limited to, the information about payments, service deliverables etc.
4 Marketing Communications
4.1 Newsletter and information about CTP activities
Based on your consent, we can send our newsletter and other related information about CTP Group’s activities such as information about our services and products, promotion deals, and events organized by us or other entities within the CTP group (www.ctp.eu). You can subscribe to the newsletter via an online form which is accessible on several websites operated by us or another entity of the CTP group (such as www.ctp.eu, www.domeq.cz, www.vlnena.eu, jobs.ctp.eu, www.ponavka.eu).
If you wish to subscribe to our newsletter you will be asked to submit your personal data in the extent of name, surname, email address and phone number (optional). We may also process your reactions or feedback regarding the newsletters that we send to you.
4.2 Photos and videos from our events
If you give us your consent, we may also process additional personal data for marketing purposes of the CTP or other entities within the CTP Group, e.g. recording, publishing and storing of photographs or videos capturing you which were recorded at one of the events organized by us or another entity of the CTP group.
4.3 Purposes of the processing and retention period
The purpose of the processing is the market research, promotion of products and services, particularly sending offers and personalized commercial information, organization and promotion of events and other marketing activities of the CTP and other entities of the CTP group.
The personal data are process based on your consent, that you can withdraw at any time. The retention period corresponds to the duration of the consent and shall not exceed the period of three years from the date when the consent was granted.
5 Social Media
7 Sharing and Transfer of Personal Data (Recipients of Personal Data)
Your personal data may be shared with:
- within the CTP Group (ctp.eu);
- providers of IT, marketing or administrative services, such as ETTEA Group s.r.o., Enerfis s.r.o., TMF Czech, a.s. or Management Data Praha spol. s.r.o., Google LLC, IMPER CZ, s.r.o.;
- external auditors, consultants, tax advisors and legal representatives bound by confidentiality obligation for the protection of our legitimate interests;
- public prosecution bodies, courts and administrative authorities in accordance with our legal duties.
8 Data Security
We have implemented and maintain appropriate technical and organizational measures, internal controls and information security processes in accordance with legal requirements and market standards corresponding to a possible threat to you as the data subject. We also take into consideration the state of technological development in order to protect your personal data from accidental loss, destruction, alterations, unauthorized disclosure or access. Such measures may, among other things, include taking reasonable steps to ensure the liability of relevant employees who have access to your data, training of employees, regular backups, procedures for data renewal and management of incidents, software protection for devices on which personal data are stored, etc.
9 Your Rights as a Data Subject
If you wish to exercise any of your rights according to this Article or according to applicable legislation, please contact us using the contact information listed in Article 2 above.
9.1 Access to and portability of your personal data
You have the right to obtain confirmation as to what personal data we process or do not process with respect to you. Should you request it, we can send some of your personal data (namely the data that we process on the basis of the fulfilment of a contract and/or your consent) directly to a third party (to another data controller) whom you state in your request, provided that such request does not affect the rights and freedoms of other persons, and provided that it is technically feasible
You can access your personal data via aforementioned contact details.
9.2 Withdrawal of consent
Please note that the withdrawal of your consent does not affect the lawfulness of processing conducted on the basis of consent prior to its withdrawal
9.3 Rectification of your personal data
According to applicable legislation, you have the right to rectification of your personal data that we are processing if you find that they are inaccurate or incomplete.
To request rectification of your personal data, please contact us via the aforementioned contact details.
9.4 Erasure of your personal data
You can request erasure of your personal data at any time. The scope within which we can comply with your request for erasure of personal data may be limited by our statutory obligations to store some personal data, particularly on the basis of accounting and tax regulations, etc. Further, we will also erase all of your personal data (and ensure erasure thereof by the processors that we engage) if you withdraw your consent.
9.5 Restriction of processing
If you request us to restrict the processing of your personal data, for example when you contest the accuracy, lawfulness or our need to process your personal data, we will limit processing of your personal data to a necessary minimum (storage), and if applicable we will only process this data to establish, exercise or defend legal claims or where necessary in order to protect the rights of other natural or legal person, or for other limited reasons required by the applicable law.. In case the restriction is lifted, and we continue processing your personal data, you will be informed accordingly without undue delay.
The request for restriction of processing can be made using the aforementioned contact details.
9.6 Objections to processing
You can object to data processing. If we do not demonstrate any compelling legitimate reasons for the processing which would override your interests or rights and freedoms, we will no longer process your personal data and will delete it without undue delay.
Objections to processing can be raised using the aforementioned contact details.
9.7 Complaint to a Data Protection Authority
You have the right to lodge a complaint pertaining to processing of data conducted by us with the competent data protection authority, i.e. in Czech Republic the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7; website: www.uoou.cz.