I. Basic Provisions
In accordance with Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), the personal data controller is Ricard & Bonette s.r.o., Business ID Number: 04740068, Registered Office: Bermanova 985/18, 196 00 Prague 9 (hereinafter the “Controller”).
The Controller’s contact details are:
Address: Bermanova 985/18, 196 00 Prague 9
E-mail address: Jakub@ricardbonette.com
Telephone: +420 775 698 265
Personal data shall be understood to mean all information about an identified or identifiable natural person; an identifiable natural person is a natural person who can be directly or indirectly identified, especially with reference to a particular identifier, for example, name, identification number, location data, network identifier or one or more particular elements of the physical, physiological, genetic, mental, economic, cultural or social identity of such natural person.
The Controller has not appointed a personal data protection officer.
II. Sources and Categories of Processed Personal Data
The Controller processes the personal data which you provide to it or the personal data which the Controller obtains through any request you make. The Controller processes your identification and contact details and any data necessary to perform a request.
III. Statutory Reason and Purpose of Personal Data Processing
The statutory reason for processing personal data is the performance of an agreement between you and the Controller in accordance with Art. 6(1)(b) of the GDPR, the Controller’s legitimate interest in the provision of direct marketing (in particular, sending business statements and newsletters) in accordance with Art. 6(1)(f) of the GDPR, your consent to processing for the purposes of providing direct marketing (in particular, sending commercial communications and newsletters) in accordance with Art. 6(1)(a) of the GDPR in connection with Section 7(2) of Act No. 480/2004 Coll., on some information society services, in the event that goods or services are not ordered.
The purpose of personal data processing is dealing with your request or a subsequent order and exercise of the rights and performance of duties resulting from a contractual relationship between you and the Controller; in the case of a request, personal data are requested as necessary for successfully dealing with the request (first name, surname, e-mail address and contact telephone number); the provision of personal data is a necessary requirement for dealing with a request.
The Controller does not engage in automated individual decision-making within the meaning of Art. 22 of the GDPR. You have provided your express consent to such processing.
IV. Data Storage Period
The Controller stores personal data for the necessary period to exercise the rights and performance of obligations resulting from the contractual relationship between you and the Controller and any claims made under such contractual relations (for a period of 15 years from the end of the contractual relationship) until the consent to the processing of personal data for marketing purposes is rescinded. After the end of the period for storing personal data, the Controller will delete the personal data.
V. Recipients of Personal Data (Subcontractors of the Controller)
The recipients of personal data are persons/entities who participate in the provision of travel and related services/accounting services under an agreement and other entities who provide marketing services.
The Controller will not forward personal data to any third country (a country outside the EU) or an international organisation.
The subcontractors of the Controller and operated services which provide marketing and support are as follows:
- TaxVision s.r.o., Prvního pluku 320/17, Prague 8, 186 00, Business ID Number: 279 21 450 – records the client’s first name and surname and address of permanent residence;
- Swallow s.r.o., –Mailchimp administrator;
- Youtube.com – records the user’s numbers of videos played and use of YouTube;
- Google Analytics – records cookies and website use;
- Google Adwords – records cookies and website use;
- Mailchimp – records e-mail addresses.
VI. Your Rights
Under the conditions stipulated in the GDPR, you have the right to:
- Access your personal data in accordance with Art. 15 of the GDPR;
- Correct your personal data in accordance with Art. 16 of the GDPR, restrict processing in accordance with Art. 18 of the GDPR, or delete your personal data in accordance with Art. 17 of the GDPR;
- Object to processing in accordance with Art. 21 of the GDPR, or data have your date transferred in accordance with Art. 20 of the GDPR;
- Rescind consent to processing in writing or electronically by sending it to the Controller’s e-mail address stated in Art. III of these conditions;
- Submit a complaint to the Office for Personal Data Protection if you believe that your right to personal data protection has been breached.
VII. Conditions for Securing Personal Data
The Controller declares that it has adopted all suitable technical and organisational measures to secure personal data. The Controller has adopted technical measures to secure data repositories and personal data repositories in paper form, in particular secure/encrypted access to the internet, encryption of customers’ passwords in the database, regular updates to the system, and regular backup of the system. The Controller declares that only persons it has authorised have access to personal data.
VIII. Final Provisions
By sending a request through the internet form, you confirm that you are familiar with the conditions for personal data protection and that you accept them in full.
You consent to such conditions by ticking the consent field on the internet form. By ticking the consent field, you confirm that you are familiar with the conditions for personal data protection and that you accept them in full.
The Controller is entitled to change the conditions at any time. It will publish a new version of the conditions for personal data protection on its website and will also send a new version of the conditions to the e-mail address you provided to the Controller.
These conditions come into effect on 25 May 2018.
