GDPR Privacy policy
Rules for the protection and processing of personal data under Regulation (EU) 2016/679. The controller is EICHNER s.r.o., Zarámí 92, 760 01 Zlín, IČO 09553321.
Introduction
These rules for the protection and processing of personal data (the “Rules”) describe which personal data of clients who are natural persons, or of other clients in relation to the natural persons acting on their behalf (the “Data Subject”), are processed in the course of the activities of EICHNER s.r.o., with its registered office at Zarámí 92, 760 01 Zlín, IČO: 09553321, registered in the Commercial Register kept by the Regional Court in Brno, Section C, File 119560 (the “Controller”).
These Rules set out the types of personal data that we collect and process when you use our services, as well as the way in which your personal data are used, shared and protected. They also explain the options available to you in relation to your personal data and how you can contact us. Below, we therefore inform you about the processing of your personal data and about your rights in accordance with Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (also the “GDPR”).
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processors and recipients of personal data
The Controller is entitled to transfer personal data to entities with which it has concluded a personal data processing agreement and which will process personal data for the Controller as its processors. On the basis of the above, the Controller is entitled to transfer the Data Subject's personal data to the following entities or categories of entities:
real estate listing websites, namely:
- Seznam.cz, a.s., IČO: 26168685;
- Reality.cz katalog nemovitostí s.r.o., IČO: 27374947;
- MAFRA, a.s., IČO: 45313351.
Furthermore, the Controller is entitled to transfer personal data related to the administration of information systems and to marketing services to the following recipients:
- Facebook Ireland Limited, IE9692928F;
- Google Ireland Limited, IE6388047V;
- Seznam.cz, a.s., IČO: 261 68 685.
The Data Subject's personal data are also transferred to the following categories of recipients:
- the Controller's suppliers;
- the Controller's employees;
- persons in another contractual relationship with the Controller (e.g. providers of marketing and advertising services, law firms, cooperating mortgage advisers);
- financial institutions and insurance companies;
- public authorities in the fulfilment of statutory obligations laid down by the relevant legislation.
The Controller undertakes not to provide the Data Subjects' personal data to any processors or recipients other than those specified above.
Categories of personal data processed
The Controller is entitled to process in particular the following personal data of the Data Subject:
- address and identification data serving the unambiguous and unmistakable identification of the Data Subject (e.g. first name, surname, title, date of birth, or birth number, permanent address, address of business premises, delivery address, IČO, DIČ) and data enabling contact with the Data Subject (e.g. contact address, telephone number, fax number, e-mail address and other similar information),
- the number of the identity card or passport, the authority that issued the identity document, the document's period of validity, or a copy of the identity document,
- descriptive data (e.g. bank details, payment information or credit card information),
- images, photographs and videos,
- account login information, including the name under which the Data Subject appears on the internet, the password and a unique user ID,
- data provided beyond the scope of the relevant laws and processed on the basis of consent given by the Data Subject (e.g. use of personal data for recruitment procedures, use of personal data for promotion and the like),
- personal settings (preferences), including the Data Subject's settings for marketing and the use of cookies,
- other data necessary for the performance of a contract,
- other personal data that the Data Subject has provided to the Controller.
In addition to the above, the Controller specifies which data are processed in connection with the Data Subject's behaviour:
1) Visiting the website
Whenever anyone visits the Controller's website, that person agrees that information about them is collected during their visit, such as their IP address, browser and preferred language settings, and the web pages visited, including the time of the visit. The Controller monitors the person's movement on the website, in particular which links are clicked. The Controller does all this in order to personalise the content displayed. When the website is visited, so-called cookies are also stored in the visitor's web browser and are subsequently read by the Controller.
2) Contact via the customer line
In connection with providing information via the telephone customer line, the Controller keeps in particular recordings of telephone calls, which are monitored. All personal data as entered by the Data Subject in the contact form are also processed, in particular the data necessary for concluding a reservation agreement, a purchase contract or another contract related to the purchase of a property and for performance under them (identification data, contact data, data arising from the duration of the contract – properties purchased, volume of services provided, customer segment). If the Data Subject tells an employee about their state of health, this information is kept only as part of the recording and is not processed in any special way.
Purposes and legal basis of processing
The Controller processes the Data Subject's personal data for the purposes of:
- concluding a contract and performance under the contract, on the basis of Article 6(1)(b) GDPR,
- complying with the Controller's legal obligation laid down by generally binding legislation, on the basis of Article 6(1)(c) GDPR (e.g. the Controller's obligation to keep accounting and tax records),
- establishing, exercising or defending the Controller's legal claims, on the basis of Article 6(1)(f) GDPR,
- sending commercial communications, on the basis of Article 6(1)(f) GDPR, owing to the Controller's legitimate interest in direct marketing,
- the Controller's other marketing purposes connected with offering products and services; sending information about events, products, services and other activities (e.g. by sending newsletters, telemarketing); contact for the purposes of market surveys and marketing research; contact for the purpose of Christmas and Easter or other holiday greetings and sending discount vouchers, gifts and the like, on the basis of Article 6(1)(a) GDPR.
Period of processing
Personal data will be processed only for as long as is necessary with regard to the purpose of their processing. With regard to the above:
- for the purpose under (a) above, personal data will be processed until the obligations under the contract expire (this does not affect the Controller's ability to further process these personal data subsequently – to the extent necessary for the purpose under (b), (c), (d) and/or (e) above),
- for the purpose under (b) above, personal data will be processed for the duration of the Controller's relevant legal obligation,
- for the purpose under (c) above, personal data will be processed until the end of the 4th calendar year following the end of the warranty period under the contract (if a quality guarantee was agreed in the contract), but at least until the end of the 5th calendar year following the expiry of the obligations under the contract,
- if judicial, administrative or other proceedings are initiated and pending in which the rights or obligations of the Controller in relation to the Data Subject concerned are being resolved, the period of processing personal data for the purpose under (c) above will not end before such proceedings have ended,
- for the purpose of sending commercial communications under (d) above, personal data will be processed until the Data Subject objects to such processing,
- for the purposes under (e) above, personal data will be processed for the period for which the Data Subject has given the Controller consent under a separately approved consent to the processing of personal data. In this case, the Data Subject acknowledges that the Controller may contact them before this period expires in order to renew their consent.
No later than the end of the calendar quarter following the end of the above processing period, the personal data concerned whose processing purpose has ceased will be destroyed (by shredding or in another way ensuring that unauthorised persons cannot become acquainted with the personal data) or anonymised.
Method of processing
Personal data are processed by the Controller. Processing takes place at the Controller's registered office by individual authorised employees of the Controller, or by Processors. The Controller may collect or obtain personal data through its website at www.eichner.cz, forms, electronic or telephone contact, personal meetings or otherwise. Processing is carried out by means of computer technology, or manually in the case of personal data in paper form, in compliance with all security principles for the management and processing of personal data. To this end, the Controller has adopted technical and organisational measures to ensure the protection of personal data, in particular measures to prevent unauthorised or accidental access to personal data, their alteration, destruction or loss, unauthorised transfers, their unauthorised processing, as well as any other misuse of personal data. All entities to which personal data may be made available respect the Data Subjects' right to privacy and are obliged to proceed in accordance with the applicable legislation on personal data protection.
No automated individual decision-making or profiling will be carried out on the basis of the data provided. The Data Subjects' personal data will not be transferred to third countries.
Your rights
In connection with the processing of their personal data, Data Subjects have a number of rights, including the right to request from the Controller:
- access to their personal data (under the conditions of Article 15 GDPR),
- rectification or erasure of personal data (under the conditions of Article 16 or Article 17 GDPR),
- restriction of the processing of personal data (under the conditions of Article 18 GDPR),
- to object to the processing of personal data (under the conditions of Article 21 GDPR),
- the right to personal data portability (under the conditions of Article 20 GDPR),
- the right to withdraw consent to the processing of personal data, in writing or electronically, to the Controller's address or e-mail stated in these Rules.
If the Data Subject finds or believes that their personal data are being processed in breach of the protection of the Data Subject's private and personal life or in breach of the law, they have the right to ask the Controller for an explanation and/or a remedy. The request must be made in writing by sending a letter or e-mail to the Controller's contact details: eichner.tomas@gmail.com.
If the Data Subject's request is found to be justified, the Controller will remedy the defective situation without delay. This does not affect the Data Subject's right to contact the supervisory authority directly, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, +420 234 665 555, www.uoou.cz.
Final provisions
The Controller reserves the right to change the rules for the protection and processing of personal data in any way and at any time; the current version will always be published on the website www.eichner.cz.