The policy is valid from: 1. 7. 2024

Name (name) Brummel House z.s.
Headquarters address Husova 741/58, Jižní Předměstí, 30100 Plzeň
Identification number 04154053
Website brummelhouse.cz

What are the purposes of processing personal data?

The main reason for processing personal data is to provide our products and services.
We are engaged in the following activities: graphic services, marketing services, web and e-shop development

Specific purposes of processing:

  • Provision of services, sale of goods
  • Research, development, improvement of products and services
  • Direct marketing to clients
  • Internal business and administrative functions
  • Client account management

What are the legal bases for processing?

The processing of personal data for the purposes set out above is based on the following legal titles:

  • Conclusion or performance of a contract
  • Fulfilling a legal obligation
  • Legitimate interests of the controller or of a third party

If any processing is based on your consent, such consent is always voluntary and free and we will not force you to give such consent in any way. We will not process without your consent. You can withdraw your consent at any time and we will cease the processing based on it. However, withdrawal of consent does not affect the processing already carried out.

If the processing is based on legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. It is our responsibility to assess whether there are sufficient grounds for us to continue processing and to inform you accordingly.

What data do we process?

In particular, we process data that we need to offer and provide our products or services, comply with legal obligations and protect your or our interests.

Categories of personal data processed:

  • Basic identification data
  • Contact details
  • Sociodemographic data
  • Information and communication technology data
  • Geolocation data
  • Data on the behaviour of persons

Unless otherwise stated, the above data is necessary for the purposes stated above and no contractual or other similar relationship can be established with us without its provision. If some of the information is voluntary, we will notify you.

Where do we get the data from?

We collect personal data:

  • Directly from data subjects (customers, employees, etc.)
  • From publicly available sources (public registers, social networks, etc.)
  • Commercial registers and data sources (providers of information products and services)
  • Own activities (internal functions, IT systems)
  • Other persons (relatives, persons acting on behalf of the subject, etc.)

How do we work with the data?

Processing is performed manually and automatically using various applications and software, e.g. those that help us in the performance of our activities and without which we would be practically unable to provide our services.

Automated individual decision-making and profiling

Automated individual decision-making is data processing that has substantial consequences for you (e.g. not concluding a contract) and in which no humans are directly involved. Therefore, only automatic means (applications, software, algorithms, etc.) are used. Profiling means the automated processing of data to evaluate certain personal aspects of a person (job performance, economic situation, health, behaviour, preferences or location tracking).

We do not perform automated individual decision-making.

In the event that automated decision-making would have significant consequences for you (e.g. would lead to a failure to conclude a contract, refusal to pay the benefit, change the terms of the agreed service, etc.), you have the right to have such a decision reviewed, to comment on it and, if necessary, to challenge it.

We do not perform profiling.

Who can we pass the data to?

Personal data may be processed by the following recipients:

  • Contractual partners providing services and supplies necessary for our activities
  • Specialised service providers
  • Analytics and website or application monitoring providers
  • Web or in-app advertising service providers (including remarketing)

In the event that we undergo a change and transfer our business or other activities, in whole or in part, to another person, then such transfer would include personal data relating to those activities. It would be the same if we were legally compelled to make such changes.

Similarly, we may be required by law to disclose certain data to authorised public authorities or other bodies designated by binding legislation.

Where can your data be processed?

Your personal data may be transferred for processing within the EU and the European Economic Area. In accordance with the law, we may also transfer personal data to countries outside the EU/EEA, but only if we provide adequate security and guarantees that it will be handled in accordance with the law.

We use the following guarantees for the transfer:

How long have we had the data with us?

We process personal data:

  • For the duration of the contract (service provision, order processing, delivery of goods)
  • After termination of the service or delivery of the goods to protect rights and legitimate interests, generally until the expiry of the limitation period
  • For the period of time required by law

What are your rights?

You can ask us for information about the processing, for correction of inaccurate data, for deletion of data in the event of termination of the purpose or unlawful processing, you have the right to restriction of processing, the right to object to processing on the basis of legitimate interest, including direct marketing, the right to access to data (copy of data) and portability and the right to lodge a complaint with the supervisory authority (Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz) or to your local data protection authority (you can find your authority here: https://edpb.europa.eu/about-edpb/board/members_en).

If you receive commercial communications from us, you always have the option to opt-out of such communications, either via a link contained in each such electronic message or by direct request to our contact points.

If the requests related to the exercise of your rights are manifestly unfounded or unreasonable (especially if they are repetitive), we may require a reasonable payment not exceeding the costs necessary to process the request or we may refuse your request.

Contact details for requests and questions regarding personal data are provided in the header of this document.

What security measures do we apply?

In order to protect personal data, we have put in place the following measures:

  • Encryption, data security (especially sensitive data)
  • Access permission control, secure password policy
  • Security of devices, systems, networks, websites
  • Detection and prevention of attacks and incidents
  • Backup, recovery and crisis management plans
  • SW updates, patch management
  • Physical security