Personal data protection principles under the GDPR.

Bajir s.r.o. – who we are and how you can contact us

Bajir s.r.o., with its registered office at K Jezeru 490/2, Prague 11 – Háje, 149 00, Company ID No.: 275 84 615, registered in the Commercial Register maintained by the Municipal Court in Prague under file no. C 117115, acting through prof. PhDr. Jiří Suchý, Ph.D., executive director (“Bajir”), processes in the course of its business activities the personal data of its employees, suppliers and clients who are natural persons.

In order to ensure the proper protection of personal data, Bajir has issued these personal data protection principles, which took effect on 25 May 2018.

Please address any questions or requests concerning the processing of personal data by Bajir to the e-mail address info@bajir.cz, or send them by post to the registered office address stated above.

The basic rules we follow when processing personal data

Bajir always processes personal data in accordance with generally binding legislation, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”), so that the rights of data subjects are duly protected.

Pursuant to Article 13 of the GDPR, Bajir hereby provides data subjects with information about the processing of their personal data.

Bajir always processes accurate and up-to-date personal data on the basis of a lawful title, fairly and in a transparent manner, only for specified, explicitly stated and legitimate purposes, to the minimum extent necessary; it stores them in a form permitting the identification of data subjects only for the period necessary in relation to the purpose, and ensures their integrity and confidentiality by means of appropriate technical and organisational measures and adequate protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Bajir duly documents all activities relating to personal data and their protection; in particular, it maintains records of processing activities and other documentation on the processing of personal data in order to fulfil the accountability principle under the GDPR.

For what purpose and on what legal basis we process personal data

Before commencing any processing of personal data, Bajir determines the purpose for which it processes the personal data and the legal basis for such processing in accordance with Article 6 of the GDPR.

In the case of Bajir's clients and suppliers who are natural persons (the GDPR does not apply to data of legal entities), personal data are processed for the purpose of concluding or performing a contract and maintaining the communication and records necessary in that connection (for example e-mail and postal correspondence regarding the services supplied, invoicing, etc.). The legal basis for this processing is therefore the performance of a contract concluded with the data subject (client or supplier), or, where applicable, compliance with Bajir's legal obligations where this concerns bookkeeping or other statutory records containing data on clients and suppliers, archiving of important documents, etc.

In the case of employees, Bajir processes personal data for the purpose of concluding an employment contract or an agreement on work performed outside an employment relationship, assigning work, paying wages or remuneration and fulfilling other obligations arising from the employment relationship and the relevant legislation. The legal basis for this processing is therefore likewise the performance of a contract concluded with the data subject (employee), or, where applicable, compliance with Bajir's legal obligations. More detailed information on the processing of personal data is provided to employees individually.

How long we process personal data

Bajir always processes personal data only for the period necessary to fulfil the purpose of the processing, i.e. for the duration of the contractual relationship with the client, supplier or employee, unless legislation requires a longer retention period (for example tax or archiving regulations). We then delete the personal data.

To whom and under what conditions we disclose personal data (recipients)

As controller, Bajir processes personal data predominantly directly through its own employees. It uses third parties for processing only exceptionally – in particular a company providing accounting services.

Bajir concludes a personal data processing agreement with every processor of personal data. The processors have provided Bajir with sufficient guarantees of the secure handling of personal data and the implementation of appropriate technical and organisational measures so that the processing in question meets the requirements of the GDPR and the protection of the rights of data subjects is ensured.

Bajir does not transfer personal data to third countries outside the European Union and the European Economic Area.

How we secure personal data

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the likelihood and varying severity of risks to the rights and freedoms of natural persons, Bajir has implemented appropriate technical and organisational measures to ensure a level of security of personal data appropriate to the risk – in particular against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data transmitted, stored or otherwise processed.

What rights the data subject has

Every data subject has the following rights:

1. The right to information – towards clients and suppliers Bajir fulfils this by making them familiar with these personal data protection principles; towards employees it supplements this with an individual information letter.
2. The right of access to personal data.
3. The right to erasure / the right to be forgotten.
4. The right to restriction of processing.
5. The right to data portability.
6. The right to object – Bajir does not carry out any processing of personal data on the legal basis of legitimate interest, so the right to object does not apply in practice.
7. The right not to be subject to automated individual decision-making, including profiling (nor does Bajir carry out any form of automated individual decision-making).
8. The right to lodge a complaint with the Office for Personal Data Protection or with another competent supervisory authority in connection with the processing of personal data.

The data subject may exercise the rights listed above under 2) to 5) vis-à-vis Bajir electronically at the e-mail address info@bajir.cz or in writing at Bajir's registered office address. In the request, the data subject shall state their identification details and the right being exercised through the request.

Bajir will inform the data subject of the measures taken on the basis of the data subject's request within one month of receiving the request, but no later than three months of receiving the request where the time limit has been extended in a justified case. Where the data subject submits the request in electronic form, the information will be provided by e-mail, unless the data subject has stated in their request that they require another means of providing the information.

The right of access to personal data

The right of access to personal data has three components. The data subject shall determine in their request addressed to Bajir which part of the right of access they are exercising.

1. The data subject has the right to obtain from Bajir confirmation as to whether or not personal data concerning them are being processed.
2. Where Bajir processes the data subject's personal data, it is obliged to provide them with the information listed below (the data subject shall likewise specify in their request which of this information they are requesting).
3. Where Bajir processes the data subject's personal data, it is obliged to provide the data subject with a copy of the personal data undergoing processing free of charge. For any further copies requested by the data subject, Bajir may charge a reasonable fee based on the administrative costs of producing those copies. The right to obtain a copy of the personal data undergoing processing must not adversely affect the rights and freedoms of others.

Information provided under point 2)

• a) the purposes of the processing;
• b) the categories of personal data concerned;
• c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• d) the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
• e) the existence of the right to request from Bajir rectification or erasure of personal data concerning the data subject or restriction of their processing, or to object to such processing;
• f) the right to lodge a complaint with the Office for Personal Data Protection or with another competent supervisory authority in connection with the processing of personal data;
• g) any available information about the source of the personal data where they are not collected from the data subject;
• h) the existence of automated individual decision-making, including profiling, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The right to rectification

The data subject has the right to:

• a) rectification of inaccurate personal data concerning them;
• b) completion of incomplete personal data, taking into account the purposes of the processing, including by means of providing a supplementary statement.

Bajir communicates any rectification of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. If the data subject so requests, Bajir will inform them about the recipients thus notified.

The right to erasure / the right to be forgotten

At the data subject's request, Bajir will erase their personal data without undue delay where any of the grounds listed below applies:

• a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• b) the data subject withdraws the consent on which the processing was based and there is no other legal ground for the processing (does not apply, as consent is not used by Bajir as a basis for processing);
• c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing of personal data for direct marketing purposes (does not apply, as legitimate interest is not used by Bajir as a basis for processing);
• d) the personal data have been unlawfully processed;
• e) the personal data must be erased for compliance with a legal obligation laid down by European Union or Member State law to which Bajir is subject;
• f) the personal data of a child have been collected in relation to the offer of information society services made directly to a child (does not apply, as Bajir does not send offers of information society services).

When the right to erasure does not apply

The right to erasure does not apply and the personal data will continue to be processed where such processing is necessary:

• a) for exercising the right of freedom of expression and information;
• b) for compliance with a legal obligation which requires processing of personal data by European Union or Member State law to which Bajir is subject;
• c) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• d) for the establishment, exercise or defence of legal claims.

Bajir communicates any erasure of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. If the data subject so requests, Bajir will inform them which recipients of the personal data have been thus notified.

The right to restriction of processing

The data subject has the right to obtain from Bajir restriction of processing of their personal data in any of the following cases:

• a) the data subject contests the accuracy of the personal data; in this case processing will be restricted for a period enabling Bajir to verify the accuracy of the personal data;
• b) the processing of the personal data is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• c) Bajir no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• d) the data subject has exercised the right to object to the processing of personal data.

As a result of the restriction of processing, Bajir may continue to store the personal data concerned; however, they may be processed only with the data subject's consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. In such cases, the data subject who obtained the restriction of processing will be informed by Bajir in advance that the restriction of processing is to be lifted.

Bajir communicates any restriction of processing of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. If the data subject so requests, Bajir will inform them to which recipients such notification was given.

The right to data portability

The data subject has the right to receive the personal data concerning them which they have provided to Bajir and which are processed by automated means, provided that one of the conditions listed below is also met:

• a) the personal data are processed for a specific purpose or purposes on the basis of the data subject's consent;
• b) the data constitute a special category of personal data processed for one or more specified purposes on the basis of the explicit consent given by the data subject; or
• c) the processing of the personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

In their request, the data subject shall choose whether Bajir is to provide the personal data to the data subject, or whether they will exercise the right to have their personal data transmitted by Bajir directly to another controller/processor, where technically feasible. Bajir will provide the personal data in a structured, commonly used and machine-readable format.

The right to data portability must not adversely affect the rights and freedoms of others.