Personal data processing principles

Principles of processing personal data of clients in Zoi Centrum Vitality according to GDPR: ZOI CENTRUM VITALITY (operator Amavalé s. r. o., ID No. 09983708, VAT No. CZ09983708, with registered office at Kobrova 3354/5, Smíchov, 150 00 Prague, registered in C 345778/MSPH Municipal Court in Prague) („Centre „), issues this privacy statement in accordance with Regulation (EU) 2016/679, on the protection of natural persons with regard to the processing of personal data („Regulation“ or „GDPR“) on what personal data Amavalé s.r.o. (as controller) collects about individuals when providing services and visiting websites operated by Amavalé s.r.o. and contacting potential customers, and for what purposes and for how long Amavalé s.r.o. processes such personal data in accordance with applicable law. This policy is effective as of 3.1.2022.

A. Categories of personal data

Personal data is any information relating to a natural person that Amavalé s.r.o. is able to identify. Amavalé s.r.o. may process the following categories of personal data in connection with the provision of services and sale of goods.

1. Basic personal identification data
   Such data is necessary for the conclusion and performance of the ZCV service contract of the contractual relationship category „member“. This includes in particular: a) first and last name b) name of the company ( if a company ) c) birth number (or if for any reason no birth number has been assigned, then the date of birth) d) registration number, VAT number of the legal entity in relation to the provision of ZCV services to their employees e) address of the registered office or place of business f) billing address g) identification data of the legal representative of the client of a person under 16 years of age h) identification data of the payer of the bill
   
   
2. Contact details
   a) Name and surname b) Contact e-mail c) Date of birth 3. Camera recordings from the ZCV premises Amavalé s.r.o. places cameras in the premises of the Centre in order to protect the legitimate interests of Amavalé s.r.o. 4. Data processed on the basis of your consent The processing of this data is not strictly necessary for the performance of the contract or legal obligations or the protection of the legitimate interests of Amavalé s.r.o., but its processing will enable Amavalé s.r.o. to improve its services and offer its customers new services or even limited benefits for a limited period of time, depending on the customer profile in relation to the type of services provided. This data is only processed if consent is given and may be processed for the duration of this consent. This includes in particular: a) data (surveys) of a marketing nature. These are processed for customers of Amavalé s.r.o. services on the basis of consent to the processing of personal data for marketing and commercial purposes. b) data on the use of services, products, benefits and bonuses and the type of behaviour in the use of services (these are processed for customers of Amavalé s.r.o. services on the basis of consent to the processing of personal data for marketing and commercial purposes) c) contact details in the case of non-customers of Amavalé s.s.r.o. (processed on the basis of consent to marketing outreach) d) records of behaviour on the websites managed by Amavalé s.r.o. obtained from cookies if cookies are enabled in the web browser (processed to improve the operation of the websites operated by Amavalé s.r.o, Internet advertising and, in the case of consent to the processing of personal data for marketing and commercial purposes, these data are processed together with other personal data for this purpose)
   
   

B. Purposes, legal grounds and periods of processing of personal data

The scope of the data processed depends on the purpose of the processing. For some purposes it is possible to process data directly on the basis of a contract, the legitimate interest of Amavalé s.r.o. or on the basis of law (without consent), for others only on the basis of consent. The provision of personal data necessary for the performance of the contract, the fulfilment of Amavalé Ltd.’s legal obligations and the protection of Amavalé Ltd.’s legitimate interests is mandatory. Without providing personal data for these purposes, it would not be possible to provide the services. We do not need consent to process personal data for these purposes. Processing for the performance of a contract and the fulfilment of legal obligations cannot be refused. These are in particular the following essential sub-purposes: > ensuring the operation and protection of electronic communications networks (performance of the contract) > provision of electronic communications services, payment transactions, provision of other services (performance of the contract) > billing for services (performance of the contract) > compliance with statutory tax obligations (performance of statutory obligations) > purposes set out by special laws for the purposes of criminal proceedings and for the fulfilment of the obligation to cooperate with the Police of the Czech Republic and other state authorities (fulfilment of legal obligations) > exchange of data between network operators and providers of electronic communications services to ensure network interconnection and access to the network, for mutual billing (fulfilment of the contract) > operation of camera and monitoring systems on the premises of Amavalé s.r.o. for the purpose of preventing damage (legitimate interest of Amavalé s.r.o.) > recovery of customer debts and other customer disputes (legitimate interest) > processes related to customer identification (performance of the contract) > provision of evidence in case of the need to defend the rights of Amavalé s.s.r.o. (legitimate interest of Amavalé s.r.o.) > debtor registration (legitimate interest of Amavalé s.r.o.) Personal data for these activities are processed to the extent necessary for the fulfilment of these activities and for the time necessary to achieve them or for the time directly provided for by law. Thereafter, the personal data is deleted or anonymised. The basic time limits for processing personal data are available below. For customers of Amavalé Ltd. services, Amavalé Ltd. is entitled to process their basic personal, identification, contact and service data in the customer database for a period of 18 months years from the date of termination of membership, either by exhausting their deposit or by the last visit to the Centre. In the event of negotiations between Amavalé s.r.o. and a potential customer for the conclusion of a membership contract which have not been concluded, Amavalé s.r.o. is entitled to process the personal data provided for a period of 6 months from the relevant negotiations. Invoices issued by Amavalé s.r.o. are archived for a period of 10 years from the date of issue, in accordance with Article 35 of Act No. 235/2004 Coll., on Value Added Tax. Due to the need to prove the legal reason for issuing invoices, customer contracts are also archived for 10 years from the date of termination of the contract. Camera recordings from the Centre’s interiors are processed for a maximum of 14 days from the date of the camera recording. Processing of data of customers of Amavalé s.r.o. services with their consent for marketing and commercial purposes effective from 3.1.2022. For clients of Amavalé s.r.o. with their consent we process personal data for marketing and commercial purposes. For the period from 3.1.2022, Amavalé s.r.o. charges a new consent for marketing and commercial purposes, which is effective after this date. The effective date of the consent to the processing of personal data for marketing and commercial purposes is in the text of the consent. With the consent for marketing and commercial purposes, Amavalé s.r.o. will process the customer’s personal data from 3 January 2022 primarily for the creation of a suitable offer of products and services of Amavalé s.r.o. and in connection with contacting the customer, by telephone, in writing (including attachments to billing), through all means of Internet advertising and by electronic communication through contact details or service numbers. Therefore, Amavalé s.r.o. will also create data on customers who give this consent about their typical behaviour when using Amavalé s.r.o. services and products and create and store anonymised behavioural analysis. All these activities are strictly necessary to reach customers with appropriate marketing offers. The provision of consent for marketing and commercial purposes is voluntary and may be withdrawn by the customer at any time after January 3, 2022. This consent remains valid for the duration of the use of Amavalé Ltd. products and services and for the following 2 years thereafter or until the customer withdraws it. For marketing and commercial purposes, all categories of data listed in section A of this document may be processed on the basis of consent, for as long as Amavalé s.r.o. is entitled to record such data for the purposes of providing services, fulfilling its legal obligations and protecting its legitimate interests, but no longer than until the consent is withdrawn or until the expiry of a period of 2 years from the date of termination of the contract for services provided by Amavalé s.r.o., unless the customer withdraws consent earlier. If the data subject withdraws his/her consent, this does not affect the processing of his/her personal data by Amavalé s.r.o. for other purposes and under other legal titles, in accordance with this Personal Data Processing Policy. The customer of the Amavalé s.r.o. service, in the event that he allows the use of this service by users, declares that he is entitled to consent to the processing of data relating to users of the service for marketing and commercial purposes. Processing of data of data subjects who have consented to marketing outreach through electronic contact. For subjects who have given their consent to marketing outreach via electronic contact, Amavalé Ltd. processes, with their consent, for the period indicated in the consent, the contacts that the subject makes available to it for the purpose of marketing outreach with the offer of services and products of Amavalé Ltd. If this consent is granted through the website operated by Amavalé s.r.o., the data from the cookies of Amavalé s.r.o., which are placed on the website where this consent was granted, are processed together with these contacts, only if the subject has cookies enabled in his/her web browser. Processing of cookies from websites operated by Amavalé s.r.o. In the event that the subject has cookies enabled in his/her web browser, we process behavioural records of cookies placed on the websites operated by Amavalé s.r.o. for the purpose of ensuring better operation of the Amavalé s.r.o. website and for the purpose of Amavalé s.r.o.’s Internet advertising.

C. Categories of recipients of personal data

Categories of recipients of personal data Amavalé s.r.o., as the controller, uses the professional and specialized services of other entities, so-called processors, in the performance of its obligations and duties under contracts. Insofar as these suppliers process personal data transmitted from Amavalé s.r.o., they have the status of data processors and process personal data only within the framework of instructions from Amavalé s.r.o. and may not use it otherwise. This includes in particular the processing of accounting operations, the administration of IT systems, internet advertising or communication campaigns. We carefully select each such entity and enter into a GDPR-compliant data processing agreement with each, in which the processor has strict obligations to protect and secure personal data. Processors are companies based in the Czech Republic. Amavalé s.r.o. transmits personal data to the administrative authorities and authorities specified by the applicable legislation in the performance of its legal obligations.

Method of processing personal data Amavalé s.r.o. processes personal data manually and automatically. Amavalé s.r.o. keeps records of all activities, both manual and automated, in which personal data is processed.

D. Commercial communications

For commercial communications from Amavalé s.r.o. or third parties, the company uses a style that always makes it clear that the communication is a commercial communication within the meaning of applicable law. Commercial communications sent by Amavalé s.r.o. shall always make it clear that Amavalé s.r.o. is the sender. We may send commercial communications to either the contacts of our customers based on Amavalé s.r.o.’s legitimate interest, and only until you expressly consent, or based on your express consent to the processing of personal data for marketing and commercial purposes. In the commercial communications sent to you, there is also a contact for refusing to receive these communications.

E. Information on the rights of data subjects in relation to the processing of personal data applicable from 3 January 2022

According to the Regulation, from 3 January 2022, if the data subject is an identifiable natural person for Amavalé s.r.o. and proves his or her identity to Amavalé s.r.o., he or she will have the following rights.

1. Right of access to personal data According to Article 15 of the Regulation, the data subject will have the right of access to personal data, which includes the right to obtain from Amavalé s.r.o.: > confirmation as to whether it processes his/her personal data, > information on the purposes of the processing, the categories of personal data concerned, the recipients to whom the personal data have been or will be disclosed, the planned duration of the processing, the existence of the right to request from the controller the rectification or erasure of personal data relating to the data subject or the restriction of their processing or to object to such processing, the right to lodge a complaint with a supervisory authority, any available information on the source of the personal data, if not obtained from the data subject, the facts. > if the rights and freedoms of others will not be adversely affected, and a copy of the personal data. In the event of a repeated request, Amavalé Ltd. will be entitled to charge a reasonable fee for a copy of the personal data. The right to confirmation of the processing of personal data and to information will be exercised in writing to the address of the registered office of Amavalé s.r.o. The right to a copy of the personal data may be exercised at a branch of Amavalé s.r.o., provided that the legitimacy of the request is proven.
2. Right to rectification of inaccurate data According to Article 16 of the Regulation, the data subject will have the right to rectification of inaccurate personal data processed by Amavalé s.r.o. about him/her. The customer of Amavalé s.r.o. is also obliged to notify changes to his/her personal data and to provide evidence that such changes have occurred. He is also obliged to provide us with assistance if it is found that the personal data we process about him is not accurate. We will carry out the rectification without undue delay, but always taking into account the technical possibilities. A request for rectification of personal data may be made to the reception desk at the Amavalé Ltd. premises, provided that the legitimacy of the said request is documented.
3. Right to erasure Pursuant to Article 17 of the Regulation, the data subject will have the right to have personal data relating to him or her erased if Amavalé s.r.o. does not demonstrate legitimate grounds for the processing of such personal data. Amavalé s.r.o. has set up mechanisms to ensure the automatic anonymisation or erasure of personal data in the event that they are no longer necessary for the purpose for which they were processed. If the data subject considers that his or her personal data has not been erased, he or she may contact us in writing at the address of the registered office of Amavalé s.r.o.
4. Right to restriction of processing According to Article 18 of the Regulation, the data subject will have the right to restriction of processing until the complaint is resolved if he or she contests the accuracy of the personal data, the grounds for processing or if he or she objects to the processing, in writing to the address of the registered office of Amavalé s.r.o.
5. Right to notification of rectification, erasure or restriction of processing According to Article 19 of the Regulation, the data subject will have the right to notification by Amavalé s.r.o. in the event of rectification, erasure or restriction of the processing of personal data. If the rectification or erasure of personal data occurs, we will inform the individual recipients, except where this proves impossible or involves a disproportionate effort. Upon request of the data subject, we may provide information about these recipients. The request may be sent in writing to the address of the registered office of Amavalé Ltd.
6. The right to data portability According to Article 20 of the Regulation, the data subject will have the right to the portability of the data concerning him/her that he/she has provided to the controller in a structured, commonly used and machine-readable format and the right to request Amavalé s.r.o. to transfer these data to another controller. If the data subject provides us with personal data in connection with a service contract or on the basis of consent and the processing is carried out by automated means, he or she has the right to obtain such data from us in a structured, commonly used and machine-readable format. If technically feasible, the data may also be transferred to a controller designated by you, provided that the person acting on behalf of the controller is duly designated and can be authorised. If the exercise of this right would adversely affect the rights and freedoms of third parties, your request cannot be granted. The request may be made to the Centre upon proof of the legitimacy of the request.
7. Right to object to the processing of personal data According to Article 21 of the Regulation, the data subject will have the right to object to the processing of his or her personal data on the grounds of legitimate interest of Amavalé s.r.o. If Amavalé s.r.o. does not establish that there is compelling legitimate ground for the processing which overrides the interests or rights and freedoms of the data subject, Amavalé s.r.o. will terminate the processing without undue delay on the basis of the objection. The objection may be sent in writing to the address of the registered office of Amavalé s.r.o.
8. Right to withdraw consent to the processing of personal data Consent to the processing of personal data for marketing and business purposes effective from 3 January 2022 may be withdrawn at any time after that date. The revocation must be made by an explicit, clear and specific expression of will, either by telephone on the customer service line, at the Amavalé Ltd. branch or in your online self-service. Consent to marketing communications given for a specific electronic contact can be revoked at any time by calling the Amavalé Ltd. branch. The processing of cookie data can be prevented by adjusting your web browser settings.
9. Automated individual decision-making, including profiling The data subject has the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects concerning him or her or similarly significantly affect him or her. Amavalé s.r.o. states that it does not carry out automated decision-making without the influence of human judgement having legal effects on data subjects.
10. Right to contact the Office for Personal Data Protection The data subject has the right to contact the Office for Personal Data Protection (www.uoou.cz).