INFORMATION ON PROCESSING OF PERSONAL DATA

Labona s.r.o.

The purpose of this document in accordance with Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR") and Act No. 110/2019 Coll. (Sb.) on the Processing of Personal Data, as amended and in force (hereinafter referred to as the "Act"), and other legal regulations governing the protection of personal data, is to provide you with full information about the processing of your personal data, in particular to what extent and for what purpose we process your personal data, who will process your personal data and in what manner, to whom your personal data may be disclosed, as well as about the right of access to your personal data, the right to rectification of your personal data and your other rights under the relevant legislation.

This document is publicly available on our website at: https://www.labona.eu. 

1.1. We are a trading company Labona s.r.o., with its registered office at Palackého nám. 152, 665 01 Rosice, ID no: 03898881, registered in the Register of Companies kept at the Regional Court in Brno, Section C, Insert 87305, and as the Controller (hereinafter referred to as the “Controller" or "we") we process your personal data.

1.2. Our Contact Details:

      Delivery address:  Palackého nám. 152, 665 01 Rosice, Czech Republic 
      Email address:  info@labona.eu
      Phone:  +420 778 707 028

2.1. Your personal data is completely safe with us. We have taken appropriate technical and organisational measures in your interest, taking into account the nature, scope, context and purposes of the processing as well as the differently likely and differently serious risks to your rights and freedoms, to ensure the protection of your personal data that we process, in particular measures to prevent unauthorised or accidental access, alteration, destruction, loss, unauthorised transfer, unauthorised processing or other misuse of your personal data. In particular, we use the following security features: encrypted communication, secure environment for storing documents containing personal data in physical form, storage facilities with unique access passwords, use of official antivirus programs, binding employees to confidentiality obligations, user access control, use of SSL certificate to protect data transmission between the visitor's browser and the website, set system of rights and role management, your login data is password-protected and all data is stored only on servers in secure data centres.

Your personal data is therefore under our constant control, both electronically and physically. In addition, we regularly update and continuously improve the security of your personal data.

2.2. We process personal data both automatically and manually; the processing of personal data does not lead to automated decision-making or profiling.

2.3. We process your personal data in accordance with following principles of the GDPR policy:

• • • the Lawfulness, Fairness and Transparency of the processing of personal data,
    • Purpose limitation – we collect personal data only for specific, explicit and legitimate purposes,
    • Data minimisation – we maintain proportionality, relevance and limit the processing of personal data to what is strictly necessary in relation to the purpose of processing,
    • Accuracy and Timeliness – we take all reasonable steps to ensure that your personal data is regularly updated or corrected,
    • Storage limitation - we keep personal data only for the time necessary for the specific purpose for which your personal data is processed,
    • Integrity and Confidentiality – We process your personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures,
    • Responsibility - we take a responsible approach to protecting your personal data.

3.1. When you use our website, we may collect certain information about you, such as your IP address, the date and time you accessed our website, information about your internet browser, operating system or your language settings. We may also process data about your behaviour in our e-shop, e.g., which products you view on our e-shop or which of our offers you are interested in. We derive additional data about you from information about your behaviour on our website in order to show you tailored offers and to improve our website in the future, but this data is anonymised for your maximum privacy and therefore we cannot attribute it to a specific person.

We process the following categories of personal data in relation to the relevant legal basis and purpose of processing in the case of customers to whom we provide our services and goods:

• • • Identification Data – name, surname, academic title, business name, company number, VAT number, permanent address, registered office address, signature;
    • Contact Details – delivery address, email address, phone number - landline, mobile;
    • Descriptive Data – bank account number, data on the services and goods provided including history (type and specification of the service/good, volume of services/goods provided and their price, information on payment record, information on payments made);
    • Data from Communication between us and the customer – communication via email;
    • Other – network identifiers (IP address, cookie identifiers, etc.), geographic location, subject behaviour on the website.

3.2. We collect your personal data:

• • • directly from data subjects,
    • from public registers.

4.1. We only ever process your personal data for specific, explicit and legitimate purposes arising from the performance of our activities. We process your personal data mainly for the purpose of fulfilling the business relationship (we need your personal data to properly process and deliver your order or provide the services you have ordered; similarly, we need it to resolve any problem that may arise in this regard), but also for the purpose of taking care of you as a customer (if you contact us with a question/problem, we need to process your personal data to answer/resolve it) or to enable you to use your user account within our e-shop.

4.2. We also process some of your personal data for the purposes of our marketing activities – you can find out more about this in the section below called "External Advertising Systems, Cookies".

4.3. In addition, we use your contact personal data for the purpose of sending you commercial communications relating only to our own services. These are mainly products and services similar to those we have already provided to you. For the purpose of sending commercial communications, we process your personal contact data mainly on the basis of your consent. If we do not receive your consent, we may send you commercial communications even without your consent if you are our customer because of our legitimate interest (we may process our customers' personal data for direct marketing purposes in accordance with the GDPR on the basis of our legitimate interest). When sending commercial communications, we comply with generally binding legal regulations, in particular the provisions of Section 7 of Act No. 480/2004 Coll., on Certain Information Society Services, as amended and in force. In any case, you can disable this marketing activity by contacting us using the contact details above or by using this contact form to tell us.

4.4. We process your personal data specifically on the basis of the following legal reasons:

• • • the legal reason is the performance of a concluded contract (Article 6(1)(b) GDPR) - on the basis of these legal grounds we process your personal data if it is necessary for the performance of a contract to which you are a party or for the performance of measures taken prior to the conclusion of the contract; e.g., the conclusion of a purchase contract, and subsequently in order to provide the ordered services/goods, which includes, in particular, the receipt of the order, subsequent communication with the customer, performance of the contract, issuance of an invoice, etc.;
    • the legal reason is the fulfilment of a legal obligation (Article 6(1)(c) GDPR) - on the basis of these legal grounds we process your personal data if we are obliged to do so by law; e.g., keeping of accounts and tax records, issuing invoices, etc.;
    • the legal reason is our legitimate interest (Article 6(1)(f) GDPR) - on the basis of these legal grounds we process your personal data if it is in our legitimate interest to do so, which includes the following activities: asserting our legal claims against you as a customer and vice versa, for the purposes of inspections carried out by public authorities, internal administrative processes, direct marketing activity - in particular sending commercial communications, cookies, your use of the contact form on our website and subsequent communication with you, etc.
    • the legal reason is your consent (Article 6(1)(a) GDPR) - on the basis of these legal grounds, in certain cases, we process your contact personal data to send you our commercial communications.

5.1 We process your personal data for the entire duration of the contractual relationship between us.

5.2. In the case of processing of personal data based on your consent, your personal data will be processed for a period of 5 years or until the withdrawal of such consent.

5.3. We must process personal data that is necessary for the proper provision of services or for the fulfilment of all our obligations, whether these obligations arise from a contract between us or from generally binding legal regulations, regardless of the consent you have given us, for the period of time specified by or in accordance with the relevant legislation (e.g., for tax documents, this period is at least 10 years).

5.4. When determining the duration of storage of personal data, we take into account all aspects of the processing in question as well as your interests or the legitimate interests of third parties, in particular by keeping your personal data only for the period of time that is strictly necessary.

6.1. We disclose your personal data to our employees, who process your personal data in accordance with all applicable and binding data protection laws and regulations, as well as in accordance with the binding rules governing the processing and protection of personal data, which are set out in internal regulations.

6.2. The personal data processed by us is transferred to the following recipients:

• • • to public authorities and other entities to which we are obliged to transfer personal data under the relevant legislation (e.g. administrative authorities, courts, law enforcement authorities, bailiffs, notaries, individual ministries of the Czech Republic, customs authorities, etc.),
    • to other entities when necessary to protect our rights (e.g., insurance companies when making an insurance claim, courts, insolvency practitioners, bailiffs, etc.),
    • service providers necessary for our business (in particular providers of legal services and accounting services, transport companies – for the purpose of delivering ordered goods to the customer, etc.).

6.3. For a current list of processors to whom we may transfer your personal data, please see HERE.

6.4. The recipients of personal data referred to in the preceding paragraph shall provide guarantees that appropriate technical and organisational measures are in place to ensure that the processing of personal data complies with the requirements of the relevant binding legal provisions of Czech and EU law governing the protection of personal data. If the processing of personal data by these recipients is not regulated by any legal regulation or other legal act of EU or Member State law, a written contract on the processing of personal data is concluded with the recipient of personal data, which regulates the rights and obligations of the parties (us, as the Controller and the Processor) in the processing of personal data.

6.5. We do not transfer your personal data to third countries (i.e., countries outside the EU) or to an international organisation.

7.1. Our website available at: https://www.labona.eu/ uses retargeting technologies by the Sklik service operated by Seznam.cz, a.s. This allows us to show visitors who have already expressed interest in our products advertisements in the advertising network Seznam.cz, a.s. We also use the advertising system by Google (Google AdWords). Through this online system it is possible to display advertisers in paid search results. In addition, the website uses Google Analytics and, where applicable, other services provided in particular by Google, Inc., Facebook Inc. or Automattic Inc. (hereinafter collectively referred to as “Other companies”).

7.2. Our website available at: https://www.labona.eu/ uses so-called "cookies" for its operation. These are text files that are used to measure number of visits of the website labona.eu, to customise the display of web pages and for targeting advertising. These cookies are sent by the specific page visited to the website visitor's browser to enable the recording of information about the visit, recognition of the website visitor's device, etc.

7.3. Our website uses session (temporary) cookies, which are automatically deleted when you stop browsing the web interface. They also use persistent cookies that remain on your device until their expiry date or until you delete them.

7.4 The cookies used by our website are either first-party cookies or third-party cookies.

• • • First-party cookies - these cookies are associated with the domain of our website. These are essential cookies and performance cookies. They can be temporary or permanent.
    • Third-party cookies - these cookies are assigned to a domain other than the domain of our website, even when you are on our website. These cookies allow us to analyse our website and display tailored advertising for you. These are functional, targeting and advertising cookies.

7.5. The specific types of cookies used and their purpose:

• • • Essential cookies - these cookies allow you to navigate the web interface and use basic functions. These cookies do not identify you in any way and do not constitute personal data.
    • Performance cookies - these cookies are used to analyse how the web interface is used (number of visits, time spent on the web interface and other similar information). The data collected by these cookies is anonymous.
    • Functional cookies - these cookies are used to personalise the content by remembering login details, geolocation and so on. Personal data may be collected and processed via functional cookies.
    • Targeting and advertising cookies - these cookies are used to serve targeted advertisements on and off the web interface. Personal data may be collected and processed through advertising cookies. We may also share information about your use of our website with our social media, advertising and analytics partners and consultants.

7.6. You can refuse the use of cookies by selecting the appropriate settings in your internet browser. Please note that if you refuse the use of cookies, you may not be able to use the full functionality of the web interface.

8.1. You have the right to contact us at any time to obtain information about the how your personal data is processed or to exercise the rights you have in relation to the processing of your personal data under the applicable data protection legislation listed below:

• • • The right of access to all personal data processed - you have the right to obtain confirmation from us as to whether or not personal data concerning you is processed by us and, if so, to obtain in particular the following information:

- what are the purposes of processing your personal data;
- the categories of personal data concerned;
- who, apart from us, are the recipients of your personal data;
- the period for which your personal data will be stored by us;
- the existence of your rights to rectification, erasure, restriction of processing of personal data, the right to object, the right to lodge a complaint with a supervisory
  authority; any available information on    the source of the personal data;
- the fact that automated decision-making, including profiling, takes place;
- you also have the right to request a copy of the personal data we process about you;

• • • The right to withdraw your consent to the processing of your personal data at any time, if personal data is processed on the basis of your consent with the processing of your personal data;
    • The right to rectification (clarification or completion) of personal data processed - you have the right to have us correct your inaccurate personal data concerning you without undue delay;
    • The right to erasure of personal data – you have the right to have personal data relating to you erased without undue delay and we are obliged to erase personal data without undue delay if one of the following reasons applies:

- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
- you have revoked the consent on the basis of which your personal data was processed and there is no other legal reason for its processing,
- you have objected to the processing of your personal data and there are no overriding legitimate reasons for processing it,
- your personal data is unlawfully processed by us,
- your personal data must be erased to comply with a legal obligation,
- the personal data has been collected in relation to the offer of information society services referred to in Article 8(1).       

Please note that some of your personal data must be retained by us in accordance with the relevant legislation, despite your request for deletion (in particular your personal data on invoices or other accounting documents). We may also continue to process your personal data despite your request for deletion for the purpose of asserting our legal claims against you.

• • • The right to restrict the processing of personal data – you have the right to ask us to restrict processing in any of the following cases:- 

- in the event that you dispute the accuracy of your personal data, for the time necessary for us to verify the accuracy of the personal data,
- the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead
- we no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims,
- you have objected to the processing until it is verified that our legitimate grounds outweigh your legitimate reasons.

In the event of a legitimate request to restrict the processing of personal data on your part, we are only entitled to further process the personal data concerned with your consent.

• • • The right to obtain the personal data processed and to transfer such personal data to another controller (right to data portability) - you have the right to obtain the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and the right to transfer these data to another controller without hindrance from us, where the legal basis for the processing of your personal data is consent or a contract and the processing of personal data is carried out by automated means;
    • The right to object - you have the right to object at any time, for reasons relating to your particular situation, to the processing of your personal data which is processed on the legal grounds of a legitimate interest - see the section of this document entitled "Purpose and grounds for processing personal data" above.
    • The right to be informed of a breach of the security of your personal data in the cases provided for in the relevant data protection legislation;
    • The right to lodge a complaint with the Office for Personal Data Protection; without prejudice to any other means of administrative or judicial protection, you have the right to lodge a complaint with the supervisory authority, i.e., the Office for Personal Data Protection, Pplk. Sochora 27 Prague 7, Postcode: 170 00, tel. +420 234 665 111, email: posta@uoou.cz, www.uoou.cz, if you believe that our processing of your personal data has violated the legal regulations governing the protection of personal data.

8.2. Your rights set out in the preceding paragraph above, except for the complaint to the Data Protection Authority, are exercised directly with us via our email: info@labona.eu, in writing at our registered office: Palackého nám. 152, 665 01 Rosice, or via our mailbox: uk6y3zj.

To exercise these rights, please use our form available HERE.

8.3. We provide all communications and statements regarding your exercised rights free of charge without undue delay, but no later than one (1) month after the customer has exercised the right. The Administrator shall be entitled to extend the time limit by two (2) months if necessary and in view of the complexity and number of applications. We are obliged to inform you of the extension of the deadline, including the reasons.

8.4. We reserve the right, if you exercise your rights as set out above unreasonably or disproportionately, to charge you a reasonable fee to reflect the administrative costs associated with providing the requested information or to refuse to comply with your request.

                                                                                                                                                                                                                                        Labona s.r.o., 01/01/2022