Principles of personal data processing in SWORP a.s.

The purpose of this document is to provide you with a comprehensive and comprehensible summary of information on the processing of personal data within the framework of using SWORP, especially in what way, to what extent, for what purpose and for how long we will process personal data and further you inform you about all your individual rights that you can exercise in connection with the processing of personal data.

If you do not understand something from this document, do not hesitate to contact us via the contacts below and we will be happy to explain everything to you in more detail.

At the same time, we refer in particular to Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons in connection with the processing of personal data and on the free movement of such data, and on the repeal of Directive 95/46/EC (General Regulation on the Protection of Personal Data), as well as the Czech Adaptation Act to this Regulation No. 110/2019 Coll., on the processing of personal data, according to which our relationship in connection with the processing of personal data is primarily governed.

I. Who is the administrator of your personal data?

The administrator of personal data is generally a person who himself or together with other entities determines the purpose and means of processing personal data, for which it also bears related responsibility.

The controller of personal data for the purposes of these personal data processing policies is SWORP as, identification number 17216621, with its registered office at Hybernská 1007/20, Prague 1, 110 00, registered in the commercial register maintained by the Municipal Court in Prague, file number B 27355.

You can contact it via email info@sworp.com.

II. Personal data protection

The personal data protection officer has not been appointed.

III. Our main principles

When processing your personal data, we honor and respect the highest standards of personal data protection and in particular adhere to the following principles:

• process your personal data for the specified purpose, by the specified means and in the specified manner, and only for the time that is absolutely necessary due to the purposes of their processing ;
• We protect your personal data and ensure their processing with the highest level of security in order to prevent any unauthorized or accidental access to your personal data, their change, destruction or loss, unauthorized transmission, or other unauthorized processing;
• we follow appropriate technical and organizational measures to ensure a level of security corresponding to all possible risks; all persons who come into contact with personal data are obliged to observe confidentiality regarding information obtained in connection with the processing of such data.

IV. What personal data do we process?

The nature of the personal data that we obtain from you and subsequently process depends primarily on the relationship you have with us and the purpose for which the personal data is obtained.

Typically, we will collect the following information from you:

Identification data

Your name, surname, title, gender, date of birth, residential address, nationality, identification number (if you are an entrepreneur), address of your seat or place of business (if you are an entrepreneur), signature.

Contact information

Residential address, mailing address, e-mail address, telephone number, or other data that you provide to us for the purpose of contact or use of our services

Records of our mutual communication

Above all, records of our e-mail or written communication between us. We do not use a phone call recording system.

Data about your property

If you use SWORP for the purpose of ordering craftsmen, we will obtain data from you about the condition of your property, as well as other information related to it.

Invoicing data

Data from issued invoices, or other data related to our mutual transactions (e.g. if we serve as a collection point for you regarding payments).

Other data

For example, data that we obtain from your internet browser, mobile phone or based on the storage of cookies.

V. How do we obtain personal data?

You primarily provide us with personal data voluntarily in person, by phone, by filling in forms, setting up user accounts or as part of the information and data provided for the purpose of using SWORP. We also obtain personal data from our own activities. We may also obtain personal data from third parties with whom we cooperate or have some other relationship, and who are authorized to process and share your personal data.

VI. For what purposes do we collect personal data?

We use your personal data for the purposes arising from our activity, while it is true that we do not need to obtain your consent for most such processing, as the processing is allowed to us directly on the basis of legal regulations. At the same time, we are entitled to (where appropriate) process personal data or their category for various purposes.

If it is necessary to obtain your consent for any of the purposes, you can revoke this consent at any time during the period for which it will be granted. We only point out that the withdrawal of consent has effects for the future, so it does not affect the legality (and legitimacy) of processing personal data until the moment of its withdrawal.

The specific main purposes of processing personal data are then the following:

• operating SWORP – the legal basis for this processing is the conclusion and fulfillment of a contract and the protection of our legitimate interests;
• conclusion and fulfillment of cooperation contracts or other contracts concluded with our partners - the legal basis for this processing is the conclusion and fulfillment of the contract;
• communication with you and other persons as part of our activity and for the purpose of improving our services – the legal basis for this processing is the conclusion and performance of a contract and the protection of our legitimate interests;
• direct marketing (sending newsletters or other marketing e-mails, sms or other similar activities) – the legal basis for this processing is the protection of our legitimate interests;
• providing cooperation to public authorities - the legal basis for this processing is the fulfillment of our legal obligations;
• the establishment and protection of legal rights, the protection of our privacy, our safety or our property and/or rights, you or other persons and the effort to use available corrective measures or limit our damage - the legal basis for this processing is the protection of our legitimate interests and the fulfillment of legal obligations , which apply to us.

VII. How long will we keep your personal data?

We take every step to ensure that the personal data we collect and process is secure and serves the intended purpose. We will therefore store personal data only for the necessary time in accordance with the principle of personal data minimization. We continuously assess whether there is still a need to process certain personal data required for a given purpose. If we find that they are no longer needed for any of the purposes for which they were processed, we will dispose of the data.

Below we provide an example of some of the times we observe in this context: we keep

• personal data in connection with the performance of our contract for a period corresponding to the relevant limitation periods;
• if we obtain some personal data from you before the conclusion of the contract and this conclusion ultimately does not take place, we will keep the personal data for a maximum of 1 year from the date of their acquisition;
• for the purposes of so-called direct marketing, we keep personal data for the duration of our contractual relationship and a maximum of 1 year after its termination;
• if you give us consent to process personal data for purposes other than direct marketing, we will retain such personal data for the period specified in such consent, or until you withdraw such consent;
• accounting and tax records, which we use to document our accounting and fulfill tax obligations (and which may contain, in particular, invoicing personal data), we keep for the period specified by special legal regulations, starting from the end of the relevant accounting or tax period.

VIII. Who do we share your personal data with?

We generally process your personal data internally. However, if it is necessary to achieve one of the purposes above, we may also share your personal data with third parties, both in the position of processors and independent, or joint administrators. In such a case, however, we undertake to transfer personal data only to entities that are guaranteed a sufficient level of personal data protection in accordance with personal data protection regulations. At the same time, we are also obliged to transfer your personal data to public authorities in some cases, if required by law. Finally, we share some personal data with third parties based on your prior consent.

In particular, we may make your personal data available to the following entities, provided that the conditions are met:

• our contractual partners and suppliers of our services – we share personal data for the purpose of providing our services with other entities such as postal and transport service providers, IT service providers, debt collection entities, law firms, accountants and tax advisers and providers of printing, advertising and marketing services;

• public authorities and third parties participating in court or similar proceedings – in accordance with compliance with our other legal obligations, we are also obliged to transfer your personal data to relevant public authorities such as law enforcement authorities. As part of any disputed proceedings, your personal data will also be shared with third parties as participants in such proceedings;

• other third parties – we are also entitled to share personal data with, for example, payees, service providers in the event of extraordinary events (fire, police and medical emergency services), etc.

IX What rights do you have in relation to the processing of personal data?

In connection with the processing of personal data, you have a number of rights that you can exercise against us through our contacts listed above.

Your request to exercise some of the rights below will be processed within one month at the latest (or within three months in justified cases, while we will inform you in advance of the extension of this period in good time) with the understanding that we will not require you to pay any fee. However, it also applies that if we receive an obviously unreasonable or unreasonable request (e.g. if there is a repeated request within a short period of time), we are entitled to demand a reasonable administrative fee to cover our costs of processing this request.

• The right to access your personal data – you have the right to request information about whether we process your personal data and, if so, also to provide a statement of this data, as well as information about the purposes for which we process it and how long we plan to process it for keep. We will provide you with the first copy of the statement of processed data free of charge, for each additional copy we may charge an administrative fee to cover our costs.

• The right to correct and supplement your personal data – if you find that the personal data we process about you is inaccurate, out-of-date or incomplete, you can ask us to correct or supplement it.

• Right to deletion – you can also ask us to delete your personal data that we process about you without undue delay. However, we are obliged to comply with this request only on the condition that:

• the processing of personal data is no longer necessary for the purposes for which it was collected or otherwise processed; or
• you have withdrawn your consent on the basis of which we processed personal data (and at the same time there is no other legal reason for processing); or
• you have successfully objected to the processing and there are no overriding legitimate grounds for the processing; or
• personal data has been processed unlawfully; or
• personal data must be deleted to comply with our legal obligation.

We will not comply with your request to delete personal data after that, especially if their processing is still necessary to fulfill our legal obligation or to determine, exercise or defend our legal claims.

• The right to limit processing – you can request that we limit the processing of your personal data (i.e. not to use them, but at the same time to prevent their complete disposal), but only in the following cases:

• you have questioned the accuracy of the personal data (processing will then be limited to time required for our verification of accuracy); or
• the processing of personal data is illegal and you are not interested in erasure; or
• we no longer need the personal data for the processing purposes for which they were obtained, but you require them for the determination, exercise or defense of your legal claims; or
• you have objected to processing and verification is underway as to whether or not our legitimate reasons for processing outweigh your objection.

Please note that even if processing is restricted, we will still be able to process personal data if:

• we have your consent; or
• it will be necessary to establish, exercise or defend our legal claims; or
• it will be necessary to protect the rights of other natural or legal persons.

• The right to portability of personal data – if the processing takes place on the basis of your consent or for the purpose of concluding or fulfilling a contract, you have the right for us to provide you at your request with personal data concerning you in a structured, commonly used and machine-readable format, or to transfer this data to another administrator.

• Right to object – You have the right to object to the processing of personal data carried out for the purposes of our legitimate interests. If we subsequently cannot prove to you that we have serious reasons for such processing that outweigh your interests or rights and freedoms, or that are necessary for the determination, exercise or defense of legal claims, the processing of your personal data will be stopped.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes. If such an objection is raised, these personal data will no longer be processed for these purposes.

• The right to withdraw your consent to the processing of personal data – if we use your consent to process your data, you are entitled to withdraw this consent at any time. The revocation of consent then only has effects for the future, so the legality of the previous processing will not be disturbed in any way. The revocation of consent must contain information about who is filing the revocation (in other words, attach the name, surname, residential address, date of birth, or other identification data of yours) and which specific consent you are revoking and to what extent.

• You have the right to file a complaint with the Office for Personal Data Protection - if, for any reason, your data is not being processed properly, you can contact the Office for Personal Data Protection, located in Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.cz, telephone: +420 234 665 111.

X. Do we use automated individual decisions?

As part of our activity, we do not automatically process any personal data, nor do we use automated decision-making.

XI. Personal Information of Others

If you provide us with personal information of other persons, you undertake: (i) to inform those persons of the contents of this document and (ii) to obtain all consents required by law for the collection, use, disclosure and transfer (including international transfer ) of the personal data of the persons concerned in accordance with this document.

XII. Do we transfer personal data to a third country or international organization?

We will not transfer personal data to countries outside the European Union or the European Economic Area, or to any international organization, unless we are obliged to do so due to the fulfillment of our legal obligations.

XIII. Do we use any data analysis services?

For the purpose of possible individualization of the content of our website, we mainly use Google Analytics, a service enabling data analysis.

In order to be able to use or however, we always require your prior consent to store your cookie files each time you visit our website.

XV Security

As part of our efforts to secure your personal data as much as possible, we take appropriate technical, physical, legal and organizational measures in accordance with applicable data privacy and security laws. If you have reason to believe that your communication with us is no longer secure (e.g. if you get the impression that the security of any personal data you have entrusted to us has been compromised), please notify us immediately via the contact details provided above.

‍

These policies are valid and effective from 1/1/2022.

‍