INAPA s.r.o.
Quality & certification
GDPR · Personal data protection

Personal Data Protection Principles

Effective from 1 Jan 2020

English translation for information. The Czech version is binding.

Download PDFOriginal document in Czech (PDF)Česká verze (závazná)

INAPA s.r.o. (the “company”) issues these personal data protection principles.

Within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), our company is the controller of your personal data. This means that it processes the data, determines the purposes and means of the processing and is responsible for it. The aim of these principles is to give you clear and understandable information on how we process your personal data.

The information in this document applies to natural persons who provide personal data, above all our customers and business partners, but it also applies, to a reasonable extent, to potential customers and business partners (persons with whom we have no contractual relationship but are in contact) and to former customers and business partners whose data we may still process under certain conditions. The information also applies, to a reasonable extent, to family members or representatives of customers and business partners.

In particular, you will learn:

  1. which of your personal data we process;
  2. for what purposes and in what way we process your personal data;
  3. to whom your personal data may be disclosed;
  4. for how long we will process your personal data;
  5. what rights you have in relation to the protection of your personal data.

If you need advice or wish to discuss any further processing of your personal data, please write to inapa@inapa.cz.

Principles of personal data processing

  • we process your personal data fairly, lawfully and transparently;
  • personal data are collected only for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes;
  • the personal data processed are adequate, relevant and limited to what is necessary for the stated purposes;
  • every reasonable step is taken to ensure that we process only accurate and up-to-date personal data and that inaccurate personal data are erased or rectified without delay;
  • personal data are kept for no longer than is necessary for the purposes for which they are processed;
  • personal data are processed in a manner that ensures their appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Scope of personal data processed

Identification and address data:
academic title, first name, surname, date of birth, permanent address, delivery or other contact address and, for self-employed persons, also the business name or any addition to the name, place of business and Company ID;
electronic contact data:
telephone, mobile phone, fax, e-mail address, data box ID;
other personal data needed to perform a contract:
bank account number, amounts of payments and other such data;
information on creditworthiness and reliability:
records of consumer history and payment behaviour, including information from public registers; other personal data you provide in contractual or other documents, in negotiations and when using our services, including later updates.

How we obtain personal data

We obtain your personal data mainly from you. We may obtain some of your personal data from publicly available sources. We always tell you whether providing your personal data is a statutory or contractual requirement, whether you are obliged to provide it and what the possible consequences of not providing it are.

When we obtain personal data from you, we do so mainly on the basis of your requests and in negotiations on concluding a contract, in personal, telephone or written communication with you, including by e-mail.

The publicly available sources from which we obtain personal data are mainly:

  • the commercial register;
  • the insolvency register;
  • exceptionally, social networks and the internet in general, if you have published the data yourself.

Exceptionally, we may also obtain your personal data from third parties that are authorised to handle them and to pass them on to us under the prescribed conditions.

Purposes of processing

We process your personal data to the extent necessary for the given purpose and for as long as necessary to fulfil it. Once the purpose has been fulfilled, we may process your personal data for purposes other than those for which they were collected.

We process your personal data:

  1. to conclude and perform contracts we have entered into with you and to handle your requests;
  2. for the purposes of our legitimate interests;
  3. for marketing purposes.

a) To conclude and perform contracts we have entered into with you and to handle your requests

We process your personal data for purposes related to the performance of the contractual obligations of both parties, for the valid conclusion, amendment and termination of contracts, and for the related invoicing, complaints and communication. Providing this personal data is a contractual requirement. All the personal data we hold about you are processed for these purposes. We process the personal data for the duration of the relevant contract and until the obligations under it have been settled.

b) For the purposes of our legitimate interests

Personal data may be processed where it is necessary to protect property or the right to enforce our legitimate claims. These are the following legitimate interests:

Debt recovery / defence of legal claims.
For this purpose, all the personal data we hold about you are processed. We pass your personal data on to third parties in order to recover our receivables. We keep the personal data for no longer than the limitation periods. If court, arbitration, enforcement or similar proceedings are initiated, we continue to process the data for the duration of those proceedings and then for the period in which extraordinary remedies may be lodged. If an extraordinary remedy is lodged, we keep the personal data for the duration of the proceedings on it.
Enquiries for products and services.
If you are an existing supplier, we may contact you to a limited extent even without your consent in connection with enquiries for products and services we have obtained or obtain from you. We may do so through various channels – by telephone, by post or electronically (e-mail and SMS). For this purpose we process your personal data to a limited extent, usually your Company ID, address details and electronic contact. The processing lasts for the duration of our contractual relationship unless you object to it, in which case it ends immediately. Where published data are used, their processing ends as soon as the offer is declined.
Offers of products and services.
If you are an existing customer, we may contact you to a limited extent even without your consent in connection with offers of our products and services that you obtain from us. We may do so through various channels – by telephone, by post or electronically (e-mail and SMS). In that case we process your personal data to a limited extent, usually your Company ID and electronic contact details. The processing lasts for the duration of our contractual relationship unless you object to it, in which case it ends immediately.
Company management, research, internal evaluation and reporting.
To achieve our business goals more effectively and to adapt our products, we use your personal data to a limited extent for statistical research, internal administration, analyses and internal reporting within the company. Although your personal data may serve as an input for these activities, their results are usually anonymised. Your data are not processed further in this connection.

c) For marketing purposes

We may use your first name, surname, e-mail address and home address to send you commercial communications and to inform you about events, deliveries or services we provide, provided that you have given us your consent to this processing. We process the personal data for the duration of the contractual relationship and for 3 years afterwards, or until you withdraw your consent. If you are not our contractual partner, your consent is valid for 3 years from the date it was given, or until you withdraw it. Once the consent has expired, your personal data will be erased or processed only to the extent and for the purposes for which your consent is not required by law.

You gave your consent voluntarily and may withdraw it at any time. Not giving or withdrawing consent has no effect on your contractual relationship or on the use of products and services for which this consent is not required. You can withdraw your consent in person at the company's office, in writing by a notice delivered to the address given in the contact details, or at inapa@inapa.cz. Please note that withdrawing your consent does not affect the processing of your personal data that we carry out for other purposes.

Who has access to your personal data

For the above purposes, we may pass your personal data on to our contractual partners so that they can process them for us. Personal data may be disclosed to:

  • an external law firm;
  • processors providing server, web, cloud or IT services, or their business partners;
  • other processors that uphold the confidentiality of personal data in accordance with the GDPR.

How long we process personal data

We will process your personal data for as long as we provide our services to you or perform our mutual contract, or for as long as necessary to fulfil our archiving obligations under applicable law, e.g. the Accounting Act or the Value Added Tax Act.

Your rights in relation to the processing of personal data

In relation to our processing of your personal data, you have the following rights:

  1. the right of access to personal data;
  2. the right to rectification;
  3. the right to erasure (“right to be forgotten”);
  4. the right to restriction of processing;
  5. the right to object to processing; and
  6. the right to lodge a complaint about the processing of personal data.

You can exercise all your rights by contacting us at inapa@inapa.cz. You can lodge a complaint with the supervisory authority, the Office for Personal Data Protection (www.uoou.cz).

Right of access.
You may ask at any time for confirmation of whether or not personal data concerning you are being processed and, if so, for what purposes, to what extent, to whom they are disclosed, for how long we will process them, whether you have the right to rectification, erasure, restriction of processing or to object, where we obtained the personal data and whether automated decision-making takes place on the basis of the processing. You have the right to obtain a copy of your personal data; the first copy is free of charge, and a reasonable fee to cover administrative costs may be charged for further copies.
Right to rectification.
You may at any time ask for your personal data to be rectified or completed if they are inaccurate or incomplete.
Right to erasure.
We must erase your personal data if (i) they are no longer needed for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for it, or (iv) we are required to do so by law.
Right to restriction of processing.
Until any disputed questions about the processing of your personal data have been resolved, we must restrict their processing so that we may only store them and, where applicable, use them for the establishment, exercise or defence of legal claims.
Right to object
to the processing of your personal data for direct marketing purposes or on the basis of legitimate interest. If you object to the processing, your personal data will no longer be processed for these purposes.

These Personal Data Protection Principles are effective from 1 January 2020.