Information for CLIENTS in accordance with Articles 13 and 14 of the GDPR Regulation
In accordance with Articles 13 and 14 of the GDPR Regulation and on the basis of the relevant provisions of the Privacy Policy (https://www.jazykovka.cz/Ochrana‑soukromi/), ASPENA Language School s.r.o., ID: 255 94 877, with its registered office at Brno, Veveří, Gorkého 64/15, Postcode 602 00, registered in the Business Register under File No. C 19243 kept by the Regional Court in Brno, as a personal data controller (hereinafter the “Company”), informs the Clients of the Company about the processing of personal data:
1. Name and contact information of the Company
ASPENA Language School s.r.o., ID: 255 94 877, with its registered office at Brno, Veveří, Gorkého 64/15, Postcode 602 00, e‑mail: gdpr@aspena.cz.
2. Personal Data Protection Officer
The Company is not obligated to have a Personal Data Protection Officer.
3. Purposes and legal grounds for the processing of personal data
• For the purposes of processing personal data in accordance with the GDPR Regulation, a Client of the Company is a natural person who:
a) provides the Company with their personal data in order to use the services of the Company,
b) is authorised to act on behalf of the legal entity of the Client in order to use the services of the Company and for this purpose provides the Company with their personal data.
• The Company obtains personal data about the Client in the following ways:
‑ directly from the Client via e‑mail or the form on the Company’s website, and furthermore during a personal visit to the Company’s premises or a personal meeting with the Client,
‑ from publicly available records (e.g. the Business Register, Trade Register, etc.), or social networks, provided that in such case the Client is asked to consent to the processing of personal data.
• The Company processes the obtained personal data of the Client automatically as well as manually.
• The Company processes the personal data of the Client in accordance with the GDPR Regulation for the following purposes, proceeding on the basis and within the scope of the following legal titles for the processing of personal data:
‑ implementation of pre‑contractual arrangements, or implementation of measures adopted prior to the conclusion of a contract at the request of the Client ‑ if the establishment of a legal relationship with the Company is initiated by the Client (legal title in accordance with Article 6, par. 1, point b) of the GDPR Regulation),
‑ Client’s consent to the processing of personal data ‑ if the establishment of a legal relationship with the Client is initiated by the Company, prior consent to the processing of the personal data of the Client during the pre‑contractual phase is required (legal title in accordance with Article 6, par. 1, point a) of the GDPR Regulation),
‑ performance of a contract to which the Client is a contracting party ‑ in particular identifying and contacting the Client, conditions of performance of the contract, information necessary to change the content of the contract, rights and obligations within the liability for defects (legal title in accordance with Article 6, par. 1, point b) of the GDPR Regulation),
• fulfilment of legal obligations applicable to the Company who is an accounting and taxable entity and, for this reason, retains accounting and other documents that may contain the personal data of the Client; and also the fulfilment of the legal obligations of the Company within the liability for defects (Article 6, point c) of the GDPR Regulation),
‑ fulfilment of the legitimate interests of the Company ‑ in particular the judicial or extrajudicial recovery of receivables from the Client, sending newsletters to the Client, improvement of provided services, business development, processing sales statistics by the Company (Article 6, point f) of the GDPR Regulation).
4. Categories and source of the personal data concerned, if not obtained directly from the Client
• The Company obtains the personal data of the Clients either directly from the Client or from publicly available sources (the Business Register, Trade Register, and other public records), and also uses information voluntarily published by the Client on social networks.
• If the personal data is not obtained directly from the Client, the Company hereby declares, in accordance with the GDPR Regulation, that the following personal data of the Client shall be processed: identification and contact information to the extent of name, surname, address, e‑mail address, telephone number, company ID, VAT number, and also operational data (e.g. payment details, data collected based on the performance of a contract).
• The Company does not process special categories of personal data of the Client.
5. Legitimate interests of the Company
The Company applies in particular the following legitimate interests in the processing of personal data:
• marketing ‑ sending newsletters to the Client recorded in the IS of the Company for the purpose of maintaining and increasing awareness of the services of the Company,
• recovery of receivables ‑ judicial or extrajudicial recovery of any receivables from the Client,
• improvement of the services provided, business development, sales statistics, etc. ‑ the Company constantly strives to improve the services provided, based on its own initiative as well as on suggestions from the Client, while maintaining the smallest possible degree of interference with the rights of individuals to the protection of personal data.
6. Recipients of personal data
The Company reserves the right to make the personal data of the Client available to the employees of the Company, if it is necessary for the performance of their duties, and also to processors with whom the Company has a contract for the processing of personal data (e.g. for accounting, IT, and marketing services), and any other persons and institutions in accordance with the legal regulations, in particular to state authorities and other public administration bodies on the basis of the legal obligation to provide personal data.
7. Transfer of personal data to a third country or international organisation
The company does not intend to transfer personal data to a third country outside the EU or to an international organisation.
8. Period for retaining personal data
The Company shall retain the personal data of the Client for the duration of the contract with the Client, or for a period of 10 years from entering the personal data of the Client into the IS of the Company. After the termination of the contract with the Client, the personal data of the Client will be retained to fulfil the legal obligations under the applicable laws (in particular regarding accounting and taxation) and, at the same time, for 10 years from the completion of the last order under the title of the above legitimate interests of the Company.
9. Rights of the Client to their personal data being processed
The Client may exercise the following rights with the Company in relation to their personal data by e‑mail at gdpr@aspena.cz:
• right to access personal data,
• right to rectification,
• right to erasure,
• right to restrict processing for a certain period of time,
• right to portability,
• right to object to the processing due to a legitimate interest.
10. Right to withdraw consent
If the processing of personal data is based on consent, the Client has the right to withdraw this consent at any time by e‑mail at gdpr@aspena.cz.
11. Right to file a complaint
The Client has the right to file a complaint with the Office for Personal Data Protection if the Client believes that the processing of their personal data has violated the GDPR Regulation.
12. Legal/contractual requirement to provide personal data
The provision of personal data by the Client is primarily a contractual requirement. The non‑provision of personal data by the Client will result in the non‑conclusion of the contract.
13. Automated decision making, including profiling
The personal data of the Client is not the subject of automated decision making or profiling.