Protection of personal data

Personal data processing rules

Kouty Ski Centre (www.kouty.cz)

At  K3 SPORT, s.r.o., I. P. Pavlova 738/116, Olomouc 779 00, Company ID No: 268 30 248, we take the protection of your personal data seriously. The objective of the document “Personal data processing rules” is to inform you about how the controller processes your personal data, the legal grounds, purposes  to which we use the data, period for which we keep your data, what third parties can get access your  personal data.

These Personal data processing rules are effective from 7.11.2018 and are issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) and in compliance with other related legislation.

Our company provides services at the Kouty Ski Centre (see www.kouty.cz), organises trips (see www.dlouhe-strane.cz) and offers accommodation in  apartment houses (see www.apartmany-kouty.cz).

1. Your personal data that we process

We process your personal data that we obtained from you at the time you purchased our products, utilisation of our services, during use of our website, or during communication with  you. In  this connection, we can collect and process your data particularly in the personal data categories stated below:

1. Identification data. This mainly concerns your name and surname, and Company ID No and Tax ID No if you are an entrepreneur.
2. Contact information. This concerns data that enables us to contact  you, particularly the contact address, delivery address, billing address, telephone number, e-mail address.
3. Information about your orders. This concerns data related to the  use of our services, particularly the data on goods and services which you ordered, their quantity and type, method of delivery and payment including the payment account number.
4. Information about your behaviour on the website. This concerns data that we collect about you particularly when using our website, and that you submit to us via the web browser, especially the browser type/version, operating system used, URL address of the previously visited website, identity of the computer in  the network (IP address), time of the login and use of our website.
5. Data related to our communication with the customer. This concerns data generated during communication related with  our services, both in personal communication, written or electronic communication.
6. Camera records from the  Kouty Ski Centre and restaurant facilities operated by the operator of the centre. We use camera systems to protect our assets and the safety of our employees and visitors in the  Kouty Ski Centre premises (entrance terminal to the  chair lift) and our restaurant facilities. The premises under camera surveillance are always properly and visibly marked.

1. Why we process your personal data and justification of this  processing

Within the  framework of our services in the  Kouty Ski Centre, we process your personal data for various legal reasons according to the purpose to which we use such data. This concerns the following legal reasons:

1. fulfilment of a contract;
2. our justified interests;
3. consent; or
4. fulfilment of our legal duties.

Your personal data are processed for the following purposes:

1. Clearance of your order, provision of the service and exercise of the rights and obligations under the contract between us and the customer

In such case  we process mainly your personal identification data, contact data, data related to our communication with  you and data on your orders. We process the personal data for this purpose particularly for fulfilment of a contract and provision of these personal data is mandatory and is a condition for provision of our services.

2. Clearance of complaints and handling of losses (insurance events)

In such cases  we process mainly your personal identification data, contact data, data related to our communication with you and data on your orders. We process the personal data for this purpose mainly on the basis of our justified interests.

3. Sending of regular information and other marketing communication about our services and products or events we participate in

In this case ,  we process only the most essential of your data for delivery of information about our products or services to you by e-mail or SMS; this may particularly concern the e-mail address and telephone number. We process the personal data for this purpose on the basis of our justified interests consisting in the  effective and targeted promotion of our products and services.

You can reject processing of personal data for the  above-stated purpose by submission of an objection to  the processing of your personal data.

4. Improvement of our services

In such case, we process mainly the Data on your behaviour on the website. We process the personal data for this purpose on the basis of our justified interests consisting in the improvement of the quality of our services.

5. Protection of our assets, the assets of our customers, ensuring the safety of our customers and employees

For this purpose, we process mainly the camera recordings from the Kouty Ski Centre and restaurant facilities operated by the operator of the centre. We process the personal data for this purpose on the basis of our justified interests consisting in  protection of our assets, the assets of our customers and other persons within the  Kouty Ski Centre, and ensuring the safety of our customers and employees.

6. Fulfilment of our obligations stipulated by the applicable laws

In this event, we  process only the personal data that we need to fulfil our obligations particularly the identification data, contact data or the data on your orders. We process the personal data for this purpose in order to fulfil the  legal obligations, which are stipulated for us under the applicable laws, particularly:

• Act No 89/2012 Coll., the Civil Code, as amended;
• Act No 634/1992 Coll., on consumer protection, as amended;
• Act No 235/2004 Coll., on Value Added Tax, as amended;
• Act No 563/1991 Coll., on accounting, as amended.

7. Exercise of rights and legal entitlements

In this case, we process only the  personal data which are necessary for us to  exercise our rights or legal claims (for instance, in the event of  outstanding receivables on the customer’s part), particularly the identification data, contact data, data related to our communication with our customer and the data on all your orders. We process the personal data on the basis of our justified interests.

In the above-stated cases under 3, 4, 5, and 7 you have the right to object to the processing of your personal data (the right to object is described in greater detail in  Section VI, para. 6 below).

III. For how long will we process your personal data?

Personal data are processed to the  extent absolutely necessary to fulfil the above-stated purposes and for the period absolutely necessary to achieve them or for the duration stipulated by law. After this, the personal data are deleted or anonymised. We process the personal data for the following periods:

1. the personal data are processed for the absolutely necessary period for fulfilment of the contract and exercise of rights and obligations in connection with the contract,  including any complaints, resolution of damage claims or related court disputes, at maximum for a period of 10 years after expiry of the last contract or lapse of the guarantee period, if it was provided;
2. for the purpose of sending business notifications without granted consent, the personal data are process for a period of 3 years after lapse of the last contract between us or until an objection is submitted or termination of subscription for business notifications;
3. for the purpose of improving our services, we process the personal data for a period of up to 6 months;
4. for fulfilment of our statutory obligations, we process the personal data for a period stipulated by the applicable laws (for instance, according to the tax laws, this is for a period of 10 years from issue of the applicable documents top your order );
5. for protection of assets and ensuring safety through the camera recordings, which we procure in the Kouty Ski Centre and restaurant facilities operated within the centre, we process the personal data for a maximum period of 3 days after making the camera recording. In case of a safety incident, this period may be extended.
6. 
   Parties with access to your  personal data

In connection with the fulfilment of orders, supply and delivery of goods, handling of complaints, or insured events or promotion of products and services we may provide your personal data to partner companies for the purpose of customer care and advertising agencies for the production and distribution of advertising materials.

We can further provide the personal data  in connection with  fulfilment of our legal obligations or protection of our interests, particularly to lawyers, auditors, tax advisers, accountants or IT system administrators. Every such subject to whom personal data are provided is contractually obligated to protect your personal data in compliance with the legislation and process them exclusively according to our instructions.

We use the MailChimp platform of The Rocket Science Group LLC to send business messages and we transfer personal data to the  USA. The transfer is  done on the basis of the so-called Privacy Shield, i.e. the common legal tool of the European Commission and the USA to secure an appropriate level of personal data protection for their transfer to the USA. More information about the Privacy Shield is available here. (hypertext link to https://www.privacyshield.gov/welcome) Processing of personal data by MailChimp is governed by their processing rules available here. (hypertext link to https://mailchimp.com/legal/privacy/)

1. How we protect your personal data

The security of your personal and other data is important to us. For this reason, we adopted all technical and organisational measures to secure  them.

To secure your personal data, we have adopted technical measures to secure the data storages and personal data storages in print format. For transfer of data from our  website www.kouty.cz, we exclusively use the HTTPS security protocol and for electronic communication with you we only use a secure and encrypted e-mail connection.

Above the framework of the above-stated technical measures, we also ensure that only authorised persons have access to the  personal data in  digital and  printed format.

1. Your rights related to processing of your personal data

In relation to the  processing of your personal data, you have the following rights:

1. right of access to your  personal data (Art. 15 GDPR);
2. right to correct inaccurate or complete incomplete personal data (Art. 16 GDPR);
3. right to the deletion of your personal data (Art. 17 GDPR);
4. right to the restriction of the processing of your personal data (Art. 18 GDPR);
5. right to the transferability of your personal data (Art. 20 GDPR);
6. right to object to or file a complaint against processing in certain cases (Art. 21 GDPR);
7. right to file a complaint to the Office for Personal Data Protection, Art. 77 GDPR).

In the event that we process your personal data on the basis of your consent, you have the right to revoke your consent at any time. Such revocation of consent shall not affect the legality of the processing of your personal data prior to its revocation.

1. Right of access to personal data
   You have the right to be informed if we process your personal data and to get access to  such data as well as to information about how we process the given data. We have already integrated information about how we process your personal data in the document “Personal data processing rules”, but this does not waive your right to demand this information again. At the same time, you can request us to send a copy of your personal data. Please take note of the fact that the first copy of your data will be sent to you free-of-charge but any additional copy shall be sent at a small fee.
2. Right to rectification

We do everything possible to process precise personal data. If you ascertain that we are processing incorrect personal data, we shall correct the data or complete them according to your request.

3. Right to deletion
   In certain cases stipulated in  Art. 17 GDPR, you have the right to request that we delete your personal data. Please be aware of the fact that even if you present any of these  reasons, we shall not be able to delete your personal data if their processing is necessary for fulfilment of our statutory obligations or exercise and defense of our rights.
4. Right to restriction of processing

In the cases  stated in  Art. 18 GDPR, you can also request us to restrict processing of your personal data for a certain period.

5. Right to personal data portability
   You also have the right to request your data from us if you want to transfer them to another  personal data controller. You can exercise this right to the  data that we obtained from you on the basis of your consent or fulfilment of contract. This right can be exercised exclusively for data that we process automatically in  our electronic databases.
6. Right to object to personal data processing
   In the event that we process your personal data on the basis of our justified interest (for instance, for the purpose of sending promotional information about our products and services), you have the right to object to such processing. In such a case,  we must not continue processing your personal data provided we cannot prove our dominant justified interest in their processing. We can continue processing the personal data if our interest in their processing outweighs any negative impacts on you. In the event that  the personal data are processed for the purposes of sending promotional information about our products and services, we shall stop their processing immediately upon receipt of the objection. In such case,  we shall no longer be able top acquaint you with  our product and service offers.
7. The right to file a complaint to the Office for Personal Data Protection
   If you assume that we process your personal data  is in violation  of the legal regulations and you did not successfully exercise the rights stated above, you have the right to file your compliant with the Office for protection of personal data (uoou.cz).

Exercise of your rights

You can exercise your rights by submission of a written request to the address K3 SPORT s.r.o., I. P. Pavlova 738/ 16, Olomouc 779 00 or by e-mail sent to the address osobniudaje@k3-sport.cz. We shall handle your request immediately, but at the latest within one month. In exceptional cases, particularly for reason of  the complexity of your request or large number of such requests, we are authorised to extend this period by two months. In such a case,  we shall inform you about the extension and the reasons for it. In the interest of  security of your personal data and their protection against access by unauthorised persons to them,  we can verify your identity in a suitable manner.

VII. Rules for use of Cookie files

For the purpose of improving the services provided to the customers, our website uses cookies. Cookies are small text files which the website stores on your PC or mobile device at the moment when you start using the website and mainly help:

• to ensure the correct functionality of the website, to ensure completion of the shopping process with as few problems as possible;
• by remembering customer login data so that you need not enter them every time;
• to determine the sites and functions most frequently used by customers;
• to measure traffic to our site;
• to determine which advertisements the customers most frequently read to ensure that they do not keep reading the same advertisements or to help ensure that they do not see advertisements for goods or services that they are not interested in.

If your browser has activated use of cookies, we shall assume that you agree with the use of standard cookies from our servers.

Cookies collect certain information about your behaviour on the web. The validity/functionality of the cookies shall expire either at the end of the session (after the device disconnects from the website/Internet) or after a certain limited period of time. The data on your behaviour on the web are anonymised for reason of maximisation of your privacy, and for this reason, not even we can assign them to a specific user, i.e. a specific person.

The cookies that we use:

• Short-term, so-called, “session cookies” that are temporary and remain on the customer’s PC only until the browser ends the current session;
• long-term, so-called “persistent cookies”, which are stored in the customer’s device for much longer or until they are physically removed.

Analytical and advertising cookies

For the purposes of improvement of our services and better targeting, we use tools for analysis of the use of our website and for  personalisation of advertisements. For this purpose, we use cookies provided by a third party, Google, that provides the Google Analytics Premium service (including marketing functions) and Google AdWords.

Google shall use the information for assessment of use of our website and creation of reports on its activity (for our internal requirements) and provision of other services concerning the activities on our website and use of the Internet in general. The data received via these cookies are also used for promotional purposes where based on these data you could, for instance, receive advertisements of our services also on other websites.

The data generated by the cookie about the use of our website are anonymised, including your IP address. This information is not in any way linked to other information and we are thus not capable of identifying you on their basis. More information about how Google processes data from  cookies is available here.

Most of the standard browsers automatically accept cookies already in their default setting. It is possible for your browser to reject or delete the cookies or only allow the use of some cookies. For more information about the use and administration of cookies, you can use the help file in your browser or you can for instance visit the following links according to the browser used:

• Microsoft Internet Explorer
• Chrome
• Mozilla
• Safari

VIII. Closing provisions

1. We can unilaterally amend these Personal data processing rules, but we shall do so only in  necessary cases and we shall always notify you about any such changes. We will also publish the new version of the Rules on our website.
2. In case of any questions regarding the protection of personal data, you can contact us by e-mail at osobniudaje@k3-sport.cz or in writing at our registered office address stated above.