Statement on the processing of customers’ personal data

of SATTURN HOLEŠOV spol. s r.o., Dlažánky 305, 769 01 Holešov

under Regulation (EU) 2016/679 of the European Parliament and of the Council, including information for data subjects

SATTURN HOLEŠOV spol. s r.o., Dlažánky 305, 769 01 Holešov, company ID: 46900250 (hereinafter “SATTURN”), processes, as controller, the personal data of individuals when providing its services, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter “GDPR”), applicable from 25 May 2018, and applicable Czech legislation. Below we explain the principles and legal bases for processing, the purposes and retention periods, to whom SATTURN may disclose personal data and why, and individuals’ rights in relation to that processing.

1. Scope of personal data processing

Personal data are processed to the extent provided to SATTURN by data subjects – individual customers, individual customers of municipalities, employees, staff of corporate suppliers and customers, and municipal customers – in connection with a contractual or other legal relationship with SATTURN, or otherwise collected by SATTURN as controller and processed in accordance with applicable legislation or the controller’s legal obligations.

2. Sources of personal data

  1. directly from individuals when entering into a contract, placing an order, enquiring about services or conducting negotiations
  2. from legal entities in connection with a contractual relationship or a legal obligation

3. Categories of personal data processed

  1. address and identification details that uniquely identify an individual, such as first name, surname, date of birth, permanent address and service location address
  2. contact details, such as a correspondence address, telephone number, email address and similar information
  3. financial details, such as bank account information
  4. other data necessary to perform the contract, such as the IP address used to access the service and information about the devices used by the customer
  5. personal data required by law

4. Purposes of personal data processing

SATTURN processes individuals’ personal data for the following reasons:

  1. performance of a contract or order entered into with SATTURN, primarily to provide the ordered services, including support services
  2. legal obligations, for example under accounting, VAT, archiving and records management, and electronic communications legislation
  3. the controller’s legitimate interests, including recovering unpaid debts, retaining evidence to defend SATTURN’s rights, and CCTV recordings to protect people and property
  4. direct marketing to customers, including information about SATTURN services

For these purposes, SATTURN processes only personal data contained in the contract or order or obtained from the individual during performance of the contract or order (see section 3, Categories of personal data). Processing personal data for contract performance is necessary to enter into the contract and for SATTURN to provide the agreed services.

5. Does SATTURN need an individual’s consent to process personal data?

SATTURN processes personal data under section 4(a)–(d) only on bases that do not require the individual’s consent.

6. How long does SATTURN process personal data?

SATTURN processes individuals’ personal data for the duration of the contractual relationship. After the contract ends, it retains data where required by law. This may currently be up to ten years after the contractual relationship ends. Data may also be retained to record and enforce SATTURN’s legal claims for unpaid services.

7. Methods of processing personal data

SATTURN processes personal data manually. No individual is subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them.

SATTURN currently uses cookies on its website, addressed in the context of GDPR, to make the site more attractive and improve it. Cookies are small text files stored on a visitor’s computer; they contain no viruses and cannot cause damage. SATTURN uses temporary session cookies, which track a person during a visit, and persistent cookies, which measure traffic and identify visitors and visit duration. Session cookies disappear when the visit ends and the user signs in again; persistent cookies are overwritten after one year. Browser settings can prevent cookies from being stored, but SATTURN does not recommend this because it may impair website functionality.

8. Categories of recipients of personal data

SATTURN also uses other suppliers to fulfil its contractual commitments and obligations. Suppliers that process personal data provided by SATTURN act as data processors. They process data under SATTURN’s instructions and may not use it for other purposes. SATTURN selects these suppliers carefully and enters into a data processing agreement with each, imposing strict obligations to protect and secure personal data.

SATTURN is also legally required to disclose personal data to public authorities in certain cases. SATTURN does not transfer personal data outside the EU.

9. Rights of individuals as data subjects

Every data subject has the right to information about processing of their personal data. SATTURN has summarised this information in this Statement. If you cannot find what you need here, please contact our company: satturn@satturn.cz, or write to our registered office: SATTURN HOLEŠOV spol. s r.o., Dlažánky 305, 769 01 Holešov. Under the GDPR, from 25 May 2018, a data subject who can be identified by SATTURN and proves their identity has the following rights:

  1. the right of access to, rectification and erasure of personal data
    the data subject may obtain information about the purpose, scope and retention period of processing and is entitled to have only accurate personal data processed; this includes the right to correct inaccurate data. If the purpose or legal basis for processing no longer exists, the data subject has the right to erasure
  2. the right to object
    a data subject may object at any time if they believe processing is contrary to law; where the objection is justified, SATTURN must stop processing the personal data
  3. the right to data portability
    if a data subject asks SATTURN to transfer their personal data to another controller, it will do so to the extent requested
  4. the right to lodge a complaint with the Office for Personal Data Protection
    a data subject may submit a notification or complaint to the Office for Personal Data Protection at any time: www.uoou.cz
  5. the right to restriction of processing
    if the data being processed are inaccurate, SATTURN will restrict processing for the period needed to correct or supplement them; processing will also be restricted while SATTURN checks whether an objection is legitimate
  6. the right to notification of a personal data breach
    this requires SATTURN, in accordance with the law, to notify the data subject of a breach of their personal data that poses a high risk to their rights and freedoms