Home Protection of Personal Data
nase-hodnoty

Protection of Personal Data

Protection of Personal Data
Principles relating to the Processing of Personal Data

of

TOPSEARCH, s.r.o.

(general)

Version 2 of 25 May 2019

Dear Sirs:

In this document, we would like to inform you how we handle your personal data which you have provided to TOPSEARCH s.r.o., with its registered office at Prague 10, Strašnice, K Rybníčkům 282/19, post code: 100 00, Company ID No.: 274 14 779, the company registered in the Commercial Register kept by the Municipal Court in Prague, ref. No. C 111415 (hereinafter referred to as “we” or the “company” or “TOPSEARCH”).

By this document, we fulfill the duty to provide you with information within the meaning of Article 12, Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”), and the obligation under Act No. 110/2019 Coll., on the processing of personal data (hereinafter referred to as “PPDA”). The text of GDPR is available here. The text of PPDA is available, inter alia, here.

A. Who is the controller of personal data provided by you and how can you contact them?

We, i.e. TOPSEARCH, are the controller of personal data provided by you.

In matters concerning the processing of your personal data, you can contact us in person in our offices at Konviktská 24, Prague 1, Staré Město, post code: 110 00, during normal business hours (on working days from 10:00 am to 4:00 pm).

You can also contact us by telephone using the telephone number +420226211880 or by e-mail at hr@topsearch.cz.

Instead of you, we can be contacted in matters concerning the processing of your personal data by a representative of your choice who will produce a written power of attorney to us.

B. In what situations do we process your personal data?

We process your personal data in the following cases:

  • in the context of business correspondence with clients (customers), suppliers and clients and other persons communicating with the company
    • in this case, we process personal data of the persons who send us the relevant business correspondence, in particular their name, surname, post/position held, telephone number(s), e-mail address, social network address, Skype contact details, signature, title(s)
  • in the context of entering into service contracts with our clients (customers)
    • in this case, we process personal data of the persons concluding the contract (name, surname, title, position), contact details of the persons referred to in the contract (name, surname, telephone number, fax number, e-mail address, other contact details of similar nature), signatures of the persons concluding the relevant contract
  • in the context of providing services to our clients (customers) in accordance with the concluded service contract
    • in this case, we process customer’s personal data which the customer disclosed to us for the purposes of fulfilling the concluded contract, i.e. arranging employment of a client (customer) or for a client
    • they are, in particular, details of the name, surname, date of birth, birth certificate number, education, experience and skills, job history, former employers, character, income, financial situation, health, including biometric data in the form of a photograph, voice recording or film recording, as well as other personal data disclosed to us in your professional CV
  • in the context of entering into contracts for the supply of goods and services to our company by our suppliers
    • in this case, we process personal data of the persons concluding the contract (name, surname, titles, position), contact details of the persons referred to in the contract (name, surname, telephone number, fax number, e-mail address, other contact details of similar nature), signatures of the persons concluding the relevant contract
  • in the context of the process of purchasing goods and services by our company from our suppliers (purchase orders, acceptance of orders)
    • in this case, we process personal data of the persons participating in the purchasing process (name, surname, titles, position), contact details of the persons participating in the purchasing process (name, surname, telephone number, fax number, e-mail address, other contact details of similar nature), signatures of the persons participating in the purchasing process
  • in the context of keeping a single database of suppliers and customers of our company
    • in this case, we process, in particular, contact details of the persons authorized to act or communicate on behalf of the supplier/customer in the form of name, surname, telephone number, fax number, social network account, Skype contact details, signature, post/position
  • in the context of employing staff and the process of selection of new employees (including legal relations to the company’s executives)
    • the information processed in this case is subject to separate Principles Relating to Processing of Personal Data of Employees to which we hereby refer
  • in the context of entering and moving around the company’s premises and offices
    • information about the name and surname and identity card number of persons entering the company’s premises, CCTV footage of movement of the persons around the buildings in which the company’s offices are situated if CCTV is installed, health information (e.g. about the extent of an injury and duration of treatment) if a person gets hurt in the company’s premises, biometric data (i.e. CCTV footage of the person’s movement if made)
  • in the context of operating the company’s website
    • information about cookies and IP address of the website user
  • in the context of activities on the company’s social network profiles
    • details of comments, statements of persons visiting the social network profile and details of persons sympathizing with the company’s social network profile, including their contact name on the social network
    • in this context, the company does not process the data independently but it leaves it to the social network operator to process the data as the company uses social networks as a common user
  • in the context of company’s participation in trade fairs, presentations, lectures and similar events
    • reportage style photographs of persons attending the company’s event for documentation purposes if taken (not photographs of every stand visitor)
    • reportage style video recording of participation at the relevant event, if made
      • in this context, the company gives the highest consideration to the possibility of anonymizing persons outside the company in the recording of the event
  • in the context of claims and disputes administration
    • details of the amounts of claims of natural persons, contact details of the persons authorized to act on behalf of our debtors, details of the contents of legal disputes and actions of persons involved in the legal dispute
  • in the context of accounting administration
    • information on bank accounts of natural persons, contact persons according to individual tax documents, information on payments to and from natural persons

C. What categories of personal data do we process?

We usually process the following personal data (to the extent to which the data are provided by the data subject):

  • name,
  • surname,
  • address,
  • marital status,
  • citizenship,passport / similar card number,
  • date of birth,
  • birth certificate number (S),
  • sex,
  • telephone number(s),
  • e-mail address(es)
  • details of social network account(s),
  • biometric data (S),
  • photograph and video recording (S),
  • health status (S),
  • IP address associated with you and cookies,
  • job history, skills and experience,
  • financial situation,
  • clean criminal record details (S).

Letter “(S)” identifies, for your information, the personal data which are sensitive.

We process sensitive personal data only if they are necessary to provide the relevant services to you or if there is a legal ground for the processing thereof. For details, we refer to Section J hereof.

D. How do we approach processing of personal data? What are the purposes for which we process your personal data, and what is the legal basis for processing of your personal data? What are our legitimate interests in the processing of your personal data?

We process your personal data so that we are able to fulfill the purpose of the contract which has been concluded with you or under which your personal data have been disclosed to us (the processing under Article 6(1)(b) GDPR). Thus, we process them in order to provide you with the services agreed in the contract or to provide services to the person who has disclosed your personal data to us and with whom you are in an employment or similar relationship or on whose behalf you are authorized to communicate with us.

We further process your personal data for the purposes of protecting your vital interests or the interests of another natural person. Thus, we process them for the purposes of investigating, for example, your injury if it occurs at the premises of our company.

We process the information which is processed for the purposes of protecting your vital interests or the interests of another natural person, for the purposes of carrying out investigations which we are obliged to carry out, complying with our legal obligation to prevent damage, and transmitting the information to the competent government and administrative authorities which carry out the relevant investigation or provide you with assistance in connection with an emergency in which you are involved provided that we are also affected by the emergency and obliged to investigate it. In this case, the purpose of processing of your personal data is to ensure the highest level of protection of your life and health and, where appropriate, your assets (the processing under Article (1)(d) GDPR).

We further process your personal data for the purposes of legitimate interests pursued by our company. The legitimate interests are defined as (a) the protection of our rights arising from a concluded contract if the contract is breached and your data have been transferred to us in the context of such contract, or (b) the situation where you raise any claim against us in relation to the concluded contract or where a party to the contract which has been concluded with us and under which your personal data have been transferred to us, raises a claim against us. Thus, we process your personal for the purposes of using them in judicial or compulsory enforcement of our claims and rights in case of breach of the contract, and for the purposes of legal defense in case any claim is raised against us in relation to a concluded contract (the processing under Article 6(1)(f) GDPR). In this respect, please note that under Article 21 GDPR, you have the right to object to processing of your personal data on grounds of our legitimate interests as defined above. You can file the objection using our contact details specified in Section B above.

We process your personal data on the basis of your consent given in writing (where appropriate) (the processing under Article 6(1)(a) GDPR). The scope of personal data thus processed is described in detail in the given consent.

Last but not least, we process your personal data for the purposes of complying with legal obligations to which we are subject. It is in particular compliance with obligations to financial, customs and administrative authorities of the Czech Republic, labor inspection authorities, state statistical service, Labor Office of the Czech Republic, Police of the Czech Republic, courts and similar authorities exercising their powers in accordance with the applicable legislation (the processing under Article 6(1)(c) GDPR).

We also use your personal data in the form of e-mail address to send newsletters of our company or specific job offers if we provide you with placement services. Please note that you can inform us at any time that you do not wish to receive any further newsletters or job offers (see Section I hereof).

E. Who is the recipient of your personal data?

Our company is the recipient of your personal data.

Given the nature of the services which we will provide to you under the contract, we will provide your personal data, to the extent that is strictly necessary, to:

(a) transport providers,

(b) accommodation providers if the company arranges for your accommodation,

(c) the insurance company with which insurance will be taken out for you or the person who has provided your personal data to us, if the disclosure of your personal data is necessary to conclude the contract,

(d) providers of other services agreed in the contract concluded with our company,

(e) government and administrative authorities investigating an injury, emergency or accident where such situation occurs,

(f) government and administrative authorities for the purposes of protecting your vital interests (see Section D above),

(g) healthcare establishments, doctors, paramedics/rescuers or similar persons providing you with treatment and/or saving your life where an event requiring the foregoing occurs at the premises of our company,

(h) legal representatives of our company for the purposes of recovering debts and/or protecting our rights in case of breach of contract and/or our defense against claims raised against us,

(i) entities engaged in debt recovery and/or commissioned to recover debts,

(j) government and administrative authorities if we are asked to provide your personal data in the context of exercise of powers of those authorities,

(k) providers of IT services,

(l) providers of accounting and audit services,

(m) persons involved in the fulfilment of a contract to which we are a party,

(n) parties interested in giving you a job in relation to which we act as an employment agency.

F. Will your personal data be transferred abroad?

Given the nature of the services we provide, your personal data will be transferred to other member states of the European Union and third countries (i.e. countries outside the European Union) if our services are provided abroad and it is necessary to transfer the data in order to provide the services to the persons involved in the foregoing.

In transferring your personal data to third countries, we will act in accordance with the contract concluded with the recipient of personal data which will include standard contractual clauses in the form required by European Union legislation. We will always transfer your personal data only to the extent that is strictly necessary.

G. How long will the company process your personal data?

Personal data in respect of which you have given consent to the processing thereof (where applicable), as such personal data are described in the consent, will be processed for the period for which your consent was given.

You can contact us for information on the period for which your consent to the processing of personal data was given, using the contact details specified in Section A hereof.

Personal data processed on the basis of relevant provisions arising from GDPR (see Section C above) will be processed for the period necessary to provide/receive the agreed deliverables under the contract, for the period necessary to prove to the competent authorities of the Czech Republic that a service has been provided under the accounting and tax legislation, and for the period necessary to protect our rights in case you breach the contract, but in all cases at least for the period of limitation of any claims, whether your claims or claims of our company, arising from the concluded contract or in connection with the concluded contract. Duration of the period of limitation is laid down in the Civil Code (Act No. 89/2012 Sb.).

H. How will your personal data be processed? How will your personal data be protected?

Your personal data will be processed in electronic form in the electronic system of our company, or in the electronic system of the persons to whom the personal data will be transferred.

Your personal data will be also processed in the form of a physical document (a document on paper or similar tangible medium) which will be stored in the company’s files.

We assure you that we have taken measures to ensure that your personal data are always protected to the maximum extent possible against abuse or loss.

All persons on our company’s part who come into contact with personal data have been trained and checked for that purpose. The archive of paper documents is secured against the entry of unauthorized persons. The archive is secured by locks and other security measures of physical protection. Electronically processed personal data are stored in a secured database.

I. What are your rights relating to the processing of personal data?

We hereby inform you about your rights relating to the processing of your personal data:

(a) If you have given us your consent to the processing of personal data in the form of consent, you have the right to withdraw your consent. You can withdraw your consent by a written notice sent by post to the address of our registered office (see Section A above) or electronically to hr@topsearch.cz; in the notice of withdrawal, you shall specify your identification in the form of your name, surname, date of birth and address of your permanent residence. It is sufficient to state the following in the notice of withdrawal: “I withdraw my consent given to TOPSEARCH, s.r.o. to the processing of my personal data.”

In relation to the withdrawal of your consent to the processing of your personal data, we hereby inform you that our company remains authorized to process your personal data if the purpose of processing is based on a ground envisaged by GDPR other than your consent.

Please note that the withdrawal of your consent will not affect the lawfulness of processing of your personal data based on the consent you have given. This means that the processing of your personal data by our company at the time of validity of your consent will continue to be considered lawful even after withdrawal of your consent.

(b) You have the right to require access to your personal data to the extent under Article 15 GDPR.

(c) You have the right to rectification of the provided personal data under Article 16 GDPR.

(d) You have the right to require erasure of your personal data under Article 17 GDPR.

(e) You have the right to require restriction of processing of your personal data under Article 18 GDPR.

(f) You have the right to portability of your personal data to another controller under Article 20 GDPR, i.e. you may ask us to transmit your personal data to another controller.

(g) You have the right to lodge a complaint against us as the controller of your personal data with a supervisory authority, i.e. the Office for Personal Data Protection (https://www.uoou.cz/en) (Article 77 GDPR).

(h) You have the right to inform us that you do not wish to be sent any further newsletters of our company and/or job offers if we provide you with placement services. You can serve your notice of disagreement within the meaning of the foregoing sentence by a written notice sent by post to the address of our registered office (see Section A above) or electronically to hr@topsearch.cz; in the notice of withdrawal, you shall specify your identification in the form of your name, surname, date of birth and address of your permanent residence. It is sufficient to state the following in the notice of withdrawal: “I do not wish TOPSEARCH, s.r.o. to send me its newsletter/job offers.”

If you decide to exercise any of the aforementioned rights, we have the obligation to identify you, i.e. to check whether the exercise of the rights is requested by a person to whom the personal data processed by our company are relating.

J. Do you process my sensitive personal data?

We process sensitive personal data only if you have provided us with such data and/or if you have published such data or, where appropriate, if the processing of such data is necessary to protect your vital interests or vital interests of another natural person. We have specified the sensitive personal data which we usually process in Section C above.

In other cases, we process the sensitive personal data only if you have given your consent to the processing thereof.

K. Is the disclosure of your personal data a prerequisite for conclusion of a contract with topsearch?

We cannot provide the agreed services without provision of your signature of the contract, necessary contact details and information required for making a payment. Those data are necessary for conclusion of the contract with our company (identification of the parties, identification of the persons to whom the services are to be provided) and the contract cannot be concluded if the data are not provided.

If we provide placement services to you or for you, we cannot provide the service unless we have information at our disposal about your name, surname, contact details, education, experience, skills, job history and health (in the form of your general capacity to work according to your statement). Provision of the aforementioned data is necessary to fulfill the purpose of the recruitment contract concluded with you and/or to provide the placement service.

We assure you that we provide the obtained data to parties interested in giving you a job only to the minimum extent necessary.

L. What does processing of personal data mean?

Processing of personal data means any operation or set of operations which is performed on personal data on sets of personal data, whether or not mechanically or by automated means. Processing includes collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other making available, alignment or combination, restriction, erasure or destruction of personal data.

For the avoidance of doubt, personal data means any information relating to an identifiable natural person who can be identified by reference to an identifier such as a name, an identification number, an online identifier or to one or more factors specific to the physical, physiological, psychological, economic, cultural or social identity. Information concerning a legal person is not considered personal data.

M. Other information

This document, in version 2 of 25 May 2019, comes into force and effect on 25 May 2019.

If we change the purpose of processing of your personal data, we will inform you in advance.

We will inform you if we receive your personal data from a third party.

We are ready to answer your questions if there is anything in this document you don’t understand. You can contact our representative for processing of personal data. Our contact details are provided in Section A above.

We will inform you about any change of this document.

This document is available in paper or electronic form at the registered office of our company and in electronic form on our website www.topsearch.cz.