Privacy Policy

Principles of data processing

In the context of our business relationship, your personal data will be processed by the controller and stored for a period necessary for the performance of the defined purposes and statutory obligations. The following text discusses the categories of the data concerned, methods of data processing and the rights you have in this connection with respect to the General Data Protection Regulation (GDPR).
Who is responsible for data processing?In terms of the right to data protection, the controller - responsible person is:  
Larson-Juhl s.r.o, Tovární 117, 381 01 Český Krumlov

What categories of data do we process? And what are the purposes of processing?
We process only those personal data that are necessary for us to perform the defined purposes and statutory obligations. This may involve the following categories of data:  

• Contact data, such as the degree title, first name, surname, address, email address, telephone numbers  
• Other information, such as access data, IP address or payment data  

Any data provided to us by you will be processed only for the purposes for which they have been received or collected, for instance:

• to perform and execute a contract
• to correspond with you
• to perform statutory and legal obligations 
• to protect legitimate interests
• to settle any matters existing between us

Data processing for other purposes is possible only subject to legal requirements set forth to the given extent in Art. 6(4) of GDPR. Should this be the case, it is a matter of course that any information obligations under Art. 13(3) of GDPR and Art. 14(4) of GDPR will be upheld by us.
What is the legal basis of data processing?In general, Art. 6 of GDPR is the legal basis of data processing, unless separate legal regulations are applicable. The following options might apply:

• Consent (Art. 6(1)(a) of GDPR)
• Data processing for the performance of contracts (Art. 6(1)(b) of GDPR). In particular, data processing is necessary for ensuring that data are complete and accurate and digitalized for the performance of a contract.
• Data processing on the basis of the consideration of legitimate interests (Art. 6(1)(f) of GDPR). In particular, data processing is necessary in order to ensure and optimize the informed decision-making of the parties in your interest and to ensure continuously high quality and uniformity of the customer support provided by the data controller.  
• Data processing in order to comply with statutory obligations (Art. 6(1)(c) of GDPR). Data processing is required especially with respect to ensuring completeness and correctness of tax-related data as per the Tax Administration Act, Licensing Act and the Commercial Code.  

If your personal data are processed based on your consent, you have a right to withdraw your consent at any time, with effects for the future. Where your personal data are processed on the basis of the consideration of legitimate interests, you, being the person concerned, have a right to object to the personal data processing, taking into consideration the requirements set forth in Art. 21 of GDPR.
How long will your data be stored?
We process data for a period necessary with respect to the given purpose. If there exist any statutory requirements for data storing - e.g. under the business law or tax law - the respective personal data will be stored for the duration of any data storage obligation (10 years). After the data storage obligation ceases, we will check whether further data processing is necessary. Provided that there is no such need, the data will be deleted. Exceptionally, the total period of personal data storage may last as many as 30 years if necessary for the establishment, exercise or defence of legal claims.
You may at any time require that we provide you with information as to your personal data retained by us (see below) and in case we have no need to store such data, you may require that your data be deleted or the processing thereof be restricted.
Who will receive your personal data?
Basically, your personal data will be transferred to third persons only where it is necessary for the performance of a contract concluded with you; the transfer on the basis of legitimate interests within the intention of Art. 6(1)(f) of GDPR is admissible, where we are compelled by the law to transfer such data, or where you have given your consent to such transfer.
Transfer of personal data to third countries  It is not expected that your personal data will be transferred to a third country or an international organization unless necessary for the performance of a contract concluded with you. Details will be communicated to you separately if so required by the law.
Where will your data be processed?
Your personal data will be processed exclusively in data centres in the Federal Republic of Germany, Netherlands and Czech Republic.
As a “data subject”, you have the following rights: 

• In accordance with Art. 15 of GDPR, you have a right to obtain information about the personal data that we process about you. In particular, you may require information about the purposes of processing, category of personal data, categories of recipients who have been or will be provided your data, about the expected period of storage, existence of the right to rectify, delete, restrict processing or object, existence of the right to lodge a complaint, information about the source of your data in case your data have not been collected by the data controller, and existence of automated decision-making, including profiling, and, as the case may, the explanatory capacity of information as to any details;  
• In accordance with Art. 16 of GDPR, you have a right to require without undue delay the rectification of inaccurate or incomplete personal data about you which are stored by the responsible person;
• In accordance with Art. 17 of GDPR, you have a right to require the erasure of your personal data, stored by the data controller, with the exception when the processing is required for exercising the right of freedom of expression and information, for compliance with a legal obligation in the public interest, or for the establishment, exercise or defence of legal claims; 
• In accordance with Art. 18 of GDPR, you have a right to require the restriction of processing of your personal data where the accuracy of data is contested by you, the processing is unlawful, but you oppose the erasure of your personal data, the responsible person no longer needs the data but thee data are required by you for the establishment, exercise or defence of legal claims, or you have objected to the processing as per Art. 21 of GDPR;
• In accordance with Art. 20 of GDPR, you have a right to receive your personal data, provided to the data controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller;
• In accordance with Art. 7(3) of GDPR, you have the right to withdraw your consent vis-à-visthe data controller at any time. As a consequence, the data controller will not be able to continue processing your personal data, based on your consent only; 
• In accordance with Art. 77 of GDPR, you have a right to lodge a complaint with a supervisory authority. In general, you may contact a supervisory authority in the place of your common residence or workplace or the registered office of our company.  

In case of any request for information not executed in writing, we ask for your understanding since we might have to ask you to prove that you are the person who you claim to be.  
Lodging objections:In particular, you have a right to object to the processing of your data in connection with direct marketing if such processing is done on the basis of the consideration of legitimate interests under Art. 21(1) and (2) of GDPR.
Our company has appointed a person responsible for personal data protection. To contact this officer, you may use any of the following contact data:
Martina Josková, Dis., Tovární 117, 382 01 Český Krumlov, tel.: +420 380 773 708 E-Mail: mjoskova@larsonjuhl.com

Right to lodge a complaint
You have a right to lodge a complaint with a supervisory authority with regard to the processing of personal data by us.
In the Czech Republic, the supervisory authority is: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Email: posta@uoou.cz, web: https://www.uoou.cz