Principles of Personal Data Processing Mediform, spol. s r.o.

Protection of personal data is priority for us. We handle personal data solely in accordance with valid and effective legislation, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “Regulation”).

These principles represent generally valid document relating to protection and processing of personal data of natural persons (hereinafter referred to as the “Data Subjects”), and we provide hereinbelow the Data Subject with information on personal data processing regardless of the fact, whether the personal data are obtained from the Data Subject (Article 13 paragraph 1 of the Regulation) or the personal data were not obtained from the Data Subject (Article 14 paragraph 3 of the Regulation).

I. Identity and contact details of the controller

Mediform, spol. s r.o.
company identification No.: 49976770
tax identification No.: CZ49976770
with the registered office at Brno, Jundrov, Olšová 660/1, post code 637 00
incorporated in the Companies Register kept by the Regional Court in Brno, Section C, Insert 14086

The controller did not appoint a data protection officer.

II. Purposes of processing of your personal data by Mediform, spol. s r.o. and legal basis for processing

Legal basis for processing of your personal data is fulfilment of our rights and duties, whether we are in the position of employer, consumer, customer, supplier or contractor. We process the personal data within the necessary scope and for the period, which is necessary for the processing purposes. We divide processing of personal data into two categories – without your consent and with your consent. Processing of personal data, to which we do not need your consent, is the following:

• fulfillment of our duties arising from concluded contracts;
• fulfillment of our duties imposed on us by special legal regulations;
• protection of vital interests of the Data Subject or other natural person;
• fulfillment of task carried out in public interest
• our legitimate interest or legitimate interest of the third party (our legitimate interests include facilitating of communication with the Data Subject concerning identification and contact personal data and also claiming our rights and lodging our claims in court proceedings, against health insurance funds and commercial insurance companies and against the State Institute for Drug Control)

If processing of your personal data in any of the above-mentioned manner is not feasible, we will need your consent for their processing for one or more particular purposes.

III. Period, for which your personal data are stored at Mediform, spol. s r.o.

We keep your personal data only for a necessary period of time and we archive them under statutory time periods imposed by legal regulations.

We process the personal data for the period of duration of contractual relation or other legal title, which enable us to process your personal data. It means that we have set strict internal regulations verifying both lawfulness and period of retention of personal data. After the legal reason ceases to exist we carry out erasure of respective personal data.

Personal data processed with your consent are stored only for the period of duration of the purpose, for which the consent was granted.

IV. Your rights in connection with personal data protection

We process your personal data transparently and in accordance with applicable legal regulations. Still you have the right to contact us anytime to obtain information on the process of processing of your personal data or for the purpose of asserting of below-mentioned rights relating to personal data.

Right to access to personal data
You shall have the right to require copy of your personal data processed by Mediform, spol. s r.o..

Right to rectification of personal data
If you assume that the personal data we keep concerning you are inaccurate or incomplete, you shall have the right to ask us for their updating or completion.

Right to erasure of personal data (right to be forgotten)
You shall have the right to require erasure of your personal data, if they are not necessary for the purpose, for which they were processed, if you withdrew consent to their processing, they were processed unlawfully or they must be erased so that the legal duty was fulfilled.

Right to restriction of personal data processing
You shall have the right to require restriction of processing, if you contest accuracy of your personal data or their processing is unlawful, but you refuse erasure of such personal data, or if you request, we may process your selected data also after they are not necessary for the purpose, for which you provided them to Mediform, spol. s r.o. (e.g. in connection with lodging of claim at court, to which you need the personal data processed by us), or you raised an objection to processing and it is not obvious whether our legitimate interest overrides your legitimate interest.

Right to object to personal data processing
You may object at any time to processing of personal data, including profiling, that we process for the reason of legitimate interest. You can also object to processing in the situation that we process your personal data for direct marketing purposes. In such case we will no longer process your personal date for such purpose.

Right to data portability
In the case of automated processing of personal data based on concluded contract or consent that you granted to us, you shall have the right to the so-called portability of such data that will be provided to you in a structured, commonly used and in machine-readable format.

Right to withdraw consent to personal data processing
In the case that you provided us with consent to processing of personal data for the purposes requiring the consent, you shall be entitled to withdraw such consent anytime. Processing of personal data before withdrawal of the consent is lawful. We will respond to your requests relating to exercise of your rights without undue delay after receipt of such request.

Right to file a complaint to supervisory authority
You shall have the right to file a complaint at supervisory authority (Office for Personal Data Protection), if you assume that rules for personal data protection were breached during processing of your personal data. Contact details of the supervisory authority are the following:

Office for Personal Data Protection
Praha 7, Pplk. Sochora 27, post code 170 00
telephone No.: +420 234 665 111
data box ID: qkbaa2n
WWW: https://www.uoou.cz
E-mail: posta@uoou.cz

V. Categories of affected personal data

We divide categories of affected personal data according to what legal relation exists between you and Mediform, spol. s r.o.. To make it clearer we prepared for you a simple table with detailed description of affected personal data.

Category of Data Subjects	Purpose of processing of personal data	Legal basis and personal data being processed	Period of processing	Transfer of personal data to the third parties
Customers	Performance and implementation of contracts entered into with customers	Legal basis is performance of contract. Identification data (name, surname, e-mail, invoice details).	For this purpose personal data may be processed for the period of duration of contractual relation and warranty period.	Personal data may be transferred to carriers for the purposes of delivery of goods and possibly to our legal representatives.
Customers	Asserting of claims from contractual relations after termination of contract	Legal basis is our legitimate interest resting in the right to recover receivables, compensation for damage and other claims that may arise during duration of our contractual relation. Identification data (name, surname, e-mail, invoice details).	For this purpose personal data may be processed for three years from termination of contractual relation, in the case of court proceedings for the whole period of the proceedings.	Personal data may be transferred to the third parties, namely to our legal representatives, for the purpose of exercising of our rights.
Customers	Fulfillment of our duties in accounting and taxes	Legal basis is fulfillment of legal duty, imposed on us by legal regulations such as the Act on Accounting and Act on Value Added Tax. Identification data (name, surname), contact details (address for service or address of permanent residence, e-mail, telephone), accounting details (bank account No. and other information on tax documents).	For this purpose personal data may be processed for up to 10 years from the end of tax period, in which performance provided to a customer was carried out.	Personal data may be transferred to the third parties, namely to tax advisers and external accountants, for the purpose of professional consultation.
Customers	Dissemination of commercial communications in the form of professional information and messages, marketing materials, offers of our goods or services	Legal basis is our legitimate interest to provide and offer you similar goods that correspond to your needs, on the basis of our mutual business relation. Identification data (name, surname), contact details (address for service or address of permanent residence, e-mail, telephone).	For this purpose personal data may be processed for the period of duration of contractual relation.	Personal data are not transferred to the third parties.
Suppliers	Performance and implementation of contracts entered into with suppliers.	Legal basis performance of contract. Identification data (name, surname, e-mail, invoice details).	For this purpose personal data may be processed for the period of duration of contractual relation and warranty period.	Personal data are not transferred to the third parties.
Suppliers	Asserting of claims from contractual relations after termination of contract	Legal basis is our legitimate interest resting in the right to recover receivables, compensation for damage and other claims that may arise during duration of our contractual relation. Identification data (name, surname, e-mail, invoice details).	For this purpose personal data may be processed for three years from termination of contractual relation, in the case of court proceedings for the whole period of the proceedings.	Personal data may be transferred to the third parties, namely to our legal representatives, for the purpose of exercising of our rights.
Suppliers	Fulfillment of our duties in accounting and taxes	Legal basis is fulfillment of legal duty, imposed on us by legal regulations such as the Act on Accounting and Act on Value Added Tax. Identification data (name, surname), contact details (address for service or address of permanent residence, e-mail, telephone), accounting details (bank account No. and other information on tax documents).	For this purpose personal data may be processed for up to 10 years from the end of tax period, in which performance provided by a supplier was carried out.	Personal data may be transferred to the third parties, namely to tax advisers and external accountants, for the purpose of professional consultation.
Persons registered in e-shop and other persons	Regular sending of commercial communications by e-mail	Legal basis is consent, that you gave us when registering to our e-shop or by filling in our contact form on our websites. Identification data (name, surname), contact details (e-mail, telephone No., address).	For this purpose personal data may be processed until the consent is withdrawn.	Personal data are not transferred to the third parties.

VI. Other information

Mediform, spol. s r.o. does not intend to transfer the personal data to the third country or to an international organization. Automated decision-making, including profiling, in relation to personal data shall not be carried out.