1. INTRODUCTORY PROVISIONS

1.1 This document provides information on the processing of personal data collected through the website at www.alpicenter.cz.

1.2. ALPI CENTER CAMP AND SPORTS TOURISM D.O.O., KANINSKA VAS 7, 5230 BOVEC, tax number: SI-88935302

(”the company”)

operates the website and is the controller of the personal data collected through this website. The controller can be contacted at: info@alpicenter.cz.

1.3 The Controller is not obliged to verify the accuracy of the personal data or the identity of the data subject when collecting personal data, but has the right, at its own discretion, to ask the data subject to prove his or her identity in order to establish the accuracy of the data.

2. PURPOSES AND LEGAL BASIS OF DATA PROCESSING

2.1. Processing of personal data for the purpose of concluding and performing a contract

We may collect personal data for the purpose of concluding and performing a contract, such as for the execution of your order, delivery of ordered services, preparation of a quotation requested by you, and the like. For these purposes we will collect the following personal data: name, surname, e-mail address, phone number, age, height, weight. Where we have requested information from you and stated that the provision of information is mandatory, we have done so because we cannot comply with your request without your information or because we are required to do so by law. In these cases, the provision of the data is a legal or contractual obligation, or an obligation necessary for the conclusion of a contract.

The legal basis for the processing of personal data is Article 6, first paragraph, point b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”; hereinafter: “GDPR”). Personal data may also be processed on the basis of Article 6, first paragraph, point c) of the GDPR, insofar as the processing is necessary to comply with a legal obligation to which the controller is subject, such as the obligation to keep records.

2.2. Sending newsletters

In case you subscribe to our newsletter, we will request the following data from you: first name, last name, e-mail address. The processing of personal data is based on your consent, i.e. point a) of the first paragraph of Article 6 of the GDPR.

2.3 Legal basis

Following an assessment that our legitimate interests outweigh the rights of individuals, we may process personal data on this basis, i.e. point (f) of Article 6(1) of the GDPR. On this basis, processing will take place for the following purposes:

1. to ensure network and information security (for example, to prevent unauthorized access to electronic communications networks, the dissemination of malicious code, denial-of-service attacks, and damage to computer and electronic communications systems)
2. customer knowledge for advertising and market research purposes
3. for the purpose of monitoring the general safety and improvement of the products and services of the controller or related parties with a view to protecting public health and the environment
4. to establish legal claims or defend against them
5. ensuring the security of the premises and property of the controller

2.4. Processing of data for the purpose of communicating sales offers and news (marketing)

For the purpose of informing about sales offers and novelties (direct marketing purpose), personal data is collected on the basis of the customer’s personal consent, i.e. point a) of Article 6(1) of the GDPR, except in the cases and to the extent that the law permits processing on the basis of the legitimate interest of the controller (point f) of Article 6(1) of the GDPR). For this purpose, we will process the following data: name, surname, e-mail address.

2.5 Conducting a satisfaction survey

For the purpose of contacting due to conducting a satisfaction survey and service quality personal data will be collected based on personal consent (point a) of Article 6(1) of the GDPR. The data provided by the customer regarding their purchase or service experience will be collected and processed by the Controller for the purpose of verifying the customer’s satisfaction with the purchase or service, thereby monitoring the quality of its products and supervising the work of its employees. The individual is not obliged to provide his/her personal data or to answer questions about his/her user experience.

3. PERSONAL DATA OF THIRD PARTIES

3.1 If you share personal data of third parties (e.g. your employees, contractors, friends or family members) with us on the Website, please note that you may only share this data with us if you have obtained the consent of the data subject or have another legal basis to share their personal data with us. By sharing personal data of third parties on the website, you warrant that you have a valid legal basis to share the personal data with us. You also warrant that you have made that third party aware of the information in this Privacy Policy.

4. USERS

4.1 The Controller does not share your personal data with third parties, except where it is necessary for the delivery of your order or where there is another valid legal basis for the forwarding. In this case, your personal data will be passed on to the following users for the following purposes:

1. External contractors who process the data solely on behalf of, for the account of, under the instructions and under the control of the controller, for example, for the aid of execution of the ordered services, organisation and execution of marketing campaigns or customer satisfaction surveys (e.g. call centers, printers, advertising agencies); for the maintenance of the security of information systems, premises, and assets; as website hosting providers; for the purpose of processing legal claims; and for the purpose of sending e-newsletters and other notifications.
2. Any company belonging to the same group of companies as the operator for the purpose of internal management.
3. Potential parties or partners in the process of transferring or selling a business or participating in a joint venture.

5. DURATION OF PROCESSING

 

5.1 The duration of the retention of your personal data may depend on the purpose of the processing, i.e. until the purpose is fulfilled.

5.1.1. Where the data is processed for the purpose of performing a contract concluded with you or as a result of an order, request or enquiry from you, the data will be kept for as long as is necessary for the performance of the contract, the supply of goods or the provision of services. Contact data for the purpose of direct marketing may be retained for longer, that is to the extent permitted by law.

5.1.2. Data collected for the purpose of sending newsletters will be retained until you withdraw your consent.

5.2 Personal data may also be retained after the purpose for which they are processed has been fulfilled, until the expiry of the applicable limitation period, if further retention is necessary to deal with legal claims, or longer if a longer retention period is necessary to comply with a legal obligation or a decision of a competent authority. After the expiry of that period, the personal data will be anonymized or deleted.

6. RIGHTS OF INDIVIDUALS

6.1. Any subject shall have the right to obtain from the controller access to their personal data, rectification or deletion of personal data, restriction of processing, and the right to portable personal data, provided that the legal conditions are met. For the purposes for which personal data are processed on the basis of consent, the data subject shall have the right to withdraw his or her consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal, nor processing based on other legal bases. For the purposes for which personal data are processed on the basis of the legitimate interests of the controller, the data subject shall have the possibility to object to such processing.

6.2 The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him/her are being processed and, when this is the case, access (inspection, copying and reproduction) to the personal data, and the following information:

1. the purposes of the processing,
2. the types of personal data concerned,
3. the users or categories of users to whom the personal data have been or will be disclosed,
4. where possible, the intended period of retention of the personal data or the criteria to be used to determine that period,
5. an indication of the right to request the controller to rectify or erase personal data or to restrict the processing of personal data concerning the data subject and to object to such processing,
6. an indication of the right to complaint with the Information Commissioner.

6.3 The controller shall provide a copy of the personal data being processed. For additional copies requested by the data subject, the controller may charge a reasonable fee, taking into account administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic format.

6.4 The data subject shall have the right to request the rectification or completion of incomplete or inaccurate personal data, including the submission of a supplementary declaration.

6.5 The data subject may request the erasure of his or her personal data if: the data are no longer necessary for the purposes for which they were collected or processed; they have been unlawfully processed; he/she objects to processing or withdraws consent; or a law or regulation so provides. In the event of a request, the controller will take reasonable measures, including technical measures, taking into account available technology and the costs of implementation, to ensure that all processors to whom it has disclosed the data are aware of the erasure request and to require them to delete the links to the personal data or copies thereof. The above shall not apply if the processing will be necessary for the exercise of the right to freedom of expression and information, compliance with a legal obligation or the establishment and defense of legal claims.

6.6. The data subject shall have the right to obtain the restriction of processing if: he or she contests the accuracy of the data which can be verified; the processing is unlawful and the data subject does not seek erasure but requests the restriction of the processing; he/she needs the data for the establishment, exercise or defense of legal claims, despite the fact that the data are no longer necessary for the purposes of the processing; he/she has raised an objection to the processing, pending verification whether the legitimate grounds of the controller override those of the data subject.

6.7 The controller shall communicate to each user to whom personal data have been disclosed any rectification or deletion of personal data or restriction of processing unless this proves impossible or involves a disproportionate effort. If the data subject so requests, it shall inform him/her of those users.

6.8. Where processing is carried out by automated means, the data subject shall have the right to receive personal data concerning him/her from the controller in a structured, commonly used, and machine-readable format, and the right to have those data transmitted to another controller, without hindrance from the controller. The data subject shall have the right to have the personal data directly transferred to another controller where this is technically feasible.

6.9. The data subject shall have the right to object, permanently or temporarily, at any time to the processing of personal data concerning him/her where the processing is carried out on the basis of the legitimate interest of the controller.

7. HOW TO EXERCISE RIGHTS

7.1. All rights relating to the protection of personal data shall be exercised by the subject with the controller. The data subject shall have the right to request access to data relating to him/her and to exercise the right to restriction of processing, rectification, deletion, data portability, objection and withdrawal of consent, in any of the following ways:

1. in writing to the business address of the controller: ALPI CENTER KAMP IN ŠPORTNI TURIZEM D.O.O., KANINSKA VAS 7, 5230 BOVEC,
2. orally, on the record, at the business address of the controller,
3. by e-mail to the following address: info@alpicenter.cz.

7.2 The controller will process the request within the statutory time limit and inform the individual in writing by post or by e-mail of the measures taken. The change of data will be processed no later than within 15 days from the date of receipt of the request unless justified reasons require a longer procedure. The controller may refuse to take any action on the request if the request is manifestly unfounded or excessive.

7.3. Any data subject shall have the right to lodge a complaint with the Information Commissioner if he/she considers that processing of personal data concerning him/her is unlawful.

8. CHANGES

8.1 We reserve the right to make changes to this Policy. Any changes will be published on the website.

Date: 30.6.2024