Information about the processing of personal data
declaration of the company LabMediaServis s.r.o.
- Document issuer and personal data controller: LabMediaServis s.r.o., Company ID No. 275 12 380, with its registered office at Národní 84, Pražské Předměstí, 551 01 Jaroměř, represented by its Managing Directors Ing. Jan Krejčí and MVDr. Tomáš Krejčí
- Date of issue: 25 May 2018
- Last updated: 12 September 2022
- Availability: This document has been published on the LMS website www.labmediaservis.cz and may also be provided by LMS upon request.
- Purpose of the document: This document provides clients, business partners and customers (data subjects) of LabMediaServis s.r.o., Company ID No. 275 12 380, with its registered office at Národní 84, Pražské Předměstí, 551 01 Jaroměř (hereinafter “LMS”), with information pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “Regulation” or “GDPR”), providing an overview of the processing of their personal data by LMS.
In particular, this includes information concerning the categories of personal data, the purposes and legal bases of their processing, the retention period, sources of personal data, the main principles of processing and information on the rights of data subjects in connection with the processing of personal data by LMS.
In this INFORMATION ON THE PROCESSING OF PERSONAL DATA you will find answers to the following questions in particular:
- Does this statement apply to you if you are a legal entity?
- What personal data do we process about you or your representatives, for how long and why?
- Main principles of personal data processing
- Where do we obtain your personal data from and to whom do we disclose it?
- What rights do you have in connection with the processing of personal data?
1. Does this statement apply to you if you are a legal entity?
In this context, LMS would first like to point out that, within the meaning of the applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter the “GDPR”), personal data always refers solely to data relating to natural persons, including self-employed individuals and persons practising so-called liberal professions.
Therefore, if you are a commercial company or another legal entity, the protection of personal data under the GDPR does not apply to data relating to the legal entity itself, such as its name, Company ID or registered office address. It applies only to personal data of specific natural persons who act or communicate with us on behalf of your legal entity, typically your contractual or technical representatives (hereinafter “your representatives”), whose contact details we hold, such as name, surname, email address or telephone number.
If you are a legal entity, you undertake to inform your representatives of this INFORMATION ON THE PROCESSING OF PERSONAL DATA – LMS Statement. If you are a natural person, irrespective of whether you deal with LMS as a businessperson or consumer, the protection of personal data under the GDPR applies to you.
2. What personal data do we process about you or your representatives, for how long and why?
We would also like to assure you that we retain your personal data only lawfully and always in accordance with the GDPR, solely on the legal grounds set out in Article 6(1) GDPR. LMS processes the personal data listed below concerning you or your representatives only for the purposes, for the periods and on the respective legal bases specified for each category in the overview table below. The table is structured to show (i) the personal data concerned, (ii) the purpose for which LMS processes the personal data, (iii) the legal basis for processing the personal data (reference to the GDPR) and (iv) the period for which LMS retains the relevant personal data.
OVERVIEW TABLE OF PERSONAL DATA PROCESSING BY LMS
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (in particular name, surname, title, address/registered office, Company ID, VAT ID, telephone number, email address, handwritten signature, bank account) | Business or other cooperation with LMS based on a contractual relationship | Performance of a contract (e.g. purchase agreement, supply agreement, cooperation agreement, etc.) (pursuant to Article 6(1)(b) GDPR) | For the duration of the contractual relationship |
| Identification and contact data (in particular name, surname, title, address/registered office, Company ID and VAT ID); identification and contact data (in particular name, surname, title, address/registered office, Company ID, VAT ID, telephone number, email address, handwritten signature, bank account) | Compliance with statutory obligations arising in particular from Act No. 563/1991 Coll., on Accounting, and Act No. 235/2004 Coll., on Value Added Tax, as amended. Securing documentary and other evidence for the protection of LMS's legal claims in potential out-of-court, judicial, administrative, enforcement or criminal proceedings. | Compliance with legal obligations (pursuant to Article 6(1)(c) GDPR). Legitimate interest (preventing damage to the property and reputation of LMS) (pursuant to Article 6(1)(f) GDPR) | 10 years after the end of the relevant accounting period to which accounting and tax documents containing personal data relate, pursuant to Act No. 235/2004 Coll., on Value Added Tax, as amended.¹ For the duration of the 10-year objective limitation period pursuant to Sections 629, 636 and 638 of Act No. 89/2012 Coll., the Civil Code, as amended, extended by a further 1 year to account for a possible delay between the commencement of court proceedings and service of the claim. |
| Contact details (in particular email address and telephone number) | Sending information in connection with LMS's business activities or any other necessary communication regarding matters related to LMS's business activities | Necessary communications related to LMS's business activities (pursuant to Article 6(1)(a) GDPR) | For the duration of the business relationship between LMS and the data subject |
3. Main principles of personal data processing
When processing personal data, we always comply with generally binding legal regulations and, in particular, the GDPR. We would also like to assure you that we observe the binding principles applicable to personal data processing, in particular the principles of:
- a) lawfulness, fairness and transparency - this principle means that LMS, as controller, must process personal data on the basis of at least one legal ground and in a transparent manner towards the data subject. The legal basis for processing your personal data is set out in the overview table in Article 2 of this document;
- b) purpose limitation - LMS collects personal data only for specified, explicit and legitimate purposes and does not process personal data in a manner incompatible with those purposes. The purposes of processing your personal data are set out in the overview table in Article 2 of this document;
- c) data minimisation - LMS always ensures that the personal data it processes is adequate and relevant in relation to the purposes for which it is processed;
- d) accuracy - LMS ensures that the personal data it processes is specific and accurate;
- e) storage limitation - we ensure that personal data is kept in a form permitting identification of data subjects only for as long as necessary for the purposes for which it is processed. The retention periods for your personal data are set out in the overview table in Article 2 of this document;
- f) integrity and confidentiality - LMS always ensures appropriate technical and organisational security of the personal data it processes. In particular, we ensure that your personal data is properly secured and protected against unauthorised or unlawful processing.
4. Where do we obtain your personal data from and to whom do we disclose it?
LMS obtains personal data primarily directly from you, i.e. from our clients, customers or business partners, particularly in connection with contractual relationships or negotiations and communications concerning such relationships. We therefore obtain personal data in particular when a contractual relationship is established and subsequently in connection with the administration of individual performance under such contracts (e.g. individual orders, provision of specific goods or services or other performance arising from the relevant contracts).
If you are our client as a legal entity, we obtain personal data concerning your representatives primarily directly from you (e.g. name, surname, email address and telephone number of your representatives in contractual matters), or in connection with the administration of individual performance under the relevant contracts. We also obtain some personal data about you from publicly available sources, for example by verifying your identification data in public registers (such as the public register, trade licensing register or register of economic entities) or by checking published bank accounts and the status of a reliable/unreliable VAT payer in the VAT register.
We do not disclose your personal data to any third parties except in the following cases:
- a) where required by law. In such cases, we disclose your personal data to public authorities, courts and law enforcement authorities if they request it in accordance with the applicable legislation;
- b) where we need to deliver a document or consignment to you. In such cases, we provide your contact details, to the extent necessary for delivery, to a delivery or postal service provider;
- c) where we need to protect our own legal claims. In such cases, we disclose your personal data to contracted legal service providers (lawyers) and, where applicable, to public authorities before which we assert our legal claims, in particular courts and enforcement offices;
- d) where our databases containing personal data are made accessible to external IT specialists or external accountants, for example for necessary servicing or accounting administration. In such cases, your personal data is made available to these parties solely for the purpose of providing their services and only within the relevant information databases. All external parties are contractually bound not to process the disclosed personal data in any way beyond the agreed purpose.
5. What rights do you have in connection with the processing of personal data?
The rights set out below belong to so-called data subjects², i.e. our customers, business partners and clients who are natural persons and, if you are a legal entity, your representatives (all such persons hereinafter jointly referred to as the “data subject”). If you are a data subject, you have the following rights:
- a) Right of access - you have the right to know what data we process about you, for what purposes and for how long, where we obtain the data from, to whom we disclose it and what rights you have. LMS provides information relevant to the right of access in this document entitled “Statement on the Processing of Personal Data”. This right may be exercised pursuant to Article 15 GDPR.
- b) Right to rectification - you have the right to have your personal data corrected or completed if it is inaccurate or incomplete. This right may be exercised pursuant to Article 16 GDPR.
- c) Right to erasure (also known as the “right to be forgotten”) - you have the right to have your personal data erased without undue delay if one of the grounds set out in Article 17(1) GDPR applies (e.g. the data is no longer necessary for the purposes for which it was collected) and none of the grounds under Article 17(3) GDPR justifying continued processing by LMS applies.
- d) Right to restriction of processing - in certain cases, you have the right to request that specific personal data be marked and not subjected to further processing operations. Unlike the right to erasure, this is a temporary restriction of processing rather than permanent deletion. The cases in which this right may be exercised are set out in Article 18 GDPR.
- e) Right to data portability - you have the right to request that personal data you have provided to us on the basis of consent (Article 6(1)(a) GDPR) or performance of a contract (Article 6(1)(b) GDPR) be provided to you or directly to another controller designated by you in a structured, commonly used and machine-readable format. This right applies only to personal data processed by automated means. It therefore does not allow all data to be transferred in every circumstance (e.g. a handwritten signature).
- f) Right to object - you have the right to object to the processing of your personal data where the legal basis is our legitimate interest (see above). More information about data subject rights is available on the website of the supervisory authority, the Czech Office for Personal Data Protection (https://www.uoou.cz/6-prava-subjektu-udaj/d-27276). If you object to processing, we will review your objection and, if we determine that there are no compelling legitimate grounds justifying such processing, we will no longer process the relevant personal data for that purpose.
- g) Right to lodge a complaint - exercising any of the above rights does not affect your right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz).
You may exercise any of the above rights free of charge electronically by emailing krejcovska@labmediaservis.cz or in writing by post to our registered office address. Please always specify (i) the right you are exercising (e.g. the right to rectification), (ii) the grounds on which you base your request (e.g. that we have recorded an incorrect Company ID for you), and (iii) what you request (e.g. correction and recording of the correct Company ID).
Jaroměř, 12 September 2022, Ing. Jan Krejčí – Managing Director of LMS
1 Pursuant to Section 29(1) of Act No. 235/2004 Coll., on Value Added Tax, as amended, a tax document must contain, among other things: (a) identification of the person making the supply, (b) the tax identification number of the person making the supply, (c) identification of the person for whom the supply is made, and (d) the tax identification number of the person for whom the supply is made. Pursuant to Section 29(4) of Act No. 235/2004 Coll., on Value Added Tax, as amended, identification means (i) business name or name, (ii) any supplement to the name, and (iii) registered office.
2 Pursuant to Article 4(1) GDPR, a data subject means an identified or identifiable natural person.
