INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA BY IMOBA, a.s.

IMOBA, a.s., with its registered office at Pyšelská 2327/2, 149 00, Prague 4, company ID 26124459, registered in the Commercial Register maintained by the Municipal Court in Prague under file number B 6203 (hereinafter “IMOBA” or “our company”) is the administrator of your personal data, which means that it determines the purpose and means of processing your personal data, processes your personal data and bears responsibility for this processing.

In this document you will find general information on how our personal data is processed and information on some of the most common types of processing of personal data that occur during the operation of IMOBA, a.s. and processed by the company in accordance with the rules on personal data protection, 2016/679 (hereinafter the “Regulation”).

Below you can find:

  • GENERAL INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA BY IMOBA, a.s.
  • ADVICE ON THE PROCESSING OF PERSONAL DATA FOR IMOBA’S CONTRACTUAL PARTNERS
  • ADVICE ON THE PROCESSING OF PERSONAL DATA FOR THE CONTACT PERSONS OF IMOBA’S CONTRACTUAL PARTNERS
  • ADVICE ON THE PROCESSING OF PERSONAL DATA FOR PERSONS SEEKING A JOB WITH IMOBA
  • ADVICE ON THE PROCESSING OF PERSONAL DATA OF VISITORS TO IMOBA’S WEB PAGES
  • RISKS AND RECOMMENDED PROCEDURES

Our company also carries out further processing of personal data, but advice about such processing is already given directly to the persons concerned.

I. GENERAL INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA BY IMOBA, a.s.

Principles relating to the processing of personal data

When processing personal data, we respect the rights of data subjects, and our company adheres in particular to the following principles:

  • personal data are processed in a correct, legal and transparent manner;
  • the collection of personal data is solely for legitimate purposes and the processing is carried out in a manner compatible with those purposes;
  • when processing personal data, we collect the minimum data necessary to meet the stated purposes;
  • we take all reasonable and affordable measures to secure your personal data during processing. We also take care to ensure the proper security of personal data, including their protection through appropriate technical and organisational measures against unauthorised or unlawful processing, accidental loss, destruction or damage;
  • we only process accurate and updated personal data; we correct or delete inaccurate or redundant data;
  • personal data are kept for as long as is necessary for the purposes for which the data are processed.

What personal data do we process?

For our purposes, we mainly process the following categories of personal data:

  • identification and address details: name, surname, title, date of birth, address (residence, delivery address or other contact address), business person and business name or addendum attached to the name, registered office and business ID number;
  • electronic contact details: telephone, mobile phone, fax, email address, data box ID;
  • other electronic data: IP address, location data, data passed from the customer’s Internet browser, etc.
  • other personal data needed to perform the contract: bank account number, invoiced amount, etc.
  • creditworthiness and credibility information: records of fulfilment of payment obligations, including information from public registers.

How do we get your personal data?

We obtain your personal data from you, from third parties, from publicly available sources or from our own activities. If we receive personal information from you, we will always inform you if the provision of your personal data is a legal or contractual requirement, and whether you are required to provide personal information and the possible consequences of not providing personal information.

from you, in particular:

  • from your requests and in the negotiation of a contract;
  • in telephone communication;
  • in personal or written communication with you, including communication by electronic means (by email).

from third parties, in particular:

  • from state authorities or from third parties in the course of our legal obligations or under specific legal regulations;
  • from cooperating third parties.

from publicly available sources, in particular:

  • from social networks and the Internet, if you publish the data yourself;
  • from the Commercial Register;
  • from the Insolvency Register.

from our own activity:

  • when evaluating the data you provide to us regarding the use of our products or services.

For what purposes do we process your personal data?

We process your personal data only to the extent necessary for the given purpose(s) and for the duration of time necessary to meet the intended purpose(s).

We process your personal data in particular:

  • for the purpose of concluding contracts, for the purposes of fulfilling the contract we have concluded with you and when processing your applications;
  • for the purpose of fulfilling our legal obligations;
  • for the purposes of our legitimate interests;
  • for marketing purposes.

How do we process your personal data and how are personal data secured?

When processing personal data, our company always makes sure your personal data is secure and cannot be misused.

The processing of your personal data can be either manual or automated. Automated processing takes place in the IMOBA information systems, or in the information systems of our processors.

Your personal data are primarily processed by the relevant IMOBA employees who need access to personal data for the fulfilment of their duties and who are committed to maintaining confidentiality about all the facts and data they have learned in the course of their work. In addition, employees of our processors have access to your personal data, but only to the extent necessary to perform their work for our company. We always enter into a written personal data processing agreement with all our processors, which contains guarantees for the security of your personal data.

What are your rights?

At any time during the processing of your personal data, you can exercise the following rights:

  • the right to access your personal data and to obtain a copy of the personal data we process about you;
  • the right to correct and complete your personal data if you find that we have processed incorrect or inaccurate personal data about you;
  • the right to delete your personal data if the statutory conditions are met;
  • the right to limit the processing of your personal data where, at your request, we may limit the handling of your personal data, subject to certain statutory conditions;
  • the right to transfer your personal data to another administrator if we process your personal data under your consent or for the purposes of performance of the contract and at the same time the processing is automated;
  • the right to object to the processing of personal data if the personal data are processed for the legitimate interests of our company. If you object, we will not process your personal data until we have demonstrated serious grounds for processing that outweigh your interests or rights and freedoms, or for the determination, exercise or defence of legal claims. In the case of personal data processing for offering our products and services, we will immediately terminate the processing of personal data when the objection is made.

If we receive a request to exercise one of the above rights, we will inform the applicant of the measures taken without undue delay and, in any case, within one month after the receipt of the request. This time limit can be extended by another two months if necessary and given the complexity and number of requests. In certain cases laid down in the Regulation, our company is not obliged to comply with the request in whole or in part. This will be the case in particular if the request is clearly unreasonable or disproportionate, in particular because it is repeated. In such cases, we may (i) impose a reasonable fee, taking into account the administrative costs associated with providing the requested information or communication or with making the requested actions, or (ii) refuse to comply with the request.

If we receive the above request, but we will have reasonable doubt as to the identity of the applicant, we may ask them to provide additional information necessary to confirm their identity.

We will store the information that a data subject has exercised their rights and how we have dealt with their request for a reasonable period of time (4 years), to document this fact for statistical purposes, to improve our services and to protect our rights.

If the data subject considers that IMOBA is processing their personal data unlawfully or otherwise violating their rights, the data subject has the right to file a complaint with the supervisory authority (The Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7) or to apply for judicial protection.

We would also like to inform you that we do not make any decisions based exclusively on automated processing, including profiling, which would have any legal effects for you.

II. ADVICE ON THE PROCESSING OF PERSONAL DATA FOR IMOBA’S CONTRACTUAL PARTNERS

Overview of the (types of) data processed and their sources

Personal information is considered to be all information about an identified or identifiable natural person (also referred to as the “data subject”); an identifiable natural person is a natural person that can be identified directly or indirectly, in particular by reference to a particular identifier such as name, identification number, location data, network identifier or one or more specific elements of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person. We will usually obtain the personal data we will process about you directly from you, or in the framework of contractual cooperation with you. In justified cases (especially when recovering amounts due) we can also search for additional information from open sources.

The personal data of the contractual partners – natural persons (hereinafter referred to as the “partner”) that IMOBA will process include, in particular, the data provided by such persons, typically name and surname, place of business, VAT number, account number, contact details (email and telephone number), date of birth, data specified in the contract, invoiced and paid (due) amounts, and details of on-going performance and communication with partners (or their employees). In connection with communication with a partner, IMOBA may also store some technical data, i.e. the time of communication with the partner and the IP address from which it is sent. For prospective business partners, our company can process data from open sources (such as their website or advertising) so that we can contact them by phone with the offer of services. Such basic data can be stored by our company in our CRM system for further contact.

Purposes of processing

This section provides an overview of the purposes for which we will process your personal data. Typically, each piece of data is used for multiple purposes at a time. The means of processing, processing time, etc. depend on the purposes. In certain cases provided for in Regulation (EU) No 2016/679 (hereinafter the “Regulation”), we may also process your data for purposes other than those listed below; however, these are exceptional and limited cases that the Regulation makes conditional on the fulfilment of other conditions.

The primary purpose of processing the personal data of a contractual partner/client will be the conclusion and performance of a contract. In this context, the data will be further used to record and properly perform the IMOBA contractual relationships, to control the activities of our employees, for statistical purposes, to further develop IMOBA services, either services covered by the contract or internal administrative procedures in IMOBA, for debt recovery and the protection of IMOBA’s rights and those of third parties (e.g. other contractors), in particular against unlawful activities. Data (particularly from partner/client communication, such as IP address and time of communication) will also be used for the purposes of IMOBA’s IT security. Furthermore, the personal data of the partner/client will be processed by IMOBA in order for IMOBA to fulfil its legal obligations, in particular according to the regulations governing the keeping of accounts and taxes, personal data protection regulations, regulations on advertising regulation, and also for the purposes of direct marketing in accordance with Article 47 of the Regulation (i.e., in particular, the sending of offers for products and services, e.g. by email or telephone).

Legal basis of processing

Every processing of personal data must be legal – it must be based on one of the Regulations listed in the legal basis of processing. Similarly to the purpose, each piece of data can be processed based on multiple legal grounds for processing. If all of the legal reasons cease to exist, we will no longer process your data. The possible legal grounds for processing are listed in Article 6 of the Regulation. Please note that if we process your personal data with your consent, you may at any time withdraw your consent (please contact us using the contact details below). The withdrawal of consent is without prejudice to the lawfulness of processing based on the consent given prior to its withdrawal. However, the data of the contractual partners are usually not processed on the basis of consent.

The legal basis for the processing of personal data of partners/clients is:

  • the necessity to perform the contract (including the recovery of receivables incurred);
  • the legitimate interests of IMOBA (due to the interest in recording contractual relationships and interest in the protection of their rights against illegal activities, including IT security, and further development of IMOBA’s products or services, processing for direct marketing) and third parties (in particular other contractual partners involved in the performance in which the partner will also be involved); and
  • the fulfilment of legal requirements (in particular the prevention of torts, fulfilment of the requirements under the legislation on the protection of personal data, in particular Act No 101/2000, and Regulation (EU) 2016/679), keeping of accounts and fulfilment of obligations under tax regulations.

Right to object

The right to object is one of your important rights. It allows you to review the processing done on the basis of our “legitimate interest” when it is justified by your particular situation – that is, when the processing itself is permissible, but there are specific reasons on your part why you do not want the processing to take place. However, the possibility of objection does not apply to all cases of processing, e.g. it is not possible to use it if we process your data necessary for the performance of the contract, or if the processing of such data is required by law. The right to object is laid down in Article 21 of the Regulation.

If the legal reason for the processing of personal data of the partner/client is the legitimate interest of IMOBA (in particular processing of data for IT security purposes, statistical purposes and further development of IMOBA’s supplier-customer relations and the protection of IMOBA’s and third parties’ rights), the partner/client has the right to object at any time to such processing of personal data for reasons relating to their particular situation. In such a case, IMOBA will not process such personal data unless there are serious legitimate grounds for the processing that outweigh the interests of the partner/client or their rights and freedoms or if they are not processed for the purposes of determining, enforcing or defending legal claims. The partner/client may object to the processing via the contact details listed below or ideally via email at imoba@imoba.cz. In your email, please state the specific situation that leads you to the conclusion that IMOBA should not process the data.

In the case of data processing for direct marketing purposes (sending marketing communications), it is always possible to raise an objection automatically, so in this case you do not have to give any reasons why you do not wish to continue to receive marketing communications. In these cases, you will ideally object by unsubscribing by means of the link that will usually be attached to the message for that purpose.

Please note that even in the above-mentioned cases, parallel processing of personal data will sometimes take place for other purposes that will justify IMOBA’s continuing to process such data.

Period for which data will be processed

Our company cannot process your data for just any length of time, but the processing time is limited to the period we really need your data. We try to limit the length of this period so that it takes due account of both your and our interests. Sometimes it is more difficult to determine the necessary period of processing or, for safety reasons, it is not appropriate to communicate the exact length of this time, so below are some of the criteria that we use to determine the duration of the processing of your data.

The contact details of the partners/clients for the purpose of sending commercial communications will be processed by IMOBA until the partner withdraws the consent therewith. However, IMOBA will then process basic data on why it sent the partner/client the commercial communication for a reasonable period of time to prove the legitimacy of such sending.

Personal data will be processed for a reasonable period of time with regard to the purpose of the processing. If the period of processing is set by law, personal data will be processed for that period, unless the below reasons justify a longer period of processing. In determining the adequacy of the period of processing of personal data, it will be based in particular on the following aspects: (i) the length of the limitation period, (ii) the likelihood of legal claims, (iii) usual market practice, (iv) the likelihood and significance of any risks, and (v) any recommendations by the supervisory authorities.

Updating of data

One of our duties as a personal data controller is to process accurate data, and possibly to add to incomplete data with regard to circumstances. If you provide us with information about a change in your data, you will help us to fulfil this obligation properly.

In the event of a change in the data provided or other data given by a partner/client, we would like to ask you to submit information about such a change.

In order to update the data, IMOBA can be contacted using the contact details below, preferably by email at imoba@imoba.cz.

Commercial communication

Information about our potential, current or past partners/clients can also be processed for direct marketing purposes, which typically involves sending emails or making telephone calls with offers of similar products or services to those you have purchased from us. The sending of offers does not have a limited duration, but if you express your wish to no longer receive such offers, we will not send them to you. However, we will continue to process basic data about sending them for a reasonable period of time so that we can demonstrate why we have sent you these offers. We will not forward your data to third parties (except for our subcontractors – processors who will process it for us) for the purpose of sending offers.

Within the meaning of Section 7 of Act No 480/2004, IMOBA may send commercial communications to a partner’s address (including email); a partner may be contacted by unsolicited direct mail containing commercial communications about IMOBA’s products, business and services. Partners may at any time refuse this at IMOBA’s headquarters or by emailing imoba@imoba.cz. Such a refusal does not (unless otherwise expressly stated by the partner) affect the sending of types of commercial communications other than the one the partner is responding to.

How the processing is carried out and its consequences

Nowadays most of the processing is done on a computer, so we will usually process your data in a computer system (for example, in our CRM system, in Outlook for emails, in the accounting system for billing data, etc.). This, of course, does not exclude the processing of documents in filing cabinets, such as a paper contract-keeping system or a business card filing cabinet kept by our individual employees.

IMOBA will process personal data particularly in its computer systems and the computer systems of its processors. IMOBA will process documents in its file cabinet. The provision of processed data by a partner is voluntary (but without the provision of certain data, the contract will not be concluded and, in some cases, some data are required by law, in particular by accounting regulations).

Personal identification number (rodné číslo)

We will process your personal identification number only if you voluntarily state it on the contract or it is required by a legal regulation (if it is not expressly required by a legal regulation, our company does not insist that you specify your personal identification number on contracts, so it is better if you do not do so).

If, on the basis of or in connection with a concluded contract, a partner – a natural person – provides IMOBA with their personal identification number, they agree as the holder of this personal identification number in accordance with Section 13c(1) of Act No 133/2000 that IMOBA can use the personal identification number for the purpose of recording the contracts, providing the performance and protection of the rights of IMOBA, and that IMOBA archives, processes and uses it for this purpose. Any withdrawal of consent under this Article shall not affect the right of IMOBA to process information and data under applicable legislation or for other purposes, unless expressly provided otherwise therein.

Provision of personal data to other persons (recipients of personal data)

Our company does not do all processing of personal data itself. For processing, we sometimes hire third parties, so-called personal data processors. We try to select only those processors that are sufficiently trustworthy.

IMOBA may only make personal data available to third parties in cases where it is required or allowed to do so by legislation or with the consent of the partner. IMOBA only makes available personal data to processors or other recipients – suppliers of external services (typically programmers or other support technical services, computer system vendors, server services vendors, email sending and archiving service providers) and providers of (backup) server or technology used by IMOBA, that process them in order to ensure the functionality of the relevant services. In addition, personal data may be made available to the extent necessary to legal, economic and tax advisers and auditors who process them for the purpose of providing advisory services, or to persons who are members of the Group along with IMOBA. Personal data concerning debtors may also be made available to companies providing debt insurance or other companies for the purpose of recovering debts. Upon request or in case of suspicion of unlawful activity, personal data may also be transmitted to the public authorities.

Providing personal data abroad

While the Regulation provides for the principle of free movement of persons in the EU, it limits the provision of personal data to foreign countries outside the EU. Our company does not generally provide personal data outside the EU. However, it may happen that your personal data will be processed in a computer system whose servers will be located outside the EU, even if we try to avoid such situations. Considering the systems typically used in business practice, these would most likely be server systems located in the United States of America. In that case, we would select the contracting partner from among companies that meet the conditions agreed by the European Commission for the safe transmission of data between the EU and the US (“Privacy Shield”). If we transmit your personal data outside the EU, we will inform you if necessary by the appropriate means.

III. ADVICE ON THE PROCESSING OF PERSONAL DATA FOR THE CONTACT PERSONS OF IMOBA’S CONTRACTUAL PARTNERS

As part of the processing of personal data of current or potential contractors, IMOBA also processes data about their contact persons (e.g. their governing bodies or employees who deal with IMOBA). In relation to these data, we usually process the name and surname of such persons, their email address, job position, telephone number and, where appropriate, minutes of meetings with them. These data are processed for the same purposes and to the same extent and with a similar duration as the data of contractual partners. Individual IMOBA employees can maintain their own contact lists, for example, through phone contact lists or business card catalogues. Phone numbers with which there has been communication from company devices are also stored for a reasonable period of time to properly account for telecommunication services, protect the rights of IMOBA and distinguish between private and business calls. However, apart from system administrators, access to such data is provided only to the employee whose device was used for the communication.

IV. ADVICE ON THE PROCESSING OF PERSONAL DATA FOR CLIENTS USING SERVICES OFFERED BY IMOBA

Personal data of the clients receiving services provided by IMOBA – natural persons (hereinafter referred to as “client”) that IMOBA will process, include in particular data provided by such persons typically:

  • name and surname, contact details (email address and phone number);
  • in the case of hotel guests, date of birth, nationality, document number (passport or ID card) date of stay, visa number, purpose of stay, bank card details (for pre-authorisation of payment card);
  • the data given in the contract, the invoiced and paid (due) amounts, the data on the current performance and communication.

These data are processed for the same purposes and to the same extent and with a similar duration as the data of contractual partners.

In connection with communication with a client, IMOBA may also store some technical data, i.e. the time of communication with the client and the IP address from which it is sent.

V. ADVICE ON THE PROCESSING OF PERSONAL DATA FOR PERSONS SEEKING A JOB WITH IMOBA

What data will we process about you?

We will process your personal data that you provide to us or the provision of which you approve, for example within data-sharing servers (typically the data contained in your CV, i.e., in addition to your name and surname and contact details, data such as your previous experience, your knowledge of languages, etc., as well as data obtained through correspondence with you), or data we obtain in the basic screening of your personal data from public sources, such as from LinkedIn (but this will also concern only essential data in the scope allowed by law to examine the applicant, in particular the data given in the CV). In connection with a personal meeting or a telephone conversation with you, we can also keep a record of the impression you made or how your conduct corresponds to the data in your CV.

If we contact you without your prior consent, we will do so only on the basis of the data you have published for that purpose.

In connection with your response to a job offer advertised on our website, we may also store some technical data, i.e. the time of your reply and the IP address from which it is sent.

If you give your consent to us to use your data, we will also keep track of how and when that consent was given and when it was withdrawn.

How do we collect the data (from what sources) and how do we process it?

We will primarily obtain the data directly from you.

For specialised positions, we can also contact people whose contact data we can obtain from public sources, such as LinkedIn, without being previously contacted by them. In such cases, you as a prospective candidate will then be contacted with the offer to participate in the appropriate selection procedure or to be included in our candidate database. If you agree, we will include you in the selection for the position or our database. If you do not agree, we will no longer process your data for this purpose (we may, however, save basic information about the fact that we contacted you and why for a reasonable period of time).

If you provide us with information about your references (contact information for your former colleagues, etc.) and you agree that we may contact them, we will, to a reasonable extent, also process the data obtained from them as well.

By submitting your personal data (for example, by replying to an advertisement or by completing a form on a website) or by agreeing to be included in a selection procedure, you allow our company to use your personal data to select a suitable candidate to fill a position within the current selection procedure, or in another concurrent selection procedure for a comparable position. If we want to use your personal data in filling other positions or for future selection procedures, we will ask you to consent to such use.

Please note that you can withdraw your consent to participate in a selection procedure at any time using the following contact details, free of charge. We recommend that you do so either by directly contacting the person from our personnel division who is dealing with you or by emailing imoba@imoba.cz.

If you withdraw your consent or you request to cancel your participation in the selection procedure, you will be excluded from the selection. The withdrawal of consent is without prejudice to the lawfulness of processing based on the consent given prior to its withdrawal.

In addition, we may obtain your contact from your CV you made available through a CV-sharing service you have registered with (such as jobdnes.cz or jobs.cz). In such services, CVs are shared with your consent.

What (what purpose) will we use your data for?

Your personal data will be used primarily for the selection of a suitable candidate to fill a position within on-going selection procedures (including external collaboration). If you are selected to fill the position and a contract is concluded with you, the data you submit (in particular your CV) may become part of your personal file.

Your basic identification data obtained from you in your email correspondence with us or within your activity on our website (e.g. data obtained from your response to an advertisement) will also be used for the purposes of protecting our company’s rights or the rights of third parties from any possible infringement that might be committed in the course of such activities and for the IT security of our website and network.

Data on how you gave us your consent or basic information about you and how we obtained your data will also be used to fulfil our statutory obligations, in particular the data protection obligations (proof of your consent to the processing of data, etc.) and, where applicable, for the purposes of verifying the performance of contracts concluded with operators of the above-mentioned CV-sharing services.

How long will we process your data?

The processing of personal data for the basic purpose, i.e. for the selection of a suitable candidate to fill a position within an on-going selection process, will be carried out until we fill the position and for about 6 months after it has been filled (so we can contact you with the offer of this position if the originally selected candidate did not succeed in the position; after this time, for the purpose of protecting our rights or the rights of third parties, emails that we exchange with you may be archived for a reasonable period of time). If we hire you, your CV and other similar data about you will be included in your personal file and will be processed for the duration of keeping this file.

If you consent to the use of your data for the offers of other positions in the future, we will process your data for the above purpose until you withdraw your consent.

In order to prove the fulfilment of our obligations under the Personal Data Protection Act, we may also, upon withdrawal of your consent, store information about how we obtained your consent and what it concerned for a reasonable period of time (usually a maximum of 4 years).

The above-mentioned periods may also be exceeded in individual cases where the circumstances justify it, for example in the case of litigation.

For the other above-mentioned purposes (protection of rights, IT security, legal obligations), we will process the necessary data about you (usually not the CV you provided) for a reasonable period of time; in determining what the reasonable period for processing your personal data is, we take account primarily of the following aspects: (i) the length of the limitation period, with a reserve to learn that an action has been brought or another proceeding has been initiated, (ii) the likelihood of legal claims against our company, (iii) the expected time limits for detecting attacks on our network or finding other security breaches, (iv) usual market practices, (v) the likelihood and significance of threatened risks, and (vi) the practices recommended by the supervisory authorities.

On what legal basis do we process your data?

The legal basis for the above processing is your consent (for the purposes of your inclusion in a selection procedure or in our CV database for future offers of job positions) and the legitimate interests of our company (especially when we first obtain contact with you in a way other than with your consent, for the purpose of processing your data in order to protect the rights of our company or the rights of third parties against possible illegal acts and for IT security purposes).

Please note that the provision of personal data for processing with your consent is optional on your part, but without your consent, we will not be able to include you in the appropriate selection procedures.

Furthermore, the legal basis of the above-mentioned processing is also the fulfilment of the legal obligations of our company, especially in the field of regulations on the protection of personal data (EU Regulation No 2016/679).

Please note that if your consent is the legal basis for the processing of your data, you have the right to withdraw it at any time. The withdrawal of consent is without prejudice to the lawfulness of processing based on the consent given prior to its withdrawal.

Right to object

If the legal basis for the processing of your personal data is the legitimate interest of our company (in particular, the data obtained about your activities on our website processed for the purposes of the protection of rights and IT security and the data of your correspondence with us), you have, for reasons relating to your specific situation, the right to object at any time to such processing of personal data. In such a case, we will not process your personal data unless there are serious legitimate grounds for the processing that outweigh your interests or rights and freedoms or if they are not being processed for the purposes of determining, enforcing or defending legal claims. You can make a complaint against the processing via the contact details listed below or preferably via email to imoba@imoba.cz. In the email, please state your specific situation that leads you to the conclusion that we should not process your data.

Updating of data

If there is a change in the information you provide in your CV or other data you have provided (e.g. you obtain higher qualifications, you learn other languages, etc.), please let us know. We will be able to better choose the position we will offer you.

Who can get access to your data?

We may make your data available to the typical extent to our processors or other recipients – suppliers of external services to our company (typically programmers or other support technical services, including a system for keeping a database of job seekers, email distribution), to our server operators, or the operators of technology that we use who process them in order to ensure the functionality of the relevant services. In addition, personal data may be made available to the extent necessary to legal, economic and tax advisers and auditors who process them for the purpose of providing advisory services. Upon request or in the case of suspicion of unlawful activity, personal data may also be transmitted to the public authorities. IMOBA will have access to the data on job seekers for subsidiaries for the above-mentioned purposes.

ADVICE ON THE PROCESSING OF PERSONAL DATA OF VISITORS TO IMOBA’S WEB PAGES

For what purposes do we process your data?

Our company does not process the personal data of users except for the purposes permitted by law, or for the purposes to which the user has consented, in particular for the following purposes:

  • Measurement of traffic on our site
  • Improving the content of our site and its development
  • Ensuring the security of our systems and network against external attacks or misuse by users, as is common in market practice
  • Organising consumer competitions
  • Keeping accounting records and fulfilling other statutory obligations (e.g. documenting consent to the processing of personal data, etc.).

We typically process your data in our own computer systems, or we can use third-party systems (so-called “processors”).

Legal basis of processing

The legal basis for the processing of your personal data is legitimate interest (given by the interest in protecting our rights), processing for statistical purposes, measuring our site traffic and the interest of third parties (especially our contractual partners involved in providing performance to you), and the fulfilment of statutory requirements (especially the prevention of tort, fulfilment of requirements under the regulations on personal data protection, keeping of accounts, fulfilment of obligations under tax regulations, etc.).

If we need your consent for processing, you will be asked for such consent.

What data do we process, for how long and what are its sources?

For the above purposes, we mainly process data about your activity on our website, IP address, date and time of access, basic geographical location, etc.

In the event that we would also need your consent, we will process information that you have provided us with such consent and how it was provided (by storing information on the manner and time of your consent, including your IP address from which you have marked the box) and when you have withdrawn it.

All personal data are processed only to the extent necessary for the fulfilment of the above-mentioned purposes and only for the time necessary to achieve the purposes set by us, but for no longer than the period stipulated by or in compliance with the relevant legal regulations. Personal data processed with consent are processed until the consent is withdrawn; then the data can be processed if there is another legitimate reason (such as proof of consent, defence against legal claims, etc.).

To determine the length of the processing period, we use in particular the aspects of (i) the length of the limitation period, (ii) the likelihood of legal claims against our company, (iii) the expected time limits for detecting attacks on our network or finding other security breaches, (iv) usual market practice and the recommendations of the supervisory authorities and (v) the probability and significance of risks.

If we need information from you that will directly identify you or allow us to contact you, we will expressly ask you.

The source of the personal data we process about you is primarily your activity on our website.

Who can get access to your data?

IMOBA may only make your personal data available to third parties in cases where it is required or allowed to do so by law or with your consent, in particular to:

  • suppliers of external services (typically programmers or other support technical services, server services, services related to the measurement of traffic on our website and customisation of their content to user preferences);
  • operators of backup servers, or IMOBA technology providers who process them to ensure the functionality of the website;
  • upon request or in the case of suspicion of unlawful activity, personal data may also be transmitted to the public authorities.

Are you required to provide us with the data?

You provide IMOBA with your personal data voluntarily. If there is a legal obligation to provide us with data in any case, we will inform you of that.

Agreement

If the legal basis for the processing of your personal data is your consent, you may withdraw such consent at any time, free of charge, using the contact details given below. The withdrawal of consent is without prejudice to the lawfulness of processing based on the consent given prior to its withdrawal.

Right to object

The right to object is one of your important rights. It allows you to have the data processing performed based on our legitimate interest reviewed. This means that the processing itself is permissible, but there are specific reasons on your side why you do not want the processing to take place. In such a case, IMOBA will not process your personal data unless there are serious legitimate grounds for the processing that outweigh your interests or rights and freedoms or if they are not being processed for the purposes of determining, enforcing or defending legal claims. However, the possibility to object does not apply to cases when we are processing your data necessary for the performance of the contract, or if the processing of such data is required by law. The right to object is laid down in Article 21 of the Regulation.

You may object to the processing via the contact details listed below or ideally via email at imoba@imoba.cz. In your email, please state the specific situation that leads you to the conclusion that IMOBA should not process the data. Please note that even in the above-mentioned cases, parallel processing of personal data will sometimes take place for other purposes that will justify IMOBA to continue to process such data.

Cookies

We use cookies or other similar network identifiers on our websites to distinguish individual computers and individually set certain services. Cookies are small text files that our servers store on individual computers using a web browser. You can imagine cookies as a form of website memory, allowing the website to recognise the user of the same computer when they next visit the website.

Cookies do not serve to retrieve any sensitive personal data.

Standard web browsers support cookie management. For more detailed information, please use the help of your browser. If your browser allows the use of cookies, we will assume that you agree to the use of standard cookies from our servers.

VII. RISKS AND RECOMMENDED PROCEDURES

Every processing of personal data carries certain risks. These may vary depending on the extent of the data processed and the method in which they are processed. Below are some best practices that can help protect your data:

  • If you provide us with your data, always consider whether it is necessary to provide the data. Particularly careful consideration should be given to the provision of data relating to your personal life and its aspects unrelated to the purposes for which you are providing them or to the data to be published (e.g. your comments under articles, etc.). If you feel we require too much information, please contact us and we will verify the propriety of our request.
  • If you provide us with the personal data of third parties (your family members or other employees of your company, etc.), consider whether this is necessary. If necessary, request the consent of such third parties.
  • If one of our colleagues asks you to provide us with data, do not be afraid to ask if this is necessary and if you can achieve the purpose of processing without this data.
  • Persons under the age of 18 are particularly vulnerable. If data provision concerns these persons, it is necessary to consider all the circumstances very carefully. At the same time, it is necessary to consider whether the consent of such persons or their legal representatives (e.g. parents) needs to be provided for the provision of such data. If you are a person under the age of 18, if you have any doubts as to whether you are able to make the right decision, discuss the matter with your parent or guardian or contact us separately.
  • If you log in with a password, always use a unique strong password that you do not use for other devices and accesses. Do not tell or make accessible your password to anyone, even to our employees. We will never ask for your password, so beware of emails requiring your passwords, even if apparently signed by IMOBA. They are likely to be scams for the purpose of soliciting and then misusing the password.
  • If you send us confidential data, try to use a secure way of communication, such as password-protection of the file associated with encryption and passing the password through another communication channel.
  • If you feel that our company is not in some way compliant with any obligations, there has been an unauthorised data leak, or someone is pretending to be our collaborator, please let us know as soon as possible, either electronically to our email address imoba@imoba.com, or by post to our address IMOBA, a.s., Pyšelská 2327/2 Chodov 149 00 Prague 4.
  • We always try to keep this advice up to date. That is why we will modify these rules from time to time. We will inform you separately about important modifications, but it is a good idea to read these rules again from time to time.

HOW CAN YOU CONTACT US?

Please send any comments and queries regarding the protection of personal data and matters relating to the exercise of your legal rights to the following contacts:

IMOBA, a.s., Pyšelská 2327/2, 149 00 Prague 4 Chodov,

email: imoba@imoba.cz

Data box ID: bs7eh63

This information on the processing of personal data is valid and effective as of 25 May 2018. The current version of this document is published at www.imoba.cz and also on the websites of all IMOBA establishments.

Pour toute question, notre équipe est à votre entière disposition au +420 220 188 610.