1. To which cases does this policy apply?

The purpose of this document is to inform persons whose personal data is processed by 3R Systems s.r.o. ("3R System" or "Controller") in the capacity of a controller, i.e. when Comdata itself determines the purpose and means of processing personal data in accordance with Article 4(7) of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council), i.e. in particular in the case of:

(i) persons who have directly requested 3R Systems to provide a service offered by it or to present an offer of a service or goods of its partner or have given 3R Systems consent to process personal data for the purpose of offering goods or services of its partners ("Customer"); and

(ii) 3R Systems' contractual partners, in the case of natural persons, as well as the persons named by the contractual partner in the contract concluded with 3R Systems (hereinafter referred to as "Representative").

This policy does not apply to the processing of personal data of employees and job applicants, which is subject to specific policies with which the individuals concerned are familiar.

If you have been contacted by 3R Systems employees, please note that this is usually the case where 3R Systems acts as a data processor and has obtained your contact from a data controller who has the legal authority to process your personal data (usually the operator of the service you use or to which you have given consent to the processing of your personal data). In such cases, the processing of your personal data is governed by the policies of the relevant data controller.

2. Identification of the Controller and contact details of the Data Protection Officer

The controller of personal data is 3R Systems, ID No. 25013262, Národní 980 Jaroměr, registered in the Commercial Register kept at the Regional Court in Hradec Králové under the number C 35761.

3. Overview of processed (types of) data

The personal data that the Administrator will process are as follows:

(i) personal data provided by the Customer

(ii) personal data of Representatives provided by their employer or other authorised person in the contract concluded with 3R Systems (typically name and surname, job position, telephone, email).

4. Purposes of processing

The Controller processes the Customer's personal data for the purpose of providing the service in which the Customer has expressed interest.

If the Customer gives the Controller consent to be contacted for the purpose of offering goods or services of its partners, the Controller will process the Customer's personal data for the purpose of sending commercial communications (e-mail marketing) and reaching out via telemarketing, where the subject of these marketing communications will be the offers of the Controller's business partners. In this case, this is so-called voluntary processing of personal data, which is based on the consent provided by the Customer.

The personal data of the Representatives are processed by the Controller for the purpose of the performance of the respective contract.

5. Legal basis for processing

The legal basis for the processing of the Customer's personal data is

a) Consent of the Customer - for the purpose of sending commercial communications (e-mail marketing) and telemarketing, we process the Customer's personal data on the basis of the Customer's consent.

b) Execution and conclusion of a contract - on this basis, the Controller processes the personal data of Customers who have asked the Controller to present an offer of a specific service or goods of its partner or to arrange a meeting (or arrangement of a similar matter) with our business partner.

The legal basis for the processing of personal data of Representatives is the performance of a contract (if the personal data of the contracting parties - natural persons) or a legitimate interest (if the personal data of persons mentioned in the contract who are not a contracting party).

6. Processing period

The Controller will process the Customers' data for the following period of time,

a) in the case of processing based on the Customer's consent - for the period for which the consent was granted.

b) in the case of processing for the performance and conclusion of a contract .

The Controller will process the data of the Representatives for the duration of the contract and subsequently for the duration of the limitation period for any claims of the parties arising during the contractual relationship, or for the duration of the proceedings on such a claim.

7. Transfer of personal data to third parties

The Controller shall disclose personal data to third parties where required or permitted by law. In particular, the Controller discloses the personal data of Customers to its partners who provide services in which the Customer is interested or if the Customer has consented to this. Furthermore, the Controller discloses the personal data of Customers/Representatives to the usual extent to processors or other recipients - external service providers, legal, economic and tax advisors and auditors.

8. How the processing will be carried out

The manner in which the Controller processes personal data includes manual and automated processing in the information systems of the Controller or its processors. The Controller will process the correspondence in its filing system.

In particular, personal data are disclosed to the Controller's employees in connection with the performance of their work duties, which require the handling of personal data, but only to the extent necessary in each case and in compliance with all security measures.

When processing personal data, the Controller complies with the highest standards of data protection and in particular complies with the following principles:

(a) personal data shall always be processed by the Controller for a clearly and comprehensibly stated purpose, by specified means, in a specified manner, and only for the time necessary in relation to the purposes for which they are processed; the Controller shall process only accurate personal data;

b) the Controller shall observe appropriate technical and organisational measures to ensure an adequate level of security; all persons who come into contact with the personal data of Customers or Representatives shall be obliged to maintain the confidentiality of information obtained in connection with the processing of such data.

9. Withdrawal of consent

In cases where the processing of personal data is based on the data subject's consent to the processing of personal data, the data subject has the right to withdraw consent to the processing of their personal data at any time. The withdrawal of the data subject's consent to the processing of personal data shall not affect the lawfulness of the processing of personal data prior to its withdrawal. Withdrawal of consent is possible by email sent to: info@3rsystems.cz.

10. Right to object

Pursuant to Article 21 of the GDPR, the data subject has the right to object to the processing of his or her personal data by the controller on grounds relating to his or her particular situation if the controller carries out the processing of personal data on the basis of his or her legitimate interest. If the data subject objects to the controller to the processing of his or her personal data, the controller shall no longer process the personal data of the data subject to the extent of the objection, unless the data subject demonstrates compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

The data subject may object to the processing by e-mailing info@3rsystems.cz. In the e-mail, the data subject shall indicate the specific situation that leads you to the conclusion that the Controller should not process his or her personal data.

11. Information on the rights of data subjects

An individual has the right to:

(a) to request access to the personal data processed by the Controller, which means the right to obtain confirmation from the Controller as to whether or not the personal data concerning him or her are being processed and, if so, the right to obtain access to such personal data and to the other information referred to in Article 15 of the GDPR,

(b) to request the rectification of personal data processed about him or her if it is inaccurate (Article 16 GDPR). Taking into account the purposes of the processing, he or she also has the right to request the completion of incomplete personal data in certain cases,

c) to request the erasure of personal data in the cases provided for in Article 17 GDPR.

d) to request the restriction of data processing in the cases provided for in Article 18 GDPR,

e) request the transfer of personal data in the cases provided for in Article 20 of the GDPR,

(f) obtain, on request, personal data relating to him or her and

- which 3R Systems processes with her consent, or

- which 3R Systems processes for the performance of a contract to which such natural person is a party or for the performance of measures taken prior to the conclusion of the contract; or

- are processed by automated means

in a structured, commonly used and machine-readable format, whereby he or she has the right to have such personal data transmitted directly to another controller, subject to the conditions and limitations set out in Article 20 of the GDPR.

If the Controller receives such a request, it will inform the applicant of the measures taken without undue delay and in any event within one month of receipt of the request. This period may be extended by a further two months if necessary and taking into account the complexity and number of requests. The controller is not obliged to comply with the request in whole or in part in certain cases provided for in the GDPR. This will be the case in particular if the request is manifestly unfounded or disproportionate, especially because it is repetitive. In such cases, the Controller may

(i) impose a reasonable fee taking into account the administrative costs involved in providing the requested information or communication or in taking the requested action; or

(ii) refuse to comply with the request.

If the Controller receives the above request but has reasonable doubt as to the identity of the applicant, the Controller may request the applicant to provide additional information necessary to confirm his or her identity.

The information that the data subject has exercised his/her rights with the Controller and how we have dealt with his/her request will be stored by the Controller for a reasonable period of time (usually 3-4 years) to document this fact, for statistical purposes, to improve our services and to protect his/her rights.

If the data subject believes that the Data Controller is processing his/her personal data unlawfully or otherwise violating his/her rights, he/she has the right to lodge a complaint with a supervisory authority (i.e. the Data Protection Authority) or seek judicial protection.