Personal Data Processing and Protection Policy under the GDPR
(hereinafter also referred to as the “Policy”)
- INTRODUCTORY PROVISIONS
- The controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”) is:
Company / name: TECH4WOMEN a.s.
Registered office / address: Příčná 1892/4, Nové Město, 110 00 Prague 1
Company ID: 23392673
Represented by: Naděžda Pašková
Contact: email: nada.paskova@foragra.cz tel.: 739434501
(hereinafter referred to as the “controller”).
- The controller processes personal data in accordance with the GDPR, Act No. 101/2000 Coll., on the Protection of Personal Data, Act No. 89/2012 Coll., the Civil Code, and other related legal regulations.
- Below is a list of personal data, methods of processing, duration of processing, purpose of processing, as well as information provided to you as data subjects by the controller.
- CATEGORIES OF PERSONAL DATA
- The controller processes only the necessary basic data, namely:
- identification data (your first and last name, trade name, home or registered address, possibly also your mailing address, Company ID, VAT ID, your date of birth)
- contact data (your email and phone number, or IP address).
- The controller processes personal data you have provided or that the controller has obtained based on fulfilling your order.
- REASON AND PURPOSE OF PROCESSING PERSONAL DATA
- The legal basis for processing personal data is:
- performance of a contract to which you, as the data subject, are a party,
- compliance with the legal obligations of the controller,
- the legitimate interest of the controller in providing direct marketing,
- your consent to the processing of personal data for the purposes of direct marketing (sending commercial messages and newsletters).
- The controller processes personal data for the purpose of fulfilling your order, complying with its legal obligations towards the state (e.g., tax obligations), and for marketing activities.
- You may withdraw your consent to receive commercial messages at any time (see section 7.6 of the Policy).
- RETENTION PERIOD OF PERSONAL DATA
- The controller retains your personal data for the time necessary to perform the rights and obligations arising from the contractual relationship or for the time necessary to fulfill archival duties under other legal regulations (Accounting Act, Archival and Records Management Act, VAT Act), but no longer than 10 years after the end of the contractual relationship. If you do not withdraw your consent to data processing for direct marketing, the data will be processed for no more than 3 years.
- After the retention period has expired, your personal data will be deleted.
- PERSONAL DATA SECURITY
- Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, the controller has implemented appropriate technical and organizational measures to meet the requirements of the GDPR and to protect the rights of data subjects.
- RECIPIENTS OF PERSONAL DATA
- The controller provides personal data to the following recipients:
- external accountants,
- payment service providers and payment processors for securing the transfer of funds,
- Your personal data is not transferred to any country outside the European Union. Data is processed both manually and automatically.
- YOUR RIGHTS
- RIGHT TO ACCESS PERSONAL DATA (Art. 15 GDPR)
You have the right to request access to the personal data being processed about you and to the following information:
- the purpose of processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom personal data have been or will be disclosed;
- the retention period for personal data;
- all available information about the source of personal data, if not obtained from you;
- whether automated decision-making, including profiling, is taking place.
- RIGHT TO RECTIFICATION (Art. 16 GDPR)
You may contact us to request a correction if the data we hold about you is inaccurate, incomplete, or outdated. Considering the purposes of processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
- RIGHT TO ERASURE (Art. 17 GDPR)
You may request that your personal data be deleted if:
- the data is no longer necessary for the purpose for which it was collected or otherwise processed,
- you have withdrawn your consent,
- the data was processed unlawfully,
- the data must be deleted to comply with a legal obligation under EU or member state law applicable to the controller, or
- you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to processing under Art. 21(2) GDPR.
- RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR)
You have the right to restrict processing if:
- you contest the accuracy of the personal data for a period enabling us to verify its accuracy;
- the processing is unlawful and you oppose the erasure of the data and request restriction instead;
- we no longer need the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
- you have objected to processing under Art. 21(1) GDPR pending verification whether our legitimate grounds override yours.
If processing is restricted, you will be notified before the restriction is lifted.
- RIGHT TO DATA PORTABILITY (Art. 20 GDPR)
You may request that your personal data be provided to you in a structured, commonly used, and machine-readable format or transferred directly to another controller, provided that:
- processing is based on your consent under Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract under Art. 6(1)(b) GDPR; and
- processing is carried out by automated means.
- RIGHT TO WITHDRAW CONSENT TO PROCESSING
You may withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- RIGHT TO OBJECT TO PROCESSING (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(e) or (f), including profiling based on those provisions. We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
If personal data are processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling related to such direct marketing.
- RIGHT TO LODGE A COMPLAINT
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection,
address: Pplk. Sochora 27, 170 00 Prague 7
ID DS: qkbaa2n,
email: posta@uoou.cz, phone: +420 234 665 111 (switchboard), fax: +420 234 665 444.
- BREACH OF PERSONAL DATA SECURITY
- If it is likely that a specific personal data breach will result in a high risk to your rights and freedoms, we will notify you of such a breach without undue delay. The notification will describe the nature of the breach and provide, at a minimum, the information and measures specified in Art. 33(3)(b), (c), and (d) GDPR. Notification is not required if any of the following conditions are met:
- we have implemented appropriate technical and organizational protection measures, and these were applied to the personal data affected by the breach, particularly those that render the data unintelligible to anyone not authorized to access it, such as encryption;
- we have taken subsequent measures ensuring that the high risk to your rights and freedoms is no longer likely to materialize;
- it would involve disproportionate effort.
- DATA PROTECTION OFFICER
- The controller has a designated data protection officer. For matters related to personal data processing, you may contact us directly.
Mailing address: Příčná 1892/4, Nové Město, 110 00 Prague 1
Email: nada.paskova@foragra.cz
All contact details can also be found on the controller’s website: www.tech4women.cz
This Policy is effective from July 16, 2025
