Fundamentals for Processing of Personal Data in the company Travel Service, a.s. (hereafter the "Fundamentals )

Transcription

1 Fundamentals fr Prcessing f Persnal Data in the cmpany Travel Service, a.s. (hereafter the "Fundamentals ) Persnal data cntrller: Travel Service, a.s., business ID N: , having its registered ffice at the address Praha 6, K Letišti 1068/30, pstcde: (hereafter the "Cntrller") Cntact address f cntrller: law@smartwings.cm Data prtectin fficer: Mgr. František Kubečka, KUBEČKA & PROKOP, advkátní kancelář s.r.., business ID N: , having its registered ffice at the address Praha 2, Kladská 1489/5, pstcde (hereafter the "Officer") Cntact data f Officer: dp@travelservice.aer INTRODUCTION These Fundamentals describe the handling f yur persnal data and cnstitute the fundatin and infrmatin surce fr the prcessing f yur persnal data. These Fundamentals infrm yu f the designated purpse f prcessing, legal title f prcessing, restrictins n the saving f gathered persnal data and abut ther imprtant things. In the Fundamentals yu will read abut yur rights, these being: - t access t the prcessed persnal data - t withdrawal f cnsent t the prcessing f persnal data - t crrectin f inaccurate r incrrect data - t erasure f persnal data - t restrictin n the prcessing f persnal data - t list f persnal data in structured and machine-readable frmat fr yurself r ther cntrller (prtability right) - t ldging f bjectin against persnal data - t right nt t be a subject f autmatic decisin-making If yu d nt like hw we prcess yur persnal data, yu can cntact us n the address law@smartwings.cm, r yu have the right t ldge a cmplaint with the supervisry authrity, which is the Office fr Persnal Data Prtectin ( 1. Basic infrmatin 1. The Cntrller ffers services in the field f civil air carriage, this being in cmpliance with laws regulating civil aviatin at the natinal and internatinal level.

2 2. The partner f the Cntrller is a legal r natural persn wh participates in the prcess f selling air tickets r in the prcess f prvisin f a service cnsisting f the carriage f persns r things. 3. Yu - the passengers flying ff with us t yur dream hliday r a business meeting - are the Client. 4. The Cntrller prcesses persnal data f Clients in cmpliance with Act N 101/2000 Cll., n persnal data prtectin (hereafter the "ZOOÚ"), and als in cmpliance with the Regulatin f the Eurpean Parliament and the Cuncil (EU) 2016/679 n the prtectin f natural persns with regard t the prcessing f persnal data and n the free mvement f such data (hereafter the "GDPR") and in cmpliance with Act N 49/1997 Cll., n civil aviatin (hereafter the "ZCL") and Directive (EU) 2016/681 f the Eurpean Parliament and f the Cuncil n the use f passenger name recrd (PNR) data fr the preventin, detectin, investigatin and prsecutin f terrrist ffences and serius crime (hereafter "PNR"). 5. The Client is nt bliged t prvide the Cntrller with persnal data that the Cntrller des nt need fr the prvisin f the service r which the law des nt require f the Cntrller. But if the Client refuses t prvide the Cntrller with the persnal data defined by the preceding sentence, the Cntrller is authrised t refuse the prvisin f the service t the Client. It gathers ther persnal data, which is yur address and yur telephne number, s that it can send yu a digital air ticket r infrm yu f a delay r cancellatin f a flight r abut ther cmplicatins. If the Cntrller prcesses yur persnal data which it des nt need fr the prvisin f the service r which the law des nt require the Cntrller t gather, it will d s nly with yur vluntary cnsent r by reasn f its legitimate interest. In n case will the Cntrller require the prvisin f cnsent t the prcessing f yur persnal data as a cnditin fr the prvisin f the service. 2. Purpse f prcessing f persnal data Yur persnal data is prcessed in particular with the aim f prviding a carriage service. If we prvide a carriage service t yu, we will retain sme f the persnal data fr the purpse f ur legal prtectin, this being in cnnectin with yur rights frm the cntract f carriage and rights t cmpensatin fr lss. Yur persnal data may be prcessed with the aim f direct marketing f the Cntrller, but nly if yu grant vluntary cnsent t this, which yu can withdraw at any time. The Cntrller may use yur persnal data in cnnectin with direct marketing, even if a legitimate interest suits it t this end. 3. Subject f persnal data prcessing The Client takes nte that the Cntrller gathers this data, sme f which is persnal data, which it needs fr the prvisin f services and which the ZCL and PNR require it t gather: a) given name r given names, and surname, b) day, mnth and year f birth,

3 c) natinality, d) number and type f passprt used by the passenger t prve their identity, e) pint f entry t the territry f the Czech Republic, f) flight number, g) date and time f departure and arrival, h) initial pint f barding fr carriage and i) ttal number f passengers carried by the relevant flight. and during the reservatin f the air ticket it als gathers: 1) PNR lcalisatin recrd 2) Date f reservatin/issue f air ticket 3) Date (dates) f intended trip 4) Given name (given names) 5) Address and cntact infrmatin (telephne number, address) 6) All infrmatin abut means f payment, including billing address 7) Cmplete rute fr individual recrd in passenger name recrd 8) Infrmatin abut traveller's lyalty prgramme 9) Travel agency r brker 10) Situatin f passenger, including cnfirmatin f departure, check-in, infrmatin abut cases where the passenger did nt arrive fr departure r where the passenger arrived at the airprt withut a reservatin 11) Decmpsed r separated infrmatin f PNR 12) General bservatins (including all available infrmatin abut unaccmpanied minrs under the age f 18, such as name and gender f minr, age, language (languages) which he/she speaks, name and cntact data f guardian upn departure and relatinship with minr, name and cntact data f guardian upn arrival and relatinship with minr, intermediary upn departure and arrival) 13) Infrmatin abut issue f air ticket, including air ticket number, date f issue f air ticket and neway air tickets, and cntent f sectin ATFQ (Autmated Ticket Fare Qute) 14) seat number and ther seat infrmatin 15) Infrmatin abut cde sharing 16) All baggage infrmatin 17) Number and ther names f passengers n single PNR recrd

4 18) All gathered API data (including type, number, cuntry f issue and date f expiry f identity dcument, natinality, surname, given names, date f birth, airline, flight number, departure date, arrival date, place f arrival, departure time and arrival time) 19) All preceding changes t PNR recrds given under pints 1 t 18. The Client takes nte that the Cntrller may gather persnal data related t the state f health f a data subject which Regulatin (EC) N 1107/2006 cncerning the rights f disabled persns and persns with reduced mbility when travelling by air requires that the Cntrller gather. The Cntrller gathers this persnal data, which is a special categry f persnal data, because it is essential fr perfrming legal bligatins, and the exceptins t the prhibitin n prcessing given in article 9 paragraph 2 f the GDPR apply t it. The Client takes due nte that the Cntrller may prcess a IP address, this being in the case f cnclusin f a cntract f carriage with the Cntrller via remte electrnic cmmunicatin means (s-called nline), and the Cntrller may als use yur cntact data fr cmmercial messages if the legitimate interests f the Cntrller verride the interests f the Client. 4. Limitatin f strage The Cntrller will liquidate yur persnal data which it has gathered fr cmpliance with the duties pursuant t ZCL and PNR within 24 hurs f the plane landing, with the exceptin f persnal data which it gathers fr reasns given in the fllwing sentences f this article. The Cntrller will retain yur persnal data cnsisting f given name, surname and date f birth fr the reasns f judicial redress, this being in cnnectin with yur rights frm the cntract f carriage (fr example, Mntreal Cnventin; Regulatin f the Eurpean Parliament and f the Cuncil (EC) N 261/2004 f 11 February 2004 establishing cmmn rules n cmpensatin and assistance t passengers in the event f denied barding and f cancellatin r lng delay f flights) and rights t cmpensatin fr lss (fr example sectin 636 f paragraph 2 f the Civil Cde) fr 15 years. After this it will liquidate all persnal data. The Cntrller retains yur persnal data if yu yurself vluntarily express cnsent t its prcessing, and it des s fr a perid f 5 years, unless yu withdraw yur cnsent earlier. The Cntrller will retain yur persnal data nt given in the preceding sentences f this article if it has a crrespnding purpse f prcessing fr it, this being fr a perid f 4 years. The Cntrller bases the legal title fr persnal data prcessing n legitimate interests cnsisting f judicial redress. 5. Transfer f persnal data The Client takes due nte that the Cntrller may use the gained persnal data, including special categries f persnal data, transfer it t a Partner f the Cmpany, nly fr the purpse defined in article 2 f these Fundamentals.

5 The persnal data Cntrller may transfer yur persnal data t recipients in a third cuntry, in particular airprts in the cuntry f arrival r natinal authrities which perfrm the functin f state aviatin authrity r t a Partner in a third cuntry nly fr the purpse defined in article 2 f these Fundamentals. The transfer f yur persnal data is based n suitable guarantees cnsisting f the decisins f the Cmmissin (if yu fly t a cuntry where crrespnding persnal data prtectin is guaranteed by this decisin; yu can find a list f these decisins here: r in internatinal treaties. Other transfers f persnal data based n apprpriate guarantees are designated in article 46 f the GDPR, and we infrm yu abut them in cntact s f the Cntrller given in the Intrductin t these Fundamentals. The Partners f the cmpany mean in particular: a) peratrs f public internatinal airprts b) handling cmpanies and handling agents (subjects ensuring aircraft handling) c) travel bureaux and travel agencies d) Civil Aviatin Authrity e) natinal authrities f ther cuntries which perfrm the tasks f state aviatin authrity f) units f Plice f the Czech Republic, pursuant t Act N 326/1999 Cll., n residence f freigners n the territry f the Czech Republic g) ther persns participating in the implementatin f a service cnsisting f the carriage f persns and gds The Client takes due nte that the Cntrller can transfer persnal data t state authrities fr a purpse designated by legal regulatins. 6. Surce f persnal data Yur persnal data cming directly frm yu, if yu rdered the air tickets n ur web pages r in sme ther way ( , telephne, in writing). Yur persnal data cming frm travel bureaux, travel agencies r ther traders frm whm yu rdered the carriage service. Yur persnal data cming frm ur s-called General Sales Agent (exclusive sales representative; GSA), which is the cmpany AIR WORLD SERVICE a.s., business ID N: , having its registered ffice at the address Milady Hrákvé 382/75, Prague. The GSA can btain persnal data in a manner cmparable t the way we btain it. 7. Rights f Client

6 I. right t prvisin f basic infrmatin abut prcessing - we are bliged t infrm yu when we gain persnal data if we get it directly frm yu, and if we did nt get it directly frm yu, at the latest ne mnth after the persnal data is gained r at the mment when there is mutual cmmunicatin if the persnal data is used fr the purpses f this cmmunicatin, r at the latest after the first disclsure if we disclse it t a third party II. right t access t persnal data - based n a request frm yu we are bliged t cnfirm fr yu whether we prcess yur persnal data and infrm yu accrding t the GDPR f, fr example, the purpse, perid f prcessing, right t erasure etc. We will als prvide yu with a cpy f the prcessed persnal data under the cnditin that it des nt adversely affect the rights and freedms f ther persns. III. right t crrectin if we have inaccurate persnal data, we are bliged t crrect it r cmplete it at yur request. IV. right t erasure based n yur request we are bliged t erase persnal data withut undue delay, especially if: yu have withdrawn cnsent and we have n ther legal title fr prcessing, we n lnger need the persnal data fr the defined purpse fr which it was prcessed, we have prcessed yur persnal data unlawfully, we thereby cmply with the legal bligatin accrding t legislatin, yu bject t persnal data prcessing based n legitimate interests, and there are n verriding legitimate interests here, yu bject t persnal data prcessing fr the purpses f direct marketing, including prfiling. Even if yu request erasure, we are nt bliged t erase the persnal data, in particular fr the reasn f: establishment, exercise r defence f legal claims, cmpliance with legal bligatin accrding t legislatin, exercise f right t freedm f expressin and right t infrmatin. V. right t restrictin f prcessing - we are bliged t restrict the prcessing f yur persnal data if: yu cntest the accuracy f persnal data, the Cntrller prcesses yur persnal data unlawfully, but at the same time yu d nt want the Cntrller t erase it,

7 the Cntrller n lnger needs the persnal data fr any f the defined purpses, but yu require the Cntrller t retain it fr the establishment, exercise r defence f legal claims, yu have bjected t prcessing n the basis f a legitimate interest pursuant t article IV, and we are waiting fr verificatin f whether the interests f the Cntrller verride yur legitimate reasns. At a time when the prcessing f persnal data is restricted, the Cntrller may prcess this data nly by means f its saving, with the exceptin f a situatin where yu grant us cnsent, r fr the establishment, exercise r defence f legal claims, in rder t prtect the rights f anther natural r legal persn r fr the reasn f imprtant public interest f the Unin r sme Member State. The Cntrller will infrm yu in advance shuld a situatin ccur where the restrictin f prcessing will be cancelled. VI. right t data prtability - if we prcess yur persnal data n the basis f cnsent r n the basis f a cncluded cntract, and the prcessing is perfrmed whlly autmatically, yu can ask the Cntrller fr: prvisin f persnal data in a structured, cmmnly used and machine-readable frmat, the transfer f such data directly t anther cntrller if technically pssible. VII. right t bject if we prcess yur persnal data n the basis f a legitimate interest, r if we perfrm prfiling, yu can bject t this prcessing at any time. We will then restrict prcessing until everything is clarified, and if we subsequently d nt shw serius legitimate reasns fr prcessing, we will n lnger prcess the data. If we use the data fr direct marketing, we will stp prcessing yur persnal data withut further ad after yu raise an bjectin. VIII. right t prtectin frm the part f state authrities - yu have the right t refer the matter t the supervisry authrity fr persnal data prtectin - the Office fr Persnal Data Prtectin, with headquarters at the address Pplk. Schra Praha 7, web: telephne: land line: (head ffice), by ldging a cmplaint. In additin t this yu have the right t the prvisin f judicial redress. Yu can ldge a cmplaint with the supervisry authrity and bring a curt case if yu feel that yur rights prtected by the GDPR have been breached as a result f prcessing frm the part f the Cntrller. ASSERTION OF RIGHTS AGAINST CONTROLLER Yu can assert yur rights against the Cntrller in particular electrnically by sending an t the address: law@smartwings.cm, r by pst t Na bjišti 1473/18, Nvé Měst, Praha 2. If yu cntact us electrnically, the Cntrller will als answer electrnically because we want t save ur frests. But yu can ask us fr a different means f cmmunicatin.

8 We will prcess yur requests and react t them as sn as pssible accrding t capacity and ur pssibilities, but in cmpliance with the GDPR we must react at the latest within 1 mnth frm receipt f the request. We can extend this perid by a further tw mnths if needs be and with regard t the cmplexity and number f requests. But we will infrm yu f each extensin within ne mnth f the receipt f a request alng with the specified reasns fr the delay. Shuld we have dubts abut yur persn, we will want yu t prvide us with further infrmatin essential fr the cnfirmatin f yur identity. The reasn is prtectin f yur data, i.e., s that the persnal data is nt transferred t a persn wh is nt the persn he/she is claiming t be. We deal with requests free f charge, but there are certain exceptins t this: Yur request is unjustified, Yur request is excessive, if the Cntrller cmes t the cnclusin that ne f the specified reasns has ccurred, it will refuse t accede t the request, r we will bill yu a cmmensurate fee in rder t cver the administrative csts assciated with the handling f the request. Published Travel Service, a.s.