GDPR

I.
General Provisions

  1. As defined under Article 4(7) of the Regulation of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (“GDPR”), the controller means ExpertaLabs, s.r.o., having its headquarters at Nové sady 988/2, 602 00 Brno – Staré Brno, Czech Republic, Company ID: 11791667, VAT Number: CZ11791667, recorded in the commercial register of the Regional Court in Brno, Section C, File 124690.(“Controller”).
  2. The contact details of the Controller are:
    • ExpertaLabs, s.r.o.
    • Postal address: Nové sady 988/2, 602 00 Brno – Staré Brno
    • e-mail: milos.ohlidal@expertalabs.com
    • Phone details: +420 776 714 203
  3. The personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  4. The Controller did not appoint the data protection officer.

II.
Sources and categories of the processed personal data

  1. The Controller processes the personal data that were provided by you or the personal data that the Controller obtained in your query or hiring request:
    • name and surname
    • e-mail address
    • phone number
    • country
    • curriculum vitae
  2. The Controller processes your identification and contact details and the personal data that are necessary for the performance of the contract, query or hiring request.

III.
Lawful ground and purpose of personal data processing

  1. Personal data processing will be lawful when:
    • processing is necessary for the performance of a contract made between you and the Controller, as defined under Article 6(1)(b) of the GDPR;
    • processing is necessary for compliance with a legal obligation of the Controller, as defined under Article 6(1)(c) of the GDPR;
    • processing is necessary for the purposes of the legitimate interest pursued by the Controller in the provision of direct marketing services (namely, to send commercial notices and newsletters), as defined under Article 6(1)(f) of the GDPR;
    • you have given your consent to the processing of your personal data for the purposes of the handling your query and hiring process, as defined under Article 6(1)(a) of the GDPR.
  2. The purpose for the personal data processing is
    • to process your order and/or hiring request and to exercise and perform the rights and obligations ensuing from the contractual relation made between your and the Controller; when placing an order, it is required to specify personal data that are necessary for the proper processing of an order (name and address, contact); the provision of personal data is vital for the execution and performance of the contract; without providing personal data, it is not possible for the Controller to execute the contract or perform the contract;
    • to perform any and all legal obligations against the state;
    • to send any commercial notices and to perform any other marketing activities;
    • to process your query.
  3. The Controller is not involved in any automated individual decision-making, as defined under Article 22 of the GDPR.

IV.
Record-keeping

  1. The Controller keeps the personal data
    • for as long as the personal data are necessary for exercising and performing any rights and obligations ensuing from the contract made between you and the Controller and for any claims arising from such contractual relations (over the period of 5 years upon the termination of the contractual relation);
    • for as long as the consent with personal data processing for the marketing purposes is revoked; no later than 3 years, if the personal data are processes with the consent.
  2. After the lapse of the period for keeping the personal data, the Controller will delete the personal data.

V.
Recipients of personal data

(sub-contractors of the Controller)

  1. The recipients of personal data are these persons and entities:
    • Those involved in the supply of goods/services/payments made under the contract;
    • Those processing hiring request and handling your queries;
    • Those arranging the marketing services.
  2. The Controller has no intention to transfer personal data to a third country (a country outside the European Union) or any international organisation.

VI.
Personal data processor

  1. The personal data processing is carried out by the controller. However, the personal data may be also processed by these processors:
    • Any other provider of processing software services and applications that are not currently used by the Controller.

VI.
Your rights

  1. Under the conditions defined under the GDPR, you have:
    • a right of access to your personal data, as defined under Article 15 of the GDPR;
    • a right to rectification the personal data, as defined under Article 16 of the GDPR, or a right to restriction of processing, as defined under Article 18 of the GDPR;
    • a right to erasure the personal data, as defined under Article 17 of the GDPR;
    • a right to object to processing of personal data, as defined under Article 21 of the GDPR;
    • a right to data portability, as defined under Article 20 of the GDPR; and
    • a right to revoke your consent with the personal data processing in writing or electronically to be sent to the postal address or the email address of the Controller specified under Article I of these conditions.
  2. In addition, you have a right to file a complaint to the Office for Personal Data Protection if you believe that your right of personal data protection was violated, or else you have a right to bring the case to a court.

VII.
Security of personal data

  1. The Controller hereby declares that all appropriate technical and organisational measures required for the personal data security have been implemented.
  2. The Controller have implemented all technical measures to secure the data storages and paper personal data storages (hard-copy).
  3. The Controller declares that only the persons explicitly authorised by the Controller have access to the personal data.

VIII.
Final Provisions

  1. By placing a query or hiring request via the online form, you confirm that you have read the personal data protection conditions and you accept them in full.
  2. By ticking off the consent in the online form, you express your consent with these conditions. By ticking off the consent, you confirm that you have read the personal data protection conditions and you accept them in full.
  3. The Controller may change these conditions at any time. The Controller will publish the new version of these data protection conditions on its website. In addition, the Controller will send you this new version via email address that you provided to the Controller.

These conditions become effective 1st January 2022.