Personal data

Information on the processing of your personal data

1. We process your personal data because such processing is necessary to fulfil obligations arising for TouchWARE from the mutual contract concluded with you; it is also necessary for compliance with TouchWARE's legal obligations and for the purposes of TouchWARE's legitimate interests (direct marketing only).

2. Because the conditions for lawful processing of personal data under Article 6(1)(b), (c), and (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "Regulation") are met, your consent to the processing of your personal data is not required for these purposes.

3. Providing your personal data is a requirement that must be stated in the mutual contract; without providing your personal data, it would not be possible to fulfil contractual obligations and TouchWARE would therefore not enter into the contract without personal data being provided.

4. The controller of personal data is TouchWARE, s.r.o., Company ID 261 85 351, registered office at Prague 8 - Liben, Sokolovska 385/200, postal code 180 00, www.touchware.cz, tel. +420 222 36 36 22, email touchware@touchware.cz (the "controller").

5. For the purpose of fulfilling TouchWARE's legal obligations, your personal data will be transferred to business partners providing accounting and tax advisory services for TouchWARE.

6. To the extent of name, surname, address, telephone number, and contact email address, your personal data will be transferred for the purpose of pursuing TouchWARE's legitimate interests to a business partner distributing promotional materials for TouchWARE.

7. To the extent of name, surname, address, date of birth, telephone number, contact email address, and ID card number, your personal data will be transferred for the purpose of fulfilling contractual obligations to business partners providing domain registration services for TouchWARE. 8. Your personal data to the extent of name, surname, date of birth, address, telephone number, contact email address, and ID card number will be stored by the controller for a maximum of 10 years.

9. We inform you that you have the right to obtain confirmation from the controller as to whether or not your personal data are being processed and, where that is the case, access to the personal data and the following information: a) purposes of processing; b) categories of personal data concerned; c) recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) the envisaged period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; e) the existence of the right to request rectification or erasure of personal data concerning you or restriction of processing, or to object to such processing; f) the right to lodge a complaint with a supervisory authority, which is the Office for Personal Data Protection, www.uoou.cz; g) a copy of the personal data undergoing processing.

10. We inform you that you have the right to have the controller rectify inaccurate personal data concerning you without undue delay. Taking into account the purposes of processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

11. We inform you that you have the right to have the controller erase personal data concerning you without undue delay and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; b) you object to processing for direct marketing purposes; c) the personal data have been processed unlawfully; d) erasure is required to comply with a legal obligation under Union or Member State law to which the controller is subject.

12. We inform you that you have the right to have the controller restrict processing of your personal data where: a) you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data; b) processing is unlawful and you oppose erasure and request restriction of use instead; c) the controller no longer needs the personal data for processing purposes but you require them for the establishment, exercise, or defence of legal claims. Where processing has been restricted, such personal data may, with the exception of storage, be processed only with your consent or for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State. The controller must inform you in advance that the restriction of processing will be lifted.

13. We inform you that the controller notifies each recipient to whom your personal data have been disclosed of any rectification or erasure of personal data or restriction of processing, unless this proves impossible or involves disproportionate effort. The controller will inform you about those recipients if you request it.

14. We inform you that you have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller.

15. We inform you that you have the right to object at any time to the processing of your personal data for direct marketing purposes. If you raise such an objection, personal data will no longer be processed for those purposes. You may raise your objection on the Consent to the processing of your personal data page at https://gdpr.touchware.cz.

16. Your personal data are properly secured through both technical and organizational measures of the controller. We inform you that if a breach of security of your personal data occurs that is likely to result in a high risk to the rights and freedoms of natural persons, the controller will notify you of the breach without undue delay. This does not apply where: a) the controller has implemented appropriate technical and organizational protection measures and those measures were applied to the personal data affected by the breach, in particular measures that render the data unintelligible to anyone not authorized to access them, such as encryption; b) the controller takes subsequent measures ensuring that the high risk to the rights and freedoms of data subjects is no longer likely to materialize; c) it would require disproportionate effort (in which case data subjects will be informed by public communication or similar measure); d) the supervisory authority decides otherwise.