Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA

Personal data obtained from the data subject.

In this section of the Terms and Conditions entitled “Information on the Processing of Personal Data”, the seller, Newag spol. s r.o., with registered office at Vestecká 104, 25241 Zlatníky, Hodkovice, Company ID No.: 49243624, is referred to as the “Controller”.

For the purposes of this Information on the Processing of Personal Data (“Information”), a data subject means (i) a buyer who is a natural person, whether a Consumer or a buyer who is a natural person and is not a consumer (i.e. a natural person – entrepreneur), or (ii) another natural person.

Identity and contact details of the Controller:

Newag spol. s r.o., with registered office at Vestecká 104, 25241 Zlatníky, Hodkovice, Company ID No.: 49243624, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 20486

Contact details of the Controller:

(i) contact address: Vestecká 104, 25241 Zlatníky-Hodkovice,

(ii) contact email: info@newag.cz,

(iii) contact telephone: 261221528

Purposes of personal data processing. Legal basis for personal data processing:

The Controller processes the data subject’s personal data only to the extent necessary for the relevant purpose and for the period necessary to fulfil that purpose. Once the relevant purpose has been fulfilled, the Controller may process the data subject’s personal data for other legitimate purposes than those for which they were collected; the Controller will always inform the data subject of such other purposes.

Personal data are processed by the Controller for the purposes of:

a) performance of the Controller’s contractual obligations, including fulfilment of the obligation to provide performance under the contract and execution of payment (personal data retention period: for the duration of the contract); legal basis for processing: performance of a contract);
b) performance of the Controller’s contractual obligations, including maintenance and servicing of the Device and the entire central vacuum system – warranty service (personal data retention period: for the duration of the warranty period); legal basis for processing: performance of a contract);
c) performance of the Controller’s contractual obligations, including preparation of a quotation and project documentation (personal data retention period: (i) for the duration of the contract or, if no contract is concluded, for a reasonable period (usually 4 years) for the purpose of documenting this fact); legal basis for processing: (i) performance of a contract or (ii) the Controller’s legitimate interest);
d) performance of the Controller’s contractual obligations, including transfer to another controller within the sales network of Newag spol. s r.o. for the purpose of preparing a quotation. A list of business partners (controllers) can be found under the “Contacts” section of the Controller’s website. Personal data are transferred either through CIS (customer information system), by telephone or by email (personal data retention period: (i) for the duration of the contract or (ii), if no contract is concluded, for a reasonable period (usually 4 years) for the purpose of documenting this fact); legal basis for processing: (i) performance of a contract or (ii) the Controller’s legitimate interest);
e) registration and administration of a user account for the e-shop (online store), processing of online-store orders and performance of the contract, including delivery by a carrier (personal data retention period: for the duration of the contract); legal basis for processing: performance of a contract;
f) compliance with legal obligations, including, for example, maintenance and processing of accounting records (personal data retention period: personal data are processed for the period stipulated by the applicable legislation); legal basis for processing: compliance with a legal obligation;
g) exercising and enforcing legal claims of the Controller, authorised recipients or other relevant persons, or protection of legal claims, including enforcement of legal claims, development and improvement of products and services provided, and handling of disputes, particularly for the purposes of court or other proceedings (personal data retention period: personal data are processed until 1 year after the expiry of the limitation period, or further for the period necessary to protect legal claims); legal basis for processing: legitimate interest of the Controller or a third party;
h) direct marketing – offering the company’s business, services and products and sending commercial communications to existing customers as an offer of information society services under the applicable legislation;
i) offering the company’s business, services and products, sending commercial communications and other marketing communication (personal data retention period: 3 years); legal basis for processing: consent granted by the data subject;
j) CCTV system for the purpose of protecting the Controller’s property and property interests (personal data are processed for 30 days, or for the necessary period in the event of an incident being investigated); legal basis for processing: the Controller’s legitimate interest

The legal basis (legal ground) for processing your personal data is:
• compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR)
• performance of a contract concluded with the data subject (Article 6(1)(b) GDPR)
• legitimate interest of the Controller or a third party (Article 6(1)(f) GDPR)
• consent to the processing of personal data, where granted by the data subject (Article 6(1)(a) GDPR)

Your personal data may be processed manually and automatically, directly by authorised employees of the Controller and also by processors appointed by the Controller on the basis of a personal data processing agreement.

Categories of personal data:

For the purposes stated above, the Controller processes the following personal data:
first name and surname;
email address;
telephone number;
address (street and house number, city, postcode, or plot number where applicable);
address of the Device (street and house number, city, postcode, or plot number where applicable);
company identification number; tax identification number (VAT ID), unless the Goods are purchased and used by a consumer within the meaning of Section 419 of Act No. 89/2012 Coll.;
persons authorised to access the user Account;
telephone contact for a person authorised to access the user Account.

Personal data are used in particular to identify the customer (buyer), prepare quotations, conclude and perform contracts (including delivery of goods – transport), operate the e-shop, issue invoices, provide service services (including information on maintenance of the device for the seller’s (Controller’s) service technicians or subcontractors), and, where applicable, for marketing purposes or for exercising and enforcing legal claims.

Recipients and categories of recipients:

Personal data of data subjects may be transferred in particular to the following categories of recipients:
• public authorities and other entities to which the Controller is obliged to disclose your personal data, or which are entitled to request your personal data from the Controller (e.g. courts, tax authorities, bailiffs, insolvency administrators, law-enforcement authorities, etc.)
• third parties with whom the Controller has entered into a written personal data processing agreement (e.g. IT service providers, accounting service providers, auditors, tax advisers, lawyers, e-shop operation service providers, providers of administrative sales support services, carriers and/or forwarding agents, the CRM system administrator, security service providers, etc.)
• the company’s business partners – e.g. companies within the Controller’s sales network in connection with preparing quotations, preparing project documentation or carrying out warranty and post-warranty service, specifically Newag Praha s.r.o., Newag Brno s.r.o., Newag Hradec Králové s.r.o. and our other authorised distributors; see the current list in the Contacts section here.
• other entities (e.g. insurance companies)
Your personal data may also be made available to third parties for another reason in accordance with applicable legislation.

The Controller does not intend to transfer personal data to a third country outside the European Union or to an international organisation.

Rights of data subjects

You may exercise the rights listed below against the Controller to the extent and under the conditions set out in Chapter III of the GDPR.
As a data subject, you are entitled to exercise your rights against the Controller, for example, using the contact details given in the heading of the Terms and Conditions or in the “Contacts” section of this website.

Your rights are as follows:

Right of access to personal data: You have the right to obtain confirmation from the Controller as to whether personal data concerning you are being processed. If your personal data are being processed, you have the right to access those data. Such access will include, for example, information on the purposes of processing, categories of personal data and information on the source of the personal data. You also have the right to request a copy of the personal data being processed.

Right to rectification: You have the right to have the Controller correct, without undue delay, any inaccurate personal data concerning you that the Controller processes. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure: If any of the grounds defined by the GDPR applies (for example, the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or you withdraw your consent), you have the right to have the Controller erase personal data concerning you without undue delay. However, this right does not apply without limitation. Erasure will therefore not take place, for example, where the data are processed on the basis of a legal obligation arising from applicable legislation.

Right to restriction of processing: You have the right to have the Controller restrict processing in the cases defined by the GDPR. This includes, for example, a situation where you contest the accuracy of personal data; processing will then be restricted for the period during which the Controller verifies the accuracy of the personal data.

Right to data portability: In certain cases defined by the GDPR (for example, where processing is based on your consent), you have the right to receive from the Controller your personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller. You also have the right, where technically feasible, to have the Controller transmit those data directly to another controller. The right to data portability does not apply to personal data that are not processed by automated means.
Right to object: You have the right, on grounds relating to your particular situation (and under the conditions laid down in Article 21 of the GDPR), to object at any time to the processing of personal data concerning you where such personal data are processed on the basis of the performance of a task carried out in the public interest or in the exercise of official authority, or on the basis of the legitimate interests of the Controller or a third party, including profiling based on those provisions. You have the right to object to processing for direct marketing purposes.

Automated individual decision-making, including profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. However, this right does not apply in all cases, for example where the decision is necessary for entering into or performance of a contract between you and the Controller.

Granting consent and the right to withdraw it at any time:

Where the processing of your personal data (as a data subject) is based on your consent, you may withdraw that consent at any time.

If you provide any personal data for processing on the basis of your consent, you do so entirely voluntarily. Both granting and withdrawing consent are therefore your free choice, and the Controller is not entitled to force you to do so or penalise you in any way. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal (i.e. withdrawal has no retroactive effect).
You may withdraw consent to the processing of personal data granted to the Controller by sending an email to the Controller at info@newag.cz. You may request cancellation or deactivation of the user Account in the same way.

Method of exercising rights by the data subject.

Complaints:

As a data subject, you may at any time send the Controller a complaint concerning the processing of your personal data by email to info@newag.cz

As a data subject, you may exercise your rights in connection with the processing of personal data against the Controller by contacting the Controller at Newag spol. s r.o., Vestecká 104, 25241 Zlatníky - Hodkovice, or at the Controller’s contact email address info@newag.cz

If you believe that the processing of your personal data violates applicable legislation/the GDPR, you have the right to lodge a complaint regarding the Controller’s conduct with a supervisory authority. The supervisory authority for the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.cz). This is without prejudice to any other administrative or judicial remedies provided by applicable legislation for the protection of data subjects.

Provision of information by the Controller:

The Controller provides information in writing in paper form. However, if you contact the Controller electronically at the Controller’s contact email address, the Controller will provide the information electronically (by email), unless you request the information in paper form. This is without prejudice to your right to data portability.

If we receive a request from you pursuant to Articles 15 to 22 of the GDPR, we will inform you of the measures taken without undue delay and, at the latest, within one month after receipt of the request, we will inform you of the measures taken, any refusal or any extension of the time limit. Taking into account the complexity and number of requests, we may extend the period for providing information on the measures taken (and therefore also for taking the relevant measures) by a further two months. We will inform you of any such extension within one month of receiving the request, together with the reasons for the delay.

Further information:

Where personal data are processed without your consent, their provision is required because (i) they are necessary for the performance of contractual obligations, or (ii) their provision is required by law, or (iii) it is required by the legitimate interests of the Controller or third parties. Failure to provide data for these purposes (or one of them) may result in the contract not being concluded or performance being impossible, etc.

Where personal data are processed on the basis of your consent, the provision of your personal data is neither a statutory nor a contractual condition (nor a statutory or contractual requirement), and therefore you are not required to grant consent. In such cases, you are therefore under no obligation to provide the personal data concerned for the relevant purpose or to consent to their processing. If you do not provide consent, this may mean that the Controller will be unable to apply certain procedures, particularly those related to marketing.

Electronic commercial communications to customers offering information society services (the so-called customer exception) under the applicable legislation (Act No. 480/2004 Coll., on Certain Information Society Services, as amended) may be cancelled using the link contained in each individual commercial communication.

For the purpose of updating personal data, the Controller may be contacted at the contact address or contact email stated above.
If the Controller uses personal data for a purpose other than that specified in this Information, it will promptly provide the relevant data subject with information about that other purpose and the additional information stated in this Information.

The Controller may continuously update the principles governing the processing of personal data under this Information. The current version of this Information is available at www.newag.cz

Delivery of notices

Notices may be delivered to the buyer at the email address specified in their user account or provided by the buyer in the order.