Principles Relating to the Processing of Personal Data

The purpose of this message is to provide you with information about what personal data we compile, how we handle it, the sources from which we obtain it, the purposes for which we use it, to whom we are permitted to provide it, where you can get information about your personal data, and what your individual rights are with regard to personal data protection.

Please familiarise yourself with the content of this message. We will gladly answer any questions that you send us to the address Alšovo nábřeží 79/12, 110 00 Praha 1 or to the e-mail address info@ceskafilharmonie.cz. You may also call us at +420 227 059 227. For questions concerning the activities of Galerie Rudolfinum, please contact them at galerie@rudolfinum.org,
+420 227 059 348.

You may also contact our data protection officer:

Jiří Bělohradský
E-mail: dpo@ceskafilharmonie.cz
Phone: + 420 602 421 377

I. General Information

In view of our organisation’s business activities, we are required to process certain personal data, and in particular to do so for the purposes of performance of contractual duties. Without your personal data, we would not be able to provide our products and/or services at all.

We also process your personal data above and beyond what is legally required. This is done for the purpose of caring for you and our other customers, in order for us to develop further our business relationships and to be able to approach you with a targeted offering of our products and/or services. In order to do this, we need to obtain your consent. In view of the orientation of our products and/or services, we will enforce a minimum age requirement for the granting of valid consent for the processing of personal data without the permission of the legal guardians of data subjects.

I.1. Principles for the processing of personal data

When processing your personal data, we honour and respect the highest possible standards of personal data protection, and in particular we abide by the following principles:

(a) We always process your personal data for a clearly and comprehensibly established purpose by established means and in an established manner, and only for the period that is necessary with respect to the purposes of their processing; we process only the exact personal data of clients, and we ensure that their processing corresponds to the established purposes and is necessary for the attaining of those purposes;

(b) We protect your personal data as classified information; we therefore process the personal data of clients in a manner that ensures the security of the data and that prevents any kind of unauthorised or random access to clients’ personal data, their alteration, destruction, or loss, unauthorised transmission, other unauthorised processing, or other misuse;

(c) We always inform you clearly about the processing of your personal data and about your entitlement to accurate and complete information about the circumstances of that processing as well as about your other related rights;

(d) Our organisation has enacted and complies with appropriate technical and organisational measure in order to ensure a level of security corresponding to potential risks; all persons who come into contact with clients’ personal data have the duty of maintaining confidentiality about information obtained in connection with the processing of that data.

II. Information about the processing of personal data

II.1. Information about the personal data controller

Your personal data controller is the Czech Philharmonic (Česká filharmonie), registered office: Alšovo nábřeží 79/12, 110 00 Praha 1, Company ID: 000 23 264, a public-benefit corporation.

II.2. Purposes of and legal basis for processing

II.2.1. Processing of personal data without your consent

This usually involves situations when you are required to provide personal data as a condition in order for us to be able to provide you with our products and/or services, or when we are entitled to process your personal data obtained in some other manner.

(a) By law, we are entitled to process your personal data without your consent for the following purposes in order to comply with our legal obligations:

(i) to prevent damages to the assets of our organisation;
(ii) to prevent the perpetration of fraud against our organisation;
(iii) to perform any duties involving client identification and due diligence under the Act on the Prevention of Money Laundering and Terrorist Financing;

(b) conclusion or performance of an agreement with you.

This mainly involves the actual realisation of contractual relations or other contractual performance between you and our organisation. Personal data are necessary inter alia to make possible the realising of contractual relations without excessive legal risks, including negotiations with you over the concluding or amending of an agreement.

(c) protection of rights and of legally protected interests, especially for:

(i) protecting the rights and legally protected interests of our organisation, collecting receivables, securing or otherwise claiming receivables, and the advancement and development of services provided;
(ii) negotiations with parties interested in the assignment of a client’s debt or in some other form of succession or transfer of receivables, including associated implementation, and other subsequent dealings with third parties, and in particular the informing of providers of related credit protection etc.;
(iii) the resolution of disputes, and in particular for lawsuits or other dispute resolution.

(d) our own legitimate interests.

This mainly involves situations where there is a contractual and/or customer relationship between you and our organisation.

II.2.2. Processing of personal data with your consent

This generally involves situations when you voluntarily consent to our processing of your personal data. On the basis of your consent, our organisation processes your personal data for the following purposes:

(a) exercising rights and performing duties arising from an agreement with you; this is a situation where your personal data is processed for the performance of an agreement;

(b) client care; these are activities that do not represent contractual performance or any other legal framework for the processing of personal data and that include the following:

(i) market research;
(ii) monitoring clients’ behaviour on our organisation’s website in connection with the services offered (this purpose does not involve the mere obtaining of information about the behaviour of users visiting the website of our organisation by means of cookies as described below in the paragraph on electronic means of communication and mobile applications);

(c) offering of products and services; this mainly involves the dissemination of information and the offering of our organisation’s products and services by various means (mail, electronic media including e-mail and messages sent to mobile devices, telephone calls, and through the website).

Providing personal data for the purposes of contractual performance and providing personal data for the purposes of our caring for you as a customer are our contractual requirements, and failure to provide the data may result in failure to conclude an agreement or our inability to provide adequate customer care.

II.3. Extent of processing of clients’ personal data

Our organisation processes your personal data to the extent necessary for the attaining of the purposes set forth above. We process contact information (contact addresses, telephone numbers, e-mail addresses, fax numbers, or other similar contact information), identifying information (first and last name, date of birth, address of permanent residence, and also the Company ID number and VAT number for clients who are individual entrepreneurs), and surveillance video.

II.4. Manner of processing of the personal data of individual entrepreneurs

The manner in which our organisation processes your personal data includes manual and automated processing in the information systems of our organisation and in material form.

Your personal data are processed primarily by the employees of our organisation and, to the extent necessary, by third parties. Before any forwarding of your personal data to a third party, we always enter into a written agreement with that party containing the same guarantees for the processing of personal data with which our organisation complies in accordance with its legal duties.

II.5. Recipients of personal data

Access to your personal data is granted mainly to the employees of our organisation in connection with the performance of duties at work that require them to handle the personal data of clients, but only to the extent that is necessary in the particular case in question and while complying with all security measures.

In addition, your personal data are forwarded to third parties that take part in the processing of the personal data of our organisation’s clients; they may also be granted access to these personal data for other reasons in compliance with legislation.

In particular, the forwarding of personal data is directed towards:

(a) the law firm that represents us;

(b) our accounting and tax consultancy agency;

(c) our marketing agency;

(d) processors who provide us with server, website, cloud, and IT services.

Before any forwarding of your personal data to a third party, we always enter into a written agreement with that party containing regulation of the processing of personal data with the same guarantees for the processing of personal data with which our organisation complies in accordance with its legal duties.

II.6. Duration of personal data processing

Our organisation processes clients’ personal data only for as long as is necessary for the purposes of their processing. We continually evaluate whether there is an ongoing need for the processing of particular personal data for a definite purpose. If we determine that data are no longer needed for any of the purposes for which they have been processed, we delete them. With regard to certain purposes for the processing of personal data, however, we have already made an internal evaluation of the usual period during which personal data may be used, and once that period has lapsed, we make an especially careful evaluation of the need for processing the relevant personal data for the purpose in question. At the same time, in this context:

(a) we process personal data for contractual performance for the duration of the contractual relationship with the client; thereafter, the personal data in question may usually be used for a period of ten years;

(b) we process personal data for the offering of products and services for the duration of the contractual relationship; thereafter, the personal data in question may usually be used for a period of ten years;

(c) we process personal data for client care for the duration of the contractual relationship with the client; thereafter, the personal data in question may usually be used for a period of ten years;

(d) we process personal data for protection of rights and guarding of legally protected interests in the form of video surveillance; thereafter, the personal data in question may usually be used for a period of 14 days.

II.7. The right to revoke consent

In this notification, we have explained the reasons for which we need your personal data and that we may process them for some purposes only with your consent. You are not required to grant our organisation permission to process your personal data, and you are also entitled to revoke that permission. We would remind you that we are entitled to process some personal data for certain purposes even without your consent. If, in such a case, you revoke your consent, we will terminate the processing of the personal data in question for purposes requiring relevant permission, but we may be entitled or even required to continue to process the same personal data for other purposes.

If you wish to revoke your consent to the processing of personal data, please contact us at our headquarters at the address Alšovo nábřeží 79/12, 110 00 Praha 1 or by e-mail at dpo@ceskafilharmonie.cz.

II.8. Sources of personal data

We obtain clients’ personal data mainly:

(a) from the clients themselves;

(b) from publicly available sources (public registers, records, or lists);

(c) from parties potentially interested in our organisation’s services in connection with marketing events and campaigns;

(d) from our own activities through the processing and evaluation of clients’ other personal data;

(e) from surveillance video.

II.9. Your rights in connection with the processing of your personal data

You can exercise all of your rights at our headquarters at the address Alšovo nábřeží 79/12, 110 00 Praha 1 or by e-mail at dpo@ceskafilharmonie.cz. You can also lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection (www.uoou.cz).

II.9.1. The right of access means that you may at any time demand that we provide confirmation about whether or not personal data that apply to you are being processed, and if so, for what purposes, to what extent, to whom they are made accessible, for how long we will be processing them, whether you are entitled to their correction, deletion, limitation on their processing, or to raise an objection. You may also demand information about the sources from which we have acquired the personal data and whether automatic decisions including profiling, if any, are made on the basis of the processing of your personal data. You also have the right to receive a copy of your personal data. This is provided free of charge the first time. Thereafter, we may require payment of a reasonable fee to compensate for administrative costs.

II.9.2. The right to correction means that at any time you may demand that we correct or supplement your personal data if they are inaccurate or incomplete.

II.9.3. The right to deletion means that we must delete your personal data if (i) they are no longer necessary for the purposes for which they were compiled or otherwise processed, (ii) their processing is illegal, (iii) you raise an objection to their processing, and there exist no overriding legitimate grounds for their processing, or (iv) we are required to do so by law.

II.9.4. The right to limitation on processing means that until we have resolved any points under dispute regarding the processing of your personal data, we must limit the processing of your personal data such that we may only keep them stored, and we may, if necessary, use them for the purpose of determining, exercising, or defending legal claims.

II.9.5. The right to raise an objection means that you may raise an objection to the processing of your personal data, which we process for purposes of direct marketing or on the grounds of a legitimate interest. If you raise an objection to processing for the purposes of direct marketing, you personal data will no longer be processed for those purposes.

III. Electronic means of communication

In the course of its business activities, our organisation uses numerous technologies to give you the most convenient possible access to us and to our products and/or services. This mainly involves services connected with the use of the internet and of social media.

III.1. Social media

One of the ways you can reach us is through various social media. We use these channels of communication mainly as marketing tools. At present, our products and/or services are not provided through social media.

III.2. Cookies

When providing our products and/or services, we also use cookies, which are small text files that are saved on the user’s computer the first time it opens our website. These files allow us to identify more easily how visitors to our website work with its contents. This allows us to communicate more helpfully with visitors to our website and to achieve our marketing goals more efficiently. Your web browser has settings that fully enable the deletion of cookies.

IV. Concluding provisions

IV.1. This published information is valid for an indefinite period, and it takes effect on 1 June 2018.

IV.2. We may change this information at any time by the issuing of a complete new version; the current version is published on our organisation’s webpage, and it is also available at our headquarters.

IV.3. Unless explicitly stated otherwise, all information stated here also applies to the processing of personal data of potential clients, i.e. persons with whom we have not yet entered into contractual relations, but with whom we are in contact. The information stated here also applies to an appropriate degree to the processing of personal data of other persons with whom our organisation is in direct contact, although we have no contractual relations with them (e.g. representatives of legal persons).