INFORMATION ABOUT PERSONAL DATA PROCESSING
in connection with the provision of TECH FASS Cloud Services (“Information”)
TECH FASS s.r.o., reg. No.: 25073397, with its registered office Věštínská 1611/19, 153 00 Praha 5, Radotín, Czech Republic, file No. C 47258 administered by the Municipal Court in Prague (“TECH FASS” or “Controller”) as the Controller of personal data hereby, in accordance with Regulation (EU) 2016/679, on the protection of natural persons with regard to the processing of personal data (“Regulation”) and other generally binding legal regulations on the protection of personal data, informs persons using TECH FASS Cloud Services (“Data Subject”) about the processing of their personal data associated therewith.
Terms not expressly defined in this Information or the General Terms and Conditions of the Use of the TECH FASS Cloud or other documents these documents may refer to have the meanings as specified in the Regulation.
1. Controller’s contact details
If necessary to deal with issues related to the protection of personal data, Data Subjects may contact the Controller in writing, either by letter sent to the address of its registered office provided above or electronically by sending an email at gdpr@techfass.cz.
2. Purposes of personal data processing
The Controller collects personal data to enable the use of TECH FASS Cloud Services by Data Subjects through their User Accounts created upon registration in the TECH FASS Cloud or, where applicable, through other applications developed for that purpose by the Controller.
In connection with Account registration, personal data necessary for the establishment and operation of the User Account are processed in accordance with the General Terms and Conditions of the Use of the TECH FASS Cloud.
For the Mobile Identity service, it is necessary to process personal data for the granting of the required mobile identity to the user of the relevant Product and its subsequent use in accordance with the Terms and Conditions of the Mobile Identity Service Provision.
For the WebHit service, personal data are necessary for proper provision of remote control, administration and configuration of the system pursuant to the Terms and Conditions of the WebHit Service Provision to a user with the appropriate Role assigned to them in the Installation.
Personal data are also processed for the purpose of fulfilling Controller’s statutory (especially tax and accounting) obligations related to the provision of services.
Within the meaning of the Regulation, the Controller is entitled to process personal data of Data Subjects for direct marketing purposes and, in accordance with other generally binding legal regulations, to use the details of the Data Subjects’ electronic contact obtained in connection with the provision of the Controller’s services or products as well as to send commercial communications concerning similar products or services.
3. Legal basis for personal data processing
The Controller’s legal titles for personal data processing are:
- necessity of processing personal data for the fulfilment of the Controller’s contractual obligations with respect to Data Subjects regarding the provision of services requested by the relevant Data Subject, or for the implementation of measures taken before the conclusion of the relevant contract at the request of the Data Subject concerned;
- necessity of processing personal data for the fulfilment of legal obligations that apply to the Controller and result from generally binding legal regulations;
- legitimate interest in the processing of personal data for direct marketing purposes within the meaning of the Regulation.
Processing of personal data on the basis of these legal titles does not require Data Subject’s consent.
4. Categories of personal data concerned and their source
In connection with the creation and management of the User Account, the following categories of personal data are processed:
- identification data (first and last name),
- contact details (e-mail address).
The password is not stored in readable form, but only its hash is stored, from which the password cannot be reconstructed back.
For Mobile Identity, the following categories of personal data are or may be processed, depending on the user’s choice:
A/ When using a device with Android OS ≤ 10
- IMEI of the device on which the mobile identity will be stored,
- IP address of the device from which the mobile identity was requested,
- identifier of the mobile identity used,
and in cases of mobile identity Standard ID and Business ID also:
- email address of the user of the device where the mobile identity will be stored.
B/ When using a device with Android OS ≥ 10
- IP address of the device from which the mobile identity was requested,
- identifier of the mobile identity used,
and in cases of mobile identity Standard ID and Business ID also:
- email address of the user of the device where the mobile identity will be stored.
For WebHit, the following categories of personal data are or may be processed, depending on the user’s choice:
- Installation identifier (short specification of Installation performed by the installer when the Installation is established in the TECH FASS Cloud; usually the location or owner designation of the Installation is used but due to the principle of minimizing personal data processing the Controller does not require the use of personal data in the description; in order to specify an Installation, it is also possible to insert any image – the entity who inserted the image in the description or who uses it this way is fully responsible for the use of the image in accordance with third party rights),
- specification of Installation users and their roles (first name, last name, email address, role – owner, administrator, user, installer),
- specification of users of access IDs of media associated with a particular Installation (such as first name, surname, media ID code, authorization PIN, assigned access rights, note),
- specification of unassigned access IDs of media associated with the Installation (such as media ID code, media ID name and description),
- specification of operational events of the Installation (such as date, time, system location, user concerned, media ID, and event type and source).
The Controller does not process all the above categories of personal data about all Data Subjects but always only those of them that are necessary for the provision of the service requested by the Data Subject or those stored by the User in their User Account with respect to the Installation.
In connection with direct marketing, identification data and contact details are processed.
Information about cookies is available on every Website of the Controller where cookies are located.
The source of personal data processed is the Data Subject, the person with the relevant Installation or the data were created in connection with the use of a Product.
5. Recipients of personal data
In the context of processing, personal data will be disclosed to other entities, referred to as recipients.
These are entities that:
- technologically provide services for the Controller or are otherwise directly involved in some of the partial processing activities; they are referred to as processors. These include primarily Microsoft as the provider of the Microsoft Azure cloud platform on which the provision of TECHFASS Cloud Services is based;
- provide the Controller with specialised services the primary content of which is not processing of personal data but ad hoc disclosure of personal data may occur – for example, IT specialists (administrators of the Controller’s IT infrastructure in the context of maintenance, support and development of HW resources used in the provision of services, administrators and developers of computer programs, mobile applications and information systems in the context of their maintenance, support and development, and security experts in the context of testing the security of the infrastructure used), providers of electronic communications services, and other professional consultants and advisors.
The need to provide personal data to other categories of recipients, such as public authorities, as part of the fulfilment of the Controller’s legal obligation cannot be excluded either.
All persons the Controller may engage in personal data processing will comply with the requirements stipulated by the Regulation. Processors will perform personal data processing for the Controller on the basis of a special contract.
All employees of the Controller are obliged to follow the Controller’s instructions when processing personal data and to comply with all organisational and technical measures established to protect personal data and, in particular, to maintain confidentiality of personal data they process in the performance of their work.
The Controller does not intend to transfer the processed personal data to a recipient in a third country, however, the servers of the provider of the Microsoft Azure cloud platform, on which the provision of TECHFASS Cloud Services is based, are located in the Netherlands. In certain cases (e.g., disaster recovery), data centres of that provider located in other locations within the EU may also be used.
Details of the security measures that are followed for data security in connection with the operation of the Microsoft Azure platform are set out in the Microsoft Online Services Data Protection Addendum available on the Microsoft website.
6. Storage period of personal data
Personal data processed for the purpose of fulfilment of the Controller’s contractual obligations towards the Data Subject with respect to the provision of services will be processed for the duration of the contractual relationship and subsequently with regard to limitation periods arising from generally binding legal regulations, for a period of 10 years from the termination of the contractual relationship.
Personal data processed for the purpose of fulfilment of obligations arising from generally binding legal regulations will be processed for the period imposed by the relevant legal regulation.
Personal data for direct marketing will be processed for this purpose until the Data Subject objects to such processing. Sending of commercial communications may be terminated at any time in the manner specified in each commercial communication.
After the expiry of the relevant storage period, personal data will be destroyed or anonymised.
7. Data Subjects’ rights
The Regulation provides for numerous rights of data subjects in connection with the processing of their personal data. The most important ones include:
- the right of access to personal data, which includes the right to obtain confirmation from the Controller as to whether or not personal data concerning the Data Subject are being processed and, if so, the right to access such personal data and other information as provided for in the data protection regulations; in the event of a repeated request for copies of the data, the Controller will charge a reasonable fee and, if the Data Subject requests that the data be provided in electronic form, the data will be provided in an commonly used electronic form;
- the right to rectification of inaccurate personal data, which enables Data Subjects to request the Controller to rectify inaccurate personal data concerning them without undue delay; the Data Subject also has the right, taking into account the purposes of the processing, to have incomplete personal data completed, including by providing an additional declaration;
- the right to erasure (to be forgotten), which enables Data Subjects to request the erasure of personal data concerning them if the processing is not necessary for one of the reasons set out in the Regulation;
- the right to restriction of processing, which enables Data Subjects to request that the Controller restrict the processing of their personal data in any of the cases listed in Article 18 of the Regulation;
- the right to object to the processing of personal data relating to Data Subjects on grounds relating to their particular situation, including profiling under Article 21 of the Regulation;
- the right to data portability, which enables Data Subjects, in the cases referred to in Article 20 of the Regulation, to obtain personal data concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transfer such data to another controller without hindrance from the Controller; where technically feasible, transfer of the data by the Controller directly to the other controller may be requested;
- the right to lodge a complaint with a supervisory authority if Data Subjects believe that processing of personal data violates the Regulation; the supervisory authority of the Czech Republic is the Office for Personal Data Protection (uoou.cz/en/).
- the right not to be subject to any decision-making based solely on automated processing, including profiling, which has legal effects on Data Subjects or significantly affects them in a similar manner.
The provision of personal data is voluntary. However, in the event of failure to provide them, the requested services that depend on the User Account or personal data provision cannot be provided.
Provision of personal data is mandatory in cases where the provision of such data follows directly from the law.
8. Means of personal data processing
The Controller processes personal data largely automated, to a lesser extent in a different manner; however, automated decision-making without the influence of human assessment with legal effects for the customer, including profiling, does not take place.
TECH FASS s.r.o.