Information on the processing of personal data of business partners/suppliers
This document provides you with information about your rights related to the processing of your personal data by Smart Energy Holding a.s., Company ID: 10676406, headquartered at Spálená 84/5, Nové Město, 110 00 Prague 1, or by controlled or controlling entities that, together with Smart Energy Holding a.s., form a group within the meaning of Sections 71-91 of Act No. 90/2012 Coll., on Commercial Corporations.
We recommend that you read the information carefully. We have done our best to make them as understandable as possible. If anything is still unclear to you, we will be happy to explain any term or provision to you.
1. Who is the controller of your personal data?
The controller of personal data, i.e., the entity that determines the purposes and means of processing your personal data, specifically the personal data of business partners/suppliers, is the company Smart Energy Holding a.s. (hereinafter "SEH"). SEH has not appointed a data protection officer.
2. How are your personal data processed?
When processing personal data, we comply with applicable legal regulations, specifically Regulation (EU) 2016/679 of April 27, 2016, known as the General Data Protection Regulation ("GDPR"), and related legal provisions.
3. What is the purpose and legal basis for processing personal data?
We process and store your personal data only for the following purposes:
- business activity;
- negotiating the conclusion of the contract, fulfilling contractual obligations;
- providing related services;
- fulfilling the obligations of an entrepreneur in relation to state and local government authorities;
- record-keeping and statistical purposes;
- marketing and advertising purposes;
- protecting the legitimate interests of SEH.
Legal Basis for Personal Data Processing:
- necessity of processing for the fulfillment of contractual obligations according to Article 6(1)(b) of the GDPR;
- necessity of processing for the fulfillment of SEH's legal obligations according to Article 6(1)(c) of the GDPR;
- for the purposes of inspections by state and municipal authorities;
- legitimate interest of SEH according to Article 6(1)(f) of the GDPR – ensuring relationships with business partners, providing customer care, and sending SEH commercial communications related to the service or goods that are the subject of the contract.
4. Which of your personal data do we process?
We process the following personal data in particular: first name(s), surname, academic titles if applicable, date of birth, business identification number (ID), tax identification number (VAT), permanent or temporary residence address, business address, delivery or other contact address, email address, phone number, bank account number, signature (in both paper and digital form, including signature metadata), information about membership in the statutory body of a legal entity, and any other personal data related to or that may be created in connection with the conclusion and fulfillment of the contract or the provision of services.
Additionally, we process data related to your written and electronic communication with SEH, including identifiers such as IP addresses, browser data, and the type of electronic device.
Your personal data is not subject to automated decision-making or profiling.
SEH processes personal data manually and automatically directly through its employees and possibly also through processors (see point 8 below). The protection of personal data by SEH is technically and organizationally secured in accordance with applicable legal regulations. The data is collected and processed for specified, explicit, and legitimate purposes. Data processing is not carried out in a manner incompatible with these purposes. Only data that is absolutely necessary for the stated purpose is collected and processed.
5. Period of Your Personal Data Processing
We process your personal data for the duration of our mutual business cooperation and the duration of the effects of the rights and obligations under the contract, or for the duration of the provision of services, and further for the period necessary for archiving purposes according to the relevant generally binding legal regulations, but no longer than the period stipulated by these regulations. In the case of contract negotiations that do not result in a contract, we will process the provided personal data for 6 months from the relevant negotiation.
6. Communication with the SEH customer service line – recording of telephone calls.
If you communicate with us by phone through the technical support line, our calls may be recorded. We always inform you about call recording at the beginning of the call. The call recordings are stored in our internal information system. We record calls due to SEH's legitimate interests, which include documenting your requests, suggestions, or claims so that we can record, evaluate, properly address them, and ensure that we fulfill our contractual obligations properly and on time. Additionally, we record calls to demonstrate that we adhere to our quality standards of communication and services provided. Please note that the technological solution does not allow us to immediately stop recording a call if it becomes apparent during the call that there is no legal reason for recording, or if consent is withdrawn. In such cases, we will note your request and submit it for processing. If your request is justified and there is no further reason to process the recording, the call recording will be permanently deleted from all storage within one month from the date of the call.
7. How do we protect your personal data?
You can be assured that we handle your personal data with due care and in compliance with applicable legal regulations. We secure your personal data to the maximum extent possible, corresponding to the technical level of available resources. SEH implements the following technical and organizational measures:
- Physical access to SEH premises is restricted by locking entrance doors;
- Protection of paper documents from unauthorized copying and use is ensured by storing them in locked cabinets and offices accessible only to selected SEH employees;
- Electronic documents are protected by password-protected access, data encryption, and SEH network access is secured by a firewall.
When transferring your personal data outside of SEH, we contractually ensure an appropriate level of data protection and security in accordance with relevant legal requirements.
8. To whom else do we transfer your personal data and why?
We generally do not transfer your personal data outside of SEH except in cases where:
- We have your consent;
- It involves a member of the SEH group (especially PHOTOMATE s.r.o., Photomate Logistic s.r.o., Photomate Energy s.r.o., Prokišova s.r.o., PHOTOMATE Polska Sp. z o.o., Poland, PHOTOMATE Hungary Kft., Hungary, LLC PHOTOMATE, Ukraine, PHOTOMATE BULGARIA EOOD, Bulgaria, PHOTOMATE Scandinavia ApS, Denmark, PHOTOMATE Green Energy Romania Srl., Romania, PHOTOMATE Eurasia LLC, Georgia, Photomate Scandinavia AB, Sweden, organizational units of PHOTOMATE s.r.o. in Estonia and Lithuania, Photomate Kazakhstan, PHOTOMATE CA LLC, Uzbekistan);
- Tird parties acting as data processors on our behalf provide technical and organizational services, including software operation and data storage, and individuals providing accounting, tax services, or legal advice to the data controller according to our instructions;
- We fulfill obligations imposed by legal regulations, which may involve financial authorities or other relevant authorities when required by mandatory legal provisions.
Except as outlined above, we do not intend to transfer your personal data to countries outside the EU or international organizations.
9. What rights regarding personal data protection can you exercise?
With respect to your personal data that we process, you have the following rights that you may exercise against us as the Data Controller:
- right to obtain confirmation of the extent of your personal data processing and to access the data;
- right to rectification or completion of your personal data if the personal data is inaccurate or incomplete;
- right to erasure or restriction of the processing of your personal data if the conditions set out in the legislation are met;
- right to object to your personal data processing;
- right to transfer of your personal data to another data controller.
In the event that we process some of your personal data based on your consent, you have the right to withdraw your consent to the processing of such personal data at any time.
You may exercise all of your rights by submitting a written request to the Data Controller to the address of the SEH registered seat or by sending an e-mail to info@photomate.eu
Should you believe that the processing of your personal data violates the statutory regulations, you have the right to lodge a complaint with the competent EU national data protection authority.