GDPR

Dear customers and business partners,

We, Kongresové centrum Praha, a.s., have a pleasure of informing you of the manner and extent of processing personal data and of the extent of your rights, as data subjects, in relation to processing of your personal data according to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – “GDPR”).

1. Who is the controller of your personal data?

The controller of your personal data is Kongresové centrum Praha, a.s., 5. května 1640/65, Nusle, 140 00 Praha 4, ID: 63080249, entered in the Commercial Register maintained at the Metropolitan Court in Prague, section B, file 3275 (Prague Congress Centre).

2. Who processes your personal data?

Your personal data is processed by Prague Congress Centre or by selected
processors, who also provide sufficient and credible guarantees of the safeguarding of your personal data protection (for example, providers of IT services and services in the area of security, accountants, providers of analytical services and other suppliers). Your personal data is thoroughly protected and processed in accordance with applicable laws and regulations. The contact person for the personal data protection agenda is Jan Peroutka, phone number: +420 261 172 511, email: jan.peroutka@praguecc.cz . You may also address your queries concerning personal data protection and application of your rights at gdpr@praguecc.cz.

3. For which purposes do we process personal data?

We only process those personal data, and to such an extent, that enable us to be able to
provide you with our services, adhere to our statutory obligations and protect our legitimate interest. We collect the personal data of our clients, including former clients, who have given consent to use continuing to contact them with the offer of our services. We may process your personal data for the following purposes:

a) Conclusion and performance of the contractual relationship which you have entered
with us (Article 6(1)(b) GDPR). Such relationships may lead to additional legal
obligations and we are obliged to process your personal date for those purposes too
(Article 6(1)(c) GDPR); on the basis of § 7 paragraph 3 of Act No. 480/2004 Coll., on certain Information Society Services and on Amendments to some Acts (Act on Certain Information Society Services), as amended, we are entitled to use your data for the purpose of disseminating commercial communications regarding our services and goods similar to those we have already provided to you; however you may refuse their sending at any time using our contact e-mail address as below, or in the way described in the marketing e-mail.

b) Marketing purposes. In order to best adapt the offer of our services to your needs, for this purpose of processing of data we obtain your explicit consent (Article 6 (1) a) GDPR). You can opt out of receiving marketing messages at any time using our contact e-mail address as below, or in the way described in the marketing e-mail.

c) In our legitimate interest in the defense of claims and for the purpose of protecting our property (Article 6(1)(f) GDPR).

4. What are our legitimate interests?

We also process personal data in our legitimate interest such as performance of our
contractual relationships, legal obligations, direct marketing, in the defense of claims, for the purpose of protecting our property as well as to ensure protection of environment and sustainable development.

5. How did we obtain your personal data?

We have obtained your personal data directly from you, especially based on filled-in forms, mutual communication or concluded agreements. Your personal data may also originate from public sources such as registers, records of files, for example commercial register, register of debtors, professional registers, or cadaster of immovable property. We also might have obtained your personal data from the collaborating third parties, which are eligible to access and process your personal data, as well as from social networks or the Internet.

6. What categories of personal date are being processed?

For the purposes of ensuring satisfaction with duly fulfilment of our contractual obligations, statutory obligations, personal offer of services, and additional purposes, we process the following categories of the personal data, such as:

a) Identification data: name, surname, date of birth, personal identification number, your signature, your appearance if you move in proximity of our CCTV which protects our property or if you consent to the taking and use of your photograph or audio-visual recording;

b) data arising from your proof of identity, such as number of document, date of issue,
term of validity, name of issuing authority, information on your permanent residence
(address) and place of your true residence;

c) contact details, including mobile telephone number and e-mail addresses;

d) information on previous use of our services: details on which services you have used
in the past and services which you use now;

e) information from our mutual communication, received by email, telephone calls
serving for the purposes of improvement of our services as well as from filled-in forms;

f) invoicing and transaction data including number of your payment card and
identification numbers required for executing a payment;

g) geolocation data: i.e. Information from the internet browser or mobile application,
which used by you.

7. What is the legal basis for personal data processing?

The legal basis is given by Article 6(1) GDPR, whereby processing is eligible, provided that it is required for the purposes of performance of the agreement, fulfilment of the legal obligation, protection of eligible interests or data is being processed upon your consent.

The legal basis is also given by the law Nr. 563/1991 Coll., on Accounting, whereby your invoicing and payment details shall be stored and processed, law Nr. 89/2012 Coll., Civil Code, whereby we shall have the right for protection of our eligible interest as well as under law Nr. 235/2004 Coll., on VAT

8. How do we ensure the safeguarding of your personal data?

We take the measures required to ensure secure storage of information in electronic format and on paper and to prevent unauthorized access, changes or disclosure of information. Our information security is supported by a number of security standards, processes and procedures. We store information in areas with restricted access or in electronic databases which require login data and passwords. We demand that the providers of our data storage sites and other processors comply with the relevant standards of industrial security. All partners, employees and providers of services that have access to confidential information are subject to the obligation of confidentiality.

9. May we provide your personal data to someone else?

In the case of events organized in the Prague Congress Centre, where catering and gastronomic services are provided by the company Zátiší Catering Group, a.s., personal data is controlled jointly, mainly for the purposes of ensuring the fulfillment of contractual obligations between these controllers and customers, and for marketing purposes.

Your personal data may, under certain conditions, be provided to state bodies (courts, police, notaries, tax authorities, Czech National Bank, etc., within the bounds of them executing their legal powers) or we may provide them directly to other subjects to the extent laid down by special law. Personal data to the extent laid down by law may also be transferred to Personal data may be transferred for processing within the European Union, European Economic Area („EHP“), as well as outside EHP (for example companies within IHG, Holiday Inn group, in case you shall use our services outside the Czech Republic). In case your Personal data are transferred to countries outside the European Union or European Economic Area, it will be done strictly in accordance with the legal regulations and only when sufficient protection of the Personal Data is ensured, among others, by 1) Resolution of the European Commission on reasonable protection in country or countries receiving Personal data, 2) appropriate internal legally binding regulations, 3) approved code of conduct along with legally binding and enforceable obligations by the data controller and processor within the EU and EEA countries, 4) based on specific situation exempt, or 5) standard contract clause in accordance with the EU regulations by the EU Commission.

10. Do we make a record of our phone conversation?

For the purposes of improvement of our services telephone lines of Prague Congress Centre and Hotel Holiday Inn Prague are being recorded. We will notify you of the recording, except for the phone lines of the Fire brigade, Security and Technical control room. These telephone lines are emergency lines where time is essential for protection of lives and property. We may use the content of the conversation for qualifying the quality of our services. The record will be deleted afterwards.

11. Do we take photo documentation at events held at KCP?

At the events organized in the Prague Congress Centre or the Holiday Inn Hotel, we take a reasonable amount of photo documentation (situational shots from the events) in order to subsequently publish selected photos on our website and social networks for promotional purposes of the Prague Congress Centre. In this way, the overall atmosphere of the event is primarily displayed not the participants of a specific event, the shots are not published in detailed resolution, we do not attach captions of specific people attending the event to them.

If event participants are specifically/clearly displayed, it is done based on the express consent of the event participant. In the case of the depiction of a minor, the consent of their legal representative is required.

12. Do we use Cookies?

Yes, we do. We use cookies to analyze data about our visitors, improve our website, display personalized content and provide you with a great website experience. On the KCP website www.praguecc.cz and www.holidayinn.cz it is possible to set which cookie files we can process as a controller.

13. How long do we store your personal data?

We only store your personal data for the length of time required to achieve the set purpose.
We process your personal data for the provision of our services for the duration of your contract and thereafter for the duration absolutely required by legal regulations for the duration of our legitimate interest. If we have consent, we process your personal data only until such consent is withdrawn, and for a maximum of 5 years after consent has been given. Upon expiry of the said period of time, your data will be safely and irretrievably destroyed to make recovery or abuse impossible.

14. What rights do you have in connection with the processing of your personal data and how can you apply such?

The right to information on the processing of and access to your personal data
You have the right to receive from us confirmation of whether personal data which concerns you are or are not processed and if so, you have the right to access such personal data and to further information about processing. You also have the right to provision of copies of processed personal data.
The right to rectification
You have the right to demand that we rectify inaccurate personal data that concern you or supplement incomplete personal data, without undue delay. Please inform us of all changes to concern your personal data at the address provided below.

The right to restriction of processing

As the data subject, you have the right to demand that we restrict the processing of your personal data if:

• you contest the accuracy of the personal data which we process about you, for the period of time required for us to verify the accuracy of your personal data; the processing of your personal data is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the processing of your personal data is no longer required by us, but you request them for the establishment, exercise or defense of legal claims; or you have lodged a complaint against processing on the ground of decision making purely on the basis of automated process, until it is verified whether our legitimate interests prevail over your justified grounds.
• If processing has been restricted based on any of the grounds specified above, the concerned personal data may only be processed (save storage) with your consent or on the ground of the establishment, exercise or defense of legal claims , on the ground of protecting another natural person or legal person or on the ground of a significant public interest or the Union or a Member State; We are obliged to inform you of ending the restriction of processing your personal data in advance.

The right to object
If you believe that the processing of your personal data is proceeding contrary to the
protection of your privacy or contrary to legal regulations, you have the right to lodge an objection to such personal data processing. In the same way you may lodge an objection to automated decision-making.

The right to data portability
You have the right to obtain your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller such that personal data are transferred directly by Prague Congress Centre to another controller if this is technically feasible.

The right to erasure
You have the right to demand that we erase without delay personal data that concern you, if at least one of the following conditions is satisfied:
• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; you withdraw consent to the processing of your personal data and no further legal grounds for their processing exist on our part; you object to the processing of your personal data and there are no overriding legitimate grounds for their processing on our part; personal data have been processed unlawfully; personal data must be erased in order to fulfil our legal obligations; personal data have been collected in connection with the offer of services of the information society.

The conditions specified above do not apply if the processing of personal data is required:

• to exercise the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right of erase is likely to render impossible or seriously impair the achievement of the objectives of that processing; or for the establishment, exercise or defense of legal claims.

Right to withdraw consent
If we process personal data based on your consent, you may withdraw such consent at any time, free of charge. However, the withdrawal of such consent shall not affect the lawfulness of processing personal data based on consent before its withdrawal. You may withdraw consent at any time, in writing, by sending an e-mail or letter to the contact address specified below, without any consequences for our contractual relationships with each other, either current or future.

The right to lodge an initiative or complaint
If you have doubts as to adherence to the obligations associated with personal data
processing, you may contact us or Úřad pro ochranu osobních údajů (Office for Personal Data Protection), having its principal office at Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.cz, https://www.uoou.cz.

15. How can you exercise your rights?

You may exercise your rights in the area of personal data protection by serving a written request or filling a form available on our web site www.praguecc.cz in GDPR section, or by sending an email to gdpr@praguecc.cz, eventually by contacting us on our correspondence address Kongresové centrum Praha, a.s., 5. května 1640/65, Nusle, 14000 Praha 4 or via data box k4ietd4.

All information or statements to the rights applied by you will be provided free of charge. In case, however, the request is reasonably judged as ungrounded, excessive or inappropriate, due to, for example, being repetitive, we shall have the right to charge a reasonable fee, which shall take into consideration administrative costs connected with provision of the required information. Provided that repeated request for provision of copies of the processed personal data we reserve the right to charge reasonable fee for administrative costs, of which you shall be informed in advance.

We will provide you requested information or our statement on adopted measures as soon as possible, however not later than within 30 days. We shall have the right to extend the term for additional two months in consideration of complexity of your query and number of requests. We will inform you about the extension of the term and reasons for such extension in advance.