Privacy Policy of PH metal s.r.o.

The purpose of the information on the processing of personal data below is to inform you about how your personal data is handled.

These principles define and specify the conditions and rules for the collection and processing of personal data by the data controller, who is defined below. When collecting and processing personal data, we proceed in accordance with EU Regulation 2016/679, the General Data Protection Regulation and valid legal regulations. We process personal data in a transparent manner, for defined purposes, to the extent and for the time strictly necessary, and always so that the data is secured against unauthorized or illegal processing and against accidental loss, destruction or damage.

These principles describe the categories of personal data that we collect about you, the way they are used, processed and protected. Here we state how long we keep them, with whom we share them, where we transfer them. We will introduce you to the rights that you, as a natural person, are entitled to in connection with our use of your personal data.

1. Identity and contact details of the personal data controller

PH metal s.r.o., with its registered office at Pobočná 1395/1, 141 00 Prague 4, ID number 26697459, registered with the Municipal Court in Prague under file number C 88059.

Contact details for questions, requests or other matters concerning personal data and processing:

• delivery address: Pobočná 1395/1, 141 00 Prague 4
• e-mail address: info@phmetal.cz
• phone: +420 731 141 141

2. Personal data

Personal data is the data you voluntarily provide to us if you

• fill out and send the contact form;
• contact us via e-mail;
• contact us via a telephone call.

The scope of personal data that we collect always depends on the purpose for which we process the data. Personal data means all information that identifies or can identify a specific person.

Other personal data that we obtain automatically in connection with the use of websites is information that we obtain on the basis of cookie files, about whose existence we informed you when you entered the websites.

2.1. Personal data obtained through the contact form

This data is necessary for processing your request. They are, but not exclusively:

• personal data serving your unique identification (first name, last name, title);
• contact details - personal data enabling contact with you (phone number, e-mail address).

2.2. Personal data obtained on the basis of cookies

• IP address
• type of browser, device and operating system
• the address of the website (URL address) from which you come to our website
• time and number of accesses to the website
• whether you have filled out and submitted the contact form

For these purposes, we use personal data for a period of no longer than 24 months, during which time we store the data only in a pseudonymized form. You have the right to object to this processing.

3. Purposes of using personal data

We use the collected data for the following purposes:

• to answer your questions and requests;
• to comply with applicable legal requirements and other legitimate requirements;
• in accordance with explicit consent to the use of cookies in full or in part;
• for the development, analysis and improvement of our services.

3.1. Processing of personal data

Processing is always carried out on the basis of legal grounds, which, among others, include:

• consent or explicit consent in the case of processing personal data for marketing purposes;
• obligations required of us by legal regulations;
• our legitimate interest, which we describe in more detail below.

3.2. Legitimate interest

If you visit the website www.phmetal.cz, we process data about your behavior on the website on the basis of our legitimate interest (i.e. without your consent) for the purpose of:

• preventing attacks on our website and a threat to its functionality and the security of your data; our legitimate interest here is the trouble-free functionality of our services for you and the security of your data;
• obtaining information, on the basis of which we will be able to improve the website for you in the future; our legitimate interest here is to improve our services for you.

If you express interest in our services and contact us by phone or email and/or fill out and send the contact form, we process your data on the basis of legitimate interest (i.e. without your consent) for the purpose of:

• processing your request; processing the request is also our legitimate interest.

For processing the request, we use personal data for the time necessary to handle it. After this period, we will continue to store the data based on our legitimate interest for the purpose of our internal records and control, for a period of five years.

You have the right to object to processing based on a legitimate interest.

If you communicate with us through various channels, especially through a phone call and e-mail, we will process your identification and contact data and records of the communication that took place on the basis of our legitimate interest (i.e. without your consent) for the purpose of:

• handling your request;
• recording your request so that we can check that we are fulfilling it properly and on time;
• proving that we have received and handled your request;
• analyzing them to improve the quality of our services

For these purposes, we store personal data for a period of 2 years.

You have the right to object to processing based on our legitimate interest.

3.3. Processing based on contract performance

If you show interest in our services and fill out the contact form, we process your personal data for the purpose of handling your request, your identification and contact details.

The fact that we use this data for the purpose of handling your request means that we use it in particular:

• so that we can communicate with you about your request;
• in connection with your other questions that you contact us with, both by phone and by e-mail.

For this purpose, we use personal data for the time necessary to handle your request.

3.4. Processing based on the fulfillment of legal obligations

We too must fulfill the obligations established by law. If we process your personal data for this very reason, we do not have to obtain your consent for such processing. On this legal basis, we process your identification and contact data, order data, in order to comply with the following laws in particular:

• Act No. 89/2012 Coll., the Civil Code,
• Act No. 634/1992 Coll., on consumer protection,
• Act No. 235/2004 Coll., on value added tax,
• Act No. 563/1991 Coll., on accounting.

4. Security and protection of personal data

As part of the processing of personal data, we apply security measures to protect personal data against accidental, illegal or unauthorized destruction, loss, alteration, access, disclosure or use. These are, in particular, the following measures:

• encryption of transferred data
• electronic security
• limitation of access rights
• performing security backups
• antivirus protection

We are obliged to report a breach of personal data security, or a leak of personal data, to the Office for Personal Data Protection and, depending on the degree of threat, also to the clients to whom the leak applies. This procedure is not necessary if the security breach does not pose a risk of personal data leakage.

We process personal data personally and automatically. We declare that we do not perform any automated decision-making without the influence of human judgment.

5. Sharing of personal data

We do not disclose the personal data we collect, except in cases or obligations described in this Privacy Policy.

For marketing activities, we also use other entities. These suppliers process it only within the framework of our instructions and may not use it otherwise. They are in the position of personal data processors. We have concluded a personal data processing agreement with these entities, which sets out strict obligations for the protection and security of personal data.

We may also share your personal data with an accountant, tax advisor or legal advisors, if it is necessary to fulfill our legal obligations or defend legal claims.

5.1. Cases of mandatory disclosure of personal data:

• if required of us by legal regulations or legal procedure;
• to law enforcement authorities or other state authorities on the basis of a legal request for disclosure;
• if disclosure is necessary to prevent physical harm or financial loss;
• in connection with the investigation of suspected fraudulent or illegal activity or actual fraudulent or illegal conduct.

6. Rights when processing personal data

As data subjects, in the event that you are an identified and identifiable natural person for us, you have the following rights:

6.1. Right to access personal data

You have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we transfer it, who processes it apart from us and what other rights you have related to the processing of your personal data. You can find out all this in this document "Principles of personal data protection". If you are not sure what personal data we are processing about you, you can ask us for confirmation of whether the personal data concerning you are or are not being processed by us, and if so, you have the right to get access to this personal data. As part of the right of access, you can ask us for a copy of the personal data being processed, while we will provide the first copy to you free of charge and other copies for a fee.

6.2. Right to correct inaccurate data

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have us correct or supplement it without undue delay.

6.3. Right to erasure

In some cases, you have the right to have us erase your personal data. We will erase your personal data without undue delay if one of the following reasons is met:
We no longer need your personal data for the purposes for which we processed it;

• you withdraw your consent to the processing of personal data, and this is data for the processing of which your consent is necessary and at the same time we have no other reason why we need to continue processing this data;
• you exercise your right to object to the processing (see the section "Right to object to processing" below) of personal data that we process on the basis of our legitimate interests and we find that we no longer have any such legitimate interests that would justify this processing;
• you believe that the processing of personal data carried out by us has ceased to be in accordance with generally binding regulations.

But please keep in mind that even if it is one of these reasons, it does not mean that we will immediately delete all your personal data. This right does not apply if the processing of your personal data is still necessary to fulfill our legal obligation or to determine, exercise or defend our legal claims.

6.4. Right to restriction of processing

In some cases, in addition to the right to erasure, you can exercise the right to restriction of personal data processing. This right allows you, in certain cases, to request that your personal data be marked and that this data not be the subject of any further processing operations, but not forever (as in the case of the right to erasure), but for a limited period. We must limit the processing of personal data when:

• you deny the accuracy of the personal data until we agree on what data is correct;
• we process your personal data without a sufficient legal basis (e.g. beyond what we have to process), but before erasing such data, you prefer to only have it restricted
• we no longer need your personal data for the aforementioned processing purposes, but you require it for the determination, exercise or defense of your legal claims;
• you object to the processing. For the period during which we investigate whether your objection is justified, we are obliged to restrict the processing of your personal data.

6.5. Right to object to the processing of personal data

You have the right to object to the processing of personal data that takes place on the basis of our legitimate interest. If it concerns marketing activities, we will stop processing your personal data. In other cases, we will do so unless we have serious legitimate reasons to continue such processing.

6.6. Right to data portability

You have the right to obtain from us all your personal data that you have provided to us yourself and that we process on the basis of your consent and on the basis of the performance of the contract. We will provide your personal data to you in a structured, commonly used and machine-readable format, or you can request the transfer of the data to another data controller.

6.7. Right not to be subject to automated decision-making

You have the right not to be subject to a decision based exclusively on automated processing, including profiling, if these profiling procedures would have legal effects or could significantly affect you in a similar way.

6.8. Right to contact the Office for Personal Data Protection

The exercise of the rights in the manner mentioned above does not affect your right to file a complaint with the relevant supervisory authority. You can exercise this right in particular in the event that you believe that we are processing your personal data illegally or in violation of generally binding legal regulations. You can file a complaint against the processing of personal data carried out by us with the Office for Personal Data Protection (www.uoou.cz), which is located at Pplk. Sochora 27, 170 00 Prague 7.

Whenever the processing is based on your consent, as stipulated in article 7 of the GDPR regulation, you can withdraw this consent at any time in the Cookie Settings section, which you can find in the footer of the website.

In the case of exercising your rights or requests, contact the data controller at the contact details listed above in these Personal Data Protection Principles.

Updates to our Privacy Policy

This Privacy Policy (including any amendments) may be updated periodically to reflect changes in our personal data protection practices and updates to legal regulations. We will notify you of significant changes by posting a prominent notice on our website, which will contain the date of the last update.

These policies are effective from 1.1. 2023