Processing of personal data

USSPA s.r.o., company registration number 63218003, with its registered office at Dolní Dobrouč 384, postcode 561 02, registered in the Commercial Register maintained by the Regional Court in Hradec Králové, Section C, file 7850 (“USSPA”), declares that all personal data processed is treated as strictly confidential and is handled in accordance with the applicable legal regulations on the protection of personal data. The security of your personal data is a priority for USSPA. For this reason, on this page we will inform you about the data we hold and explain why we need this data and how you can limit its collection.

USSPA is, within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679 (‘the Regulation’ or ‘GDPR’), the controller of your personal data, i.e. it collects, stores and uses (and otherwise processes) your personal data for the purposes of its business activities (the specific purposes for which personal data is processed are set out in more detail below for each category of data subject).

This Privacy Policy applies to all personal data collected by USSPA (i) in connection with your use of the USSPA website (the “Website”) and, furthermore, to all personal data collected by USSPA (ii) in order to comply with legal obligations, (iii) on the basis of a legitimate interest, and also (iv) in the performance of a contractual relationship with our Customers, or in preparation for a contractual relationship with our Prospective Customers, and in the performance of a contractual relationship with our Business Partners.

USSPA processes your personal data:

• fairly, lawfully and transparently;
• only for specific, explicitly stated and legitimate purposes;
• to a reasonable extent;
• accurately and kept up to date;
• for no longer than is necessary for the purposes for which it is processed;
• in a manner that ensures their appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

If you have purchased our products, made a purchase via our online shop or used our services, you are one of our Customers and we will process your personal data to the extent set out below. In the case of our Customers who are legal entities, we process the personal data of the natural persons representing the Customer.

Purposes of personal data processing

Your personal data may be processed by USSPA primarily for the following purposes:

• Fulfilment of the contractual relationship;
• Providing customer benefits, sending commercial communications and offers;
• Operating the customer e-shop;
• Accounting and tax purposes (record-keeping in accordance with accounting and tax legislation);
• To fulfil other legal obligations (other legal obligations fulfilled by USSPA include, for example, providing information to public authorities).

USSPA is authorised to process the following personal data in accordance with the purpose for which it was obtained from individual data subjects:

Personal data is processed by USSPA both manually and automatically.

USSPA may also process other data relating to its Customers which they provide, taking into account USSPA’s legitimate interests, the maintenance of good business relations, the streamlining of business communication, and for the purposes of fulfilling the contractual relationship.

Personal data relating to third parties – that is, personal data which USSPA receives from a Customer in connection with the conclusion or performance of a contract – will be processed in accordance with the applicable data protection legislation.

At USSPA, your personal data is made available only to authorised employees or to individual data processors and data controllers at USSPA, and only to the extent necessary to fulfil the specific purposes of processing.

A list of recipients of USSPA’s personal data is available at the end of this document. Under certain conditions, we are also authorised to disclose some of your personal data to public authorities in accordance with applicable legislation.

We process and store your personal data for as long as is strictly necessary to fulfil all rights and obligations arising from the relevant contractual relationship, for the duration of the provision of customer benefits and, furthermore, for the period during which USSPA, as the data controller, is obliged to retain such data in accordance with generally applicable legal regulations. In other cases, the processing period is determined by the purpose of the processing or is specified by data protection legislation.

We process personal data in accordance with the purpose of processing for the periods specified below:

* USSPA is authorised to process your email address in accordance with Section 7(3) of Act No. 480/2004 Coll., on certain information society services and amending certain acts (the Act on Certain Information Society Services), as amended, for the purpose of sending commercial communications relating to its own products or services, provided that you have not opted out of receiving such communications.

If you do not wish to receive our commercial communications and offers, you may inform us of this at any time, for example by emailing gdpr@usspa.cz, and we will cease sending them immediately.

If you have expressed an interest in purchasing our product – for example, by asking us to send you a catalogue – we regard you as a potential customer and will process your personal data to the extent set out below.

Your personal data may be processed by USSPA, in particular, for the following purposes:

• Negotiating the conclusion of a contract (e.g. product selection and specification, preparation of contractual documentation);
• Sending commercial communications and offers;
• Compliance with other legal obligations (other legal obligations fulfilled by USSPA include, for example, the provision of information to public authorities).

Prior to the conclusion of the contract, USSPA is authorised to process the following personal data:

Personal data is processed by USSPA both manually and automatically.

USSPA may also process other data relating to its prospective customers that is provided by them, taking into account USSPA’s legitimate interests and the maintenance of good relations with prospective customers.

In the event of telephone communication with our sales representatives, please note that, if you give us your consent, these telephone calls may be monitored for the purpose of improving our services. A recording of such a call may be retained for a maximum of 6 months (longer only in exceptional cases relating to the resolution of a specific matter).

Personal data relating to third parties – meaning personal data that USSPA receives from a prospective customer in connection with negotiations to conclude a contract – will be processed in accordance with the applicable data protection legislation.

At USSPA, your personal data is made available only to authorised employees or to individual data processors and data controllers at USSPA, and only to the extent necessary to fulfil the specific purposes of processing.

A list of recipients of USSPA’s personal data is available at the end of this document. Under certain conditions, we are also authorised to disclose some of your personal data to public authorities in accordance with applicable legislation.

We process and store your personal data for as long as is strictly necessary to fulfil the purpose of the processing, i.e. whilst you are considering purchasing our product and entering into a contract.

The retention period for personal data for the purposes of sending marketing communications and offers for products and services is governed by applicable legislation. If you do not wish to receive our marketing communications and offers, you can let us know at any time, for example by emailing gdpr@usspa.cz, and we will stop sending them immediately.

If you call our service department’s helpline with a query regarding the operation of our equipment, a request for servicing, a complaint or any other matter, the call will be recorded. If you do not consent to your call being recorded, you can contact us by email or write to us at our postal address. You can find out below why we record calls and how long we retain the recordings.

Call recordings are processed primarily for the following purposes:

• To fulfil a contractual relationship or the caller’s request (for the purposes of proving legal action and protecting the rights of both USSPA and the caller);
• Legitimate interest (for the purpose of improving the quality of our services).

If you have entered into a contract with us in the course of your business, you are our Business Partner and we will process your personal data to the extent set out below. In the case of Business Partners that are legal entities, we process the personal data of the natural persons representing our Business Partner.

Your personal data may be processed by USSPA, in particular, for the following purposes:

• To fulfil a contractual relationship;
• Sending commercial communications and offers;
• Accounting and tax purposes (record-keeping in accordance with accounting and tax legislation);
• To fulfil other legal obligations (other legal obligations fulfilled by USSPA include, for example, the provision of information to public authorities).

USSPA is authorised to process the following personal data in accordance with the purpose for which it was obtained from individual data subjects:

Personal data is processed at USSPA both manually and automatically.

USSPA may also process further data concerning its Business Partners, or natural persons representing Business Partners, in the interests of USSPA’s legitimate interests, maintaining good business relations with Business Partners, streamlining business communication, and for the purposes of fulfilling the contractual relationship with Business Partners.

Personal data of third parties – meaning the personal data of employees and customers of USSPA’s business partners and other individuals involved in cooperation with USSPA, or any other data that USSPA receives from a business partner in connection with the conclusion or performance of a contract, will be processed in accordance with the applicable data protection legislation. USSPA will use this personal data for the purpose of fulfilling contracts with business partners. The business partner hereby acknowledges that USSPA will process the personal data of third parties for the duration of the contractual relationship and for a further period as specified by specific legal provisions, where such provisions exist. The data will be retained for a longer period if, in justified cases, there is a need to retain the data in connection with a specific case. The business partner is obliged to properly inform its employees, customers and other individuals involved on the business partner’s side in the cooperation with USSPA about the processing of personal data by USSPA.

At USSPA, your personal data is made available only to authorised employees or to individual data processors and data controllers at USSPA, and only to the extent necessary to fulfil the specific purposes of processing.

A list of recipients of USSPA’s personal data is available at the end of this document. Under certain conditions, we are also authorised to disclose some of your personal data to public authorities in accordance with applicable legislation.

We process and store your personal data for as long as is strictly necessary to fulfil all rights and obligations arising from the relevant contractual relationship, and for as long as USSPA, as the data controller, is required to retain such data under generally applicable legislation. In other cases, the duration of processing is determined by the purpose of the processing or is set out in data protection legislation.

We process personal data in accordance with the purpose of such processing for the periods set out below:

* USSPA is authorised to process your email address within the meaning of Section 7(3) of Act No. 480/2004 Coll., on certain information society services and amending certain acts (the Act on Certain Information Society Services), as amended, for the purpose of sending commercial communications relating to its own products or services, provided that you have not opted out of receiving such communications.

If you are interested in a job at USSPA and have therefore sent us your personal data, for example in the form of a CV, we will process this personal data.

Your personal data may be processed by USSPA for the following purposes:

• selecting a suitable candidate for a job vacancy;
• offering future job opportunities at USSPA.

USSPA is authorised to process the data provided by job applicants.
Personal data is processed by USSPA both manually and automatically.

At USSPA, your personal data is only made available to authorised USSPA staff, and only to the extent necessary to fulfil the specific purposes of processing.
Under certain circumstances, we are also authorised to disclose some of your personal data to public authorities in accordance with applicable legislation.

We process personal data in accordance with the purpose of such processing for the periods set out below:

You can find out about the processing of visitors’ personal data on our website at https://usspa.dev.portadesign.cz/cs/zpracovani-osobnich-udaju/cookies

Customers, prospective customers, business partners, job applicants and website visitors, as data subjects, have rights in relation to the processing of personal data which arise from legislation and which they may exercise at any time. These include the right (i) to access personal data, (ii) to have inaccurate personal data rectified and incomplete personal data completed, (iii) to erasure of personal data, where such data is no longer necessary for the purposes for which it was collected or otherwise processed, or where it is found to have been processed unlawfully, (iv) to restriction of the processing of personal data, (v) to data portability, (vi) the right to object, following which the processing of personal data will cease unless it is demonstrated that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, in particular where the purpose is the potential enforcement of legal claims; and (vii) the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

• Right of access to personal data: if you wish to know whether USSPA is processing personal data, you have the right to obtain information as to whether your personal data is being processed, and if so, you also have the right to access your personal data. In the event of unfounded, excessive or repeated requests, USSPA shall be entitled to charge a reasonable fee for a copy of the personal data provided or to refuse the request (the same applies mutatis mutandis to the exercise of the rights set out below).
• Right to rectify inaccurate and complete incomplete personal data: if you feel that USSPA is processing inaccurate or incomplete personal data about you, you have the right to request that it be rectified and completed. USSPA will rectify or complete the data without undue delay, subject, however, to technical feasibility.
• Right to erasure: should you request erasure, USSPA will erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for processing your personal data, or (iv) USSPA is under a legal obligation to erase the data.
• Right to restriction of processing: should you request a restriction on processing, USSPA will make your personal data inaccessible, temporarily delete or store it, or carry out other processing operations necessary for the proper exercise of the right you have exercised;
• Right to data portability: if you wish USSPA to transfer your personal data to a third party, you may exercise your right to data portability. Should the exercise of this right adversely affect the rights and freedoms of others, USSPA will not be able to comply with your request.
• Right to object: the right to object to the processing of personal data that is processed for the purposes of carrying out a task carried out in the public interest or in the exercise of official authority, or for the purposes of protecting USSPA’s legitimate interests. Should USSPA fail to demonstrate that there is a compelling legitimate ground for the processing which overrides the customer’s interests or rights and freedoms, it will cease the processing on the basis of the objection without undue delay.

To exercise your rights, please contact us at USSPA’s registered office or by email at gdpr@usspa.cz. USSPA reserves the right to verify the identity of the person exercising these rights in an appropriate manner.

Address:
Office for Personal Data
Protection, Pplk. Sochora 27
, 170 00 Prague 7
Data box: qkbaa2n
Email: posta@uoou.cz
Telephone: +420 234 665 111 (Switchboard)

In accordance with the Regulation, for the purposes of this Policy, the following definitions apply:

1. ‘controller’ means the entity which, alone or jointly with others, determines the purposes and means of the processing of personal data, or which is required to process personal data by applicable and effective legislation; for the purposes of this Policy, USSPA s.r.o. is deemed to be the controller;
2. ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
3. a data subject means an identified or identifiable natural person (not a legal person – a company or organisation);
4. a recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether a third party or not (with the exception of public authorities which may obtain personal data on the basis of applicable and effective legislation);
5. personal data means any information relating to an identified or identifiable natural person (data subject), in particular by reference to an identifier such as a name, date of birth, identification number, address and contact details, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; data which, on its own, does not relate to a natural person is also considered personal data, but which, when combined with other information, could be attributed (even if only potentially) to a specific natural person (e.g. the colour and make of a private car, as data relating to an object which, in itself, is not connected to a natural person);
6. special categories of personal data include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a natural person’s health, sex life or sexual orientation; data relating to criminal convictions are subject to special protection;
7. biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allows or confirms unique identification, such as facial images or dactyloscopic data;
8. ‘anonymous data’ means data which, either in its original form or following processing, cannot be related to an identified or identifiable data subject – it is therefore not personal data;
9. processing of personal data means any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of disclosure, alignment or combination, restriction, as well as erasure or destruction;
10. the collection of personal data means a systematic procedure or set of procedures aimed at obtaining personal data for the purpose of its subsequent storage on a data medium for immediate or subsequent processing;
11. ‘storage of personal data’ means the retention of data in a form that enables further processing;
12. disposal of personal data: the physical destruction of the medium on which it is stored, its physical erasure or its permanent exclusion from further processing; anonymisation is also a form of disposal of personal data;
13. anonymisation: an operation whereby identifiers used to identify a specific natural person are permanently deleted or disconnected;
14. pseudonymisation means the processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is stored separately and is subject to technical and organisational measures to ensure that it is not linked to an identified or identifiable natural person; once the additional information has been re-associated, it is possible to re-identify a specific natural person;
15. ‘profiling’ means any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning, for example, that person’s work performance, economic situation, state of health, personal preferences, interests, reliability, behaviour, location or movements, etc.;
16. ‘consent of the data subject’ means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of his or her personal data;
17. database/register: any structured set of personal data accessible according to specific criteria, whether centralised, decentralised, or organised by functional or geographical criteria;
18. a personal data breach (a ‘Data Breach’) means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The Personal Data Processing Policy (hereinafter referred to as the “Policy”) is effective from 1 September 2025.

• H.R.G. spol. s r.o. – a company responsible for the printing and distribution of the magazine Bublinky (applies to Customers only)
• solicitor – as required
• auditor
• external accountant
• IT suppliers
• Occupational health doctor