Terms of personal data protection

I. Basic Provisions

1. The controller of personal data under Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and the Council (hereinafter “GDPR”) is GASTRO HOLDING CANDOLA s.r.o., Company ID 24820041, registered at Králodvorská 1086/14, Staré Město, 110 00 Praha 1 (hereinafter “controller”).

2. Controller’s contact details:
Address: U Továren 256, 102 00 Praha 15 – Hostivař
E‑mail: info@candola.cz
Phone: +420 283 853 242

3. Personal data means any information relating to an identified or identifiable natural person.

4. The controller has not appointed a Data Protection Officer.

II. Sources and Categories of Processed Data

1. The controller processes personal data you have provided or data obtained while fulfilling your order.

2. The controller processes identification and contact data and data necessary for fulfilling the contract.

III. Legal Basis and Purpose of Processing

1. The legal basis for processing is:
– performance of a contract under Article 6(1)(b) GDPR,
– the controller’s legitimate interest in direct marketing under Article 6(1)(f) GDPR,
– your consent for marketing purposes under Article 6(1)(a) GDPR in connection with Section 7(2) of Act No. 480/2004 Sb.

2. The purpose of processing is:
– processing your order and exercising rights and obligations arising from the contract,
– sending commercial communications and conducting marketing activities.

3. The controller does not carry out automated individual decision‑making under Article 22 GDPR.

IV. Data Retention Period

1. The controller retains personal data:
– for the period necessary to exercise rights and obligations arising from the contract,
– for the duration of consent, if the data is processed on the basis of consent.

V. Recipients of Personal Data

1. Recipients of personal data include:
– persons involved in delivering goods, services and processing payments,
– providers of services related to operating the Candola and Ancap e‑shops,
– providers of marketing services.

2. The controller does not intend to transfer personal data to third countries.
If the controller uses mailing or cloud service providers located outside the EU, data may be transferred in accordance with GDPR.

VI. Your Rights

1. Under GDPR, you have the right:
– to access your personal data (Article 15),
– to rectification (Article 16) or restriction of processing (Article 18),
– to erasure (Article 17),
– to object to processing (Article 21),
– to data portability (Article 20),
– to withdraw consent to processing.

2. You have the right to lodge a complaint with the Office for Personal Data Protection.

VII. Security of Personal Data

1. The controller has adopted appropriate technical and organisational measures to secure personal data.

2. The controller has secured data storage systems containing personal data.

3. Only authorised persons have access to personal data.

VIII. Final Provisions

1. By submitting an order, you confirm that you have read and accept these conditions.

2. You give consent to these personal data protection conditions by ticking the appropriate field in the form.

3. The controller is entitled to amend these conditions. The new version will be published on the controller’s website and sent to your e‑mail address.

These conditions take effect on 25 May 2018.