Privacy Policy

When protecting personal data, employees of IBR Consulting, s.r.o. comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, and with the internal Guidelines for Ensuring the Protection of Personal Data at IBR Consulting, s.r.o.

The General Data Protection Regulation is available here, and the Guidelines for Ensuring Personal Data Protection at IBR Consulting, s.r.o. are as follows:

Security Policy, available here,

Policy No. 1 on Personal Data Protection, available here,

Appendix No. 1 – Additional Authorized Persons, available here,

Policy No. 2 on Retention of Impact Assessment Reports without a DPO, available here.

Controller of Your Personal Data

The controller of your personal data is IBR Consulting, s.r.o., with its registered office at Sokolovská 352/215, Prague 9, 190 00, ID No.: 25023446, registered with the Municipal Court in Prague under file number C 235748 (hereinafter also “We”).

The Data Protection Officer is Jan Fikar (e-mail:gdpr@ibrconsulting.cz).

The controller collects and processes your personal data and is responsible for its proper and lawful processing.

Basic Information on the Processing of Personal Data

To provide a clearer overview of the data processed, IBR Consulting, s.r.o. has prepared a comprehensive table listing all activities involving the processing of personal data. It includes information on the purpose of processing, the scope of the personal data processed, the legal basis for processing, and the recipients or categories of recipients of personal data. It also lists the sources of personal data, the period for which the personal data will be stored, the storage location, and, where applicable, the recipients of the personal data. The table of personal data processed by IBR Consulting, s.r.o. is available here.

As a general rule, IBR Consulting, s.r.o. does not transfer personal data to third countries or international organizations.

As a general rule, IBR Consulting, s.r.o. does not process personal data using automated decision-making, including profiling.

If IBR Consulting, s.r.o. intends to process personal data for a purpose other than the one for which it was collected, it will provide the data subject with information about this other purpose prior to such further processing, or, if necessary, request the data subject’s consent if such consent is required for the processing of personal data.

IBR Consulting, s.r.o. documents and records all personal data breaches, including the facts relating to the breach, its effects, and the corrective measures taken. If such a security breach results in a high risk to the rights and freedoms of natural persons, IBR Consulting, s.r.o. will notify the data subject and the Office for Personal Data Protection without undue delay.

If IBR Consulting, s.r.o. processes your personal data based on its legitimate interest, you have the right to object to IBR Consulting, s.r.o. at any time (e-mail:gdpr@ibrconsulting.cz).

In accordance with internal regulations, personal data is subject to physical, electronic, and procedural controls. All persons who process or come into contact with your personal data are trained and bound by a duty of confidentiality.

Processing of Website Users’ Personal Data

IBR Consulting, s.r.o., with its registered office at Sokolovská 352/215, Prague 9, 190 00, ID No.: 25023446, registered with the Municipal Court in Prague under file number C 235748 (hereinafter also “We”), as the data controller, hereby informs you, as a user of the websites www.aspe.cz and www.ibrconsulting.cz, about the processing of personal data and privacy policies described below.

If you need clarification on any part of this text, advice, or wish to discuss the further processing of your personal data, you may contact us at any time at gdpr@ibrconsulting.cz.

Processing of Children’s Personal Data

Our websites are not intended for persons under the age of 16. We do not process the personal data of persons under the age of 16.

Scope of Personal Data Processing

When you contact us through our website, you may be asked to provide certain information about yourself or your company. This information may include, in particular:

Your first and last name,

business name,

address or registered office,

identification number and tax identification number,

phone number, or

email address.

We do not track you on our website, so we only receive the personal data that you explicitly provide to us.

Cookies

We track the activity and behavior of users on our website using cookies, specifically:

# Cookie Name Function/Purpose

1 Google Analytics third-party cookies tracking website traffic and user behavior

2 ASPE application administration cookies – Comments/Edits, Trilobit for newsletter distribution maintaining the user’s session (ID)

3 ASPE application administration cookies – Comments/Edits, Trilobit for newsletter distribution User interface settings (e.g., sorting tables and setting filters)

Purpose of Personal Data Processing

We use the data you provide to us to contact you and provide you with the information you have requested, or to fulfill our obligations, i.e., primarily to provide software customer support (an overview of all processed data is provided in the Table of Processed Data and is available here). All personal data is processed in a lawful and transparent manner, and only data that is adequate, relevant, and necessary in relation to the purpose of processing is collected.

In addition, we may use your first name, last name, and email address to send you marketing communications—that is, to inform you about events, publications, offerings, or services we provide that we believe may be of interest to you. Providing personal data for the purpose of fulfilling a contract and providing personal data for the purpose of responding to your inquiries or providing the information you have requested are contractual requirements on our part, and failure to provide such data may result in the contract not being concluded or your inquiries not being answered.

In addition, you may opt out of the processing of your personal data for the purpose of sending commercial communications at any time, and this will not affect our other mutual relationships. Simply send us an email with the relevant request to gdpr@ibrconsulting.cz.

Who Has Access to Your Personal Data

We, as the data controller, will process your personal data. We may transfer your personal data to our subcontractors for the purposes stated above so that they may process it on our behalf. An overview of internal and external processors is provided in the Data Processing Table and is available here.

Duration of Personal Data Processing

We will process your personal data for as long as we provide our services to you or fulfill our mutual contract, or for as long as necessary to comply with archiving obligations under applicable laws, such as the Accounting Act, the Archiving and Records Act, or the Value-Added Tax Act. An overview of the duration of personal data processing is provided in the Table of Processed Data and is available here.

Your Rights Regarding the Processing of Personal Data

In relation to our processing of your personal data, you have the following rights:

the right of access to personal data,

the right to rectification,

the right to erasure (“right to be forgotten”),

the right to restrict processing,

the right to object to processing, and

the right to lodge a complaint regarding the processing of personal data.

Your rights are explained below so that you can gain a clearer understanding of what they entail.

The right of access means that you may at any time request confirmation from us as to whether or not personal data concerning you is being processed, and if so, for what purposes, to what extent, to whom it is disclosed, how long we will process it, whether you have the right to rectification, erasure, restriction of processing, or to object; where we obtained the personal data; and whether automated decision-making, including profiling, is taking place based on the processing of your personal data. You also have the right to obtain a copy of your personal data; the first copy is provided free of charge, but for subsequent copies, the Data Processor may request reasonable reimbursement of administrative costs.

The right to rectification means that you may ask us at any time to correct or complete your personal data if it is inaccurate or incomplete.

The right to erasure means that we must erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) we are required to do so by law.

The right to restriction of processing means that, until we resolve any disputes regarding the processing of your personal data, we must restrict the processing of your personal data so that we may only store it and, if necessary, use it for the purpose of establishing, exercising, or defending legal claims.

The right to object means that you may object to the processing of your personal data that we process for direct marketing purposes or on the basis of a legitimate interest. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

You may exercise all of your rights by contacting us at gdpr@ibrconsulting.cz.

You may file a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).

This Privacy Policy is effective as of May 25, 2018.