Principles of Personal Data Protection
We, ALBI Česká republika a.s., company ID No.: 497 08 368, with the registered office at Thámova 289/13, 186 00 Praha 8, entered in the Commercial Register kept by the Municipal Court in Prague, section B, entry 7943 (hereinafter referred to as “ALBI“), do appreciate your trust very much.
You will find out in these principles, how we process your personal data, which we obtain in connection with a visit to the websites operated by ALBI (www.albi.cz; www.albi.eu; eshop.albi.cz; kouzelnecteni.cz; kvido.cz; prani.albi.cz; antoninovopekarstvi.cz; play.albi.cz; skolashrou.cz), in connection with your participation in our loyalty clubs (ALBI Club, ALBI Club for Schools, and ALBI Club of Board Game Fans), in connection with a visit to our brick-and-mortar stores ALBI and Antonín´s Bakery, as well as with some other cases of personal data processing.
These Principles apply to the processing of your personal data as customers, members of our loyalty clubs, those interested in our goods and services, and visitors to our websites, always in the scope of personal data corresponding to your position towards us.
We process all personal data in accordance with the law and we place great emphasis on their safe storage.
CONTROLLER OF YOUR PERSONAL DATA
Company Name: ALBI Česká republika, a.s.Company ID No.: 497 08 368
Registered office: Thámova 289/13, 186 00 Praha 8
Registration in CR: company entered in the Commercial Register kept by Prague Municipal Court, section B, entry 7943
You may contact us at any time by e‑mail at the address gdpr@albi.cz or by a letter sent to the address of the company´s registered office.
PROCESSING OF PERSONAL DATA FOR SENDING NEWSLETTER AND ADVERTISING MESSAGES
If a visitor of our website or a member of one of our loyalty programs is interested in receiving the newsletter and other advertising messages, we process the personal data provided by you for these purposes based on your consent, always at least to the extent of the e-mail address. If you also provide us with your identification data (first name, surname, date of birth), we will process these data for the stated purposes as well. The advertising messages we send you always concern only our own services.If we obtain your consent to the processing in paper form, we will only start processing your personal data after you have filled in and signed the registration form for our loyalty club. We will store the consent in paper form and at the same time we will enter the data from it into our electronic database. If we obtain your consent to processing in electronic form, we will only start processing your personal data after you have filled in your data in the relevant form for sending newsletters and other advertising messages and then confirm your wish to receive the newsletter according to the instructions in the e-mail you receive from us. If you do not confirm your wish to receive the newsletter, we will destroy your data without undue delay.
Your personal data will be processed until the consent has been withdrawn. After this period, we will only process them if required by special legislation or if necessary to protect our legal claims.
You give us consent to this processing of personal data voluntarily and you can withdraw it at any time, either by sending a notice of withdrawal of consent in writing to the address of our registered office, or by clicking on the relevant link in the sent newsletter or advertising message.
If you become our customer, for example you buy something from us in our e-shop, we may use your contact details for the purpose of sending the newsletter, although special consent would be required by law, and that on the basis the so-called legitimate interest. In this case as well, you can of course inform us at any time that you do not wish to receive further advertising messages, and in such case we will no longer send you these messages.
However, not every message you receive from us is a commercial message. Sometimes we need to communicate with you in connection with provision of a certain type of services and with a large number of recipients, this cannot be done other than by sending a bulk e-mail. Within the framework of this communication, therefore, some messages sent are not commercial communications (e.g. notification of a change in trade terms and conditions or a request to update your personal data).
PROCESSING OF PERSONAL DATA IN CONNECTION WITH PURCHASE OF GOODS IN THE E-SHOP
In the case of purchasing goods in eshop.albi.cz, we will process your personal data to the extent of first name, surname, date of birth, residential address, delivery address, e-mail address, telephone contact, information about the purchased goods and their price. If you are a legal entity or a natural person doing business, we will also process information about your company name, ID number, VAT number, registered office or business address, billing address, identification data of your representative or other contact person, and bank account number and bank code.The processing of these personal data is a necessary precondition for the performance of the contract and it is, therefore, a processing that does not require your consent.
We will process your data for the purpose of implementation of a concluded purchase contract, delivery of the ordered goods, and also for the purpose of protecting the rights and legally protected interests of protection against possible litigations arising from concluded purchase contracts. We will process these data in our customer database for a period of 4 years after the expiration of the warranty period for the goods. After this period, we will only process them if required by special legislation or if necessary for other legal reasons.
If we deliver the ordered goods to the address specified in the order, we will also provide your personal data to the extent of first name, surname, telephone contact, and address for delivery of the goods to the relevant carrier.
In the event you withdraw from the purchase contract, we will also process your bank account number, which you will provide to us for the purpose of settling our mutual obligations. We will only process these personal data provided for the time necessary to refund the money and to prove that the amount paid has actually been refunded to you, but no longer than during the limitation period resulting from generally binding legal regulations. The provision of this personal data is necessary for the settlement of our mutual obligations in the event of withdrawal from the contract, and therefore, it is a processing that does not require your consent.
We want to constantly improve our goods and services, therefore, we will continue to process your e-mail address, also to verify your satisfaction with the purchase. This processing is necessary for the purpose of protecting our legitimate interests in providing feedback on the progress of your purchase, and therefore, consent is not required by law. We survey your satisfaction with the purchase via e-mail questionnaires within the Verified by Customers program, in which our e-shop is involved. We send them to you each time you have purchased from us, unless, within the meaning of Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services, you refuse receiving our commercial communications or withdraw your previously given consent. The sent questionnaire, thus, constitutes a commercial communication in the sense of the cited law. For sending questionnaires, evaluating your feedback, and analyses of our market position, we use a processor, which is the operator of Heureka.cz portal, Heureka Shopping s.r.o., company ID No.: 023 87 727, with the registered office at Karolinská 650/1, Karlín, 186 00 Praha 8; for these purposes, we can transmit to the company the information about the goods purchased and your e-mail address.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE PROCESSING OF SUGGESTIONS, INQUIRIES, AND COMPLAINTS
We are open to your suggestions, inquiries, and requests, and therefore, you may contact us at any time by phone, e-mail, via social networks, or per post.For the processing of your requests and answering your inquiries, we process personal data you have provided to us on a voluntary basis, however, only to the extent necessary and only until your inquiry or request has been processed, unless a need arises to process personal data for another purpose. Without those personal data, we would not be able to respond to your inquiry or request, and therefore, your consent to processing in this case is not required.
If the subject of your request is a complaint for goods, we will also process your personal data for the purpose of settling such a complaint. Your personal data will be processed in this context due to compliance with contractual and legal obligations and in order to document the course and settlement of the complaint for the protection of rights and legally protected interests. Your consent to this processing is therefore not required. The time and extent of processing personal data for the purpose of handling a complaint depends on our obligation to handle the complaint.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE USER ACCOUNT ON ESHOP.ALBI.CZ WEBSITE
In case you create a user account in our e-shop, we will process the personal data provided, usually to the extent of name and surname, address of residence, delivery address, e-mail address, telephone number, and identification details to the account, if you are a legal entity or a natural person doing business, we will also process data on your company name, ID number, VAT number, address of registered office or place of business, billing address, identification data of your representative or other contact person, and that for the exercise of the rights and obligations of the purchase contract and creation and management of your user account. This is processing not requiring your consent. For these purposes, we also process the history of your orders and information about the history of payments and payment options.We will only process the provided personal data for as long as your user account is active. After this period, we will only process them if required by special legislation or if necessary for other legal reasons.
SENDING NOTIFICATIONS OF GOODS IN STOCK (PRODUCT MONITORING FUNCTION)
In the event you wish to be informed about the availability of goods in our e-shop, we will process the following personal data in order to provide the “Monitor Product” service: e-mail address and monitored goods. The legal basis for the processing of personal data is Article 6 (1)(b) of the GDPR (General Data Protection Regulation), thus, the processing necessary for the performance of the contract. For the above purpose, we will process your personal data for the period necessary to fulfil the “Monitor Product” function, i.e. until the notification of restocking of the goods is sent to the e-mail address of your choice.PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE USER ACCOUNT ON PRANI.ALBI.CZ WEBSITE
In the event you create a user account on our website prani.albi.cz, we will process the personal data provided, always at least to the extent of name and surname, e-mail address, date of birth, city, and account identification details, for the purposes of creating and managing your user account.We perform this processing for the purposes of exercising the rights and obligations under the contract and for the purposes of maintaining your user account and this is processing that does not require your consent.
We will only process the provided personal data for as long as your user account is active. After this period, we will only process them if required by special legislation or if necessary to protect legal claims.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE USE OF SERVICES ON PRANI.ALBI.CZ WEBSITE WITHOUT CREATING A USER ACCOUNT
If you use the e-greeting-card service on prani.albi.cz website without creating a user account, we will process personal data to the extent of the recipient´s e-mail address, the sender´s e-mail address, or first and surname, if you provide us with these data, for the purpose of sending and delivering your greeting card.We perform this processing for the purposes of exercising the rights and obligations under the contract and this is processing that does not require your consent.
We will process the personal data provided only for the period strictly necessary to ensure that your greeting card has been sent, delivered, and made available to the addressee, but for a maximum period of 5 years from the date of dispatch of the greeting card. After this period, we will only process them if required by special legislation or if necessary, to protect legal claims.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH LOYALTY CLUB MEMBERSHIP
We are currently running a loyalty programs Albi Club, Albi Club for the Schools, and Club of Board Game Fans.If you want to become a member of one of these loyalty clubs, we will ask you for your consent to the processing of your personal data. We will process your personal information provided in the registration form to the loyalty club (for the Albi Club it is the name and surname, date of birth, address, e-mail and telephone; for the Albi Club for Schools and the Albi Club of Board Game Fans it is the name and surname, e-mail and telephone number of the registrant or contact person) and data related to the membership in the Albi Club, in particular, account identification details, data on purchase history, and data on the use of loyalty program benefits.
You provide us with the data for the purpose of operating a loyalty program, inclusion in the database of members of the loyalty club and your participation in it. If you give us special consent, we will also process the data for the purpose of sending marketing offers and messages. We will process personal data for the duration of your loyalty club membership. You may withdraw your consent to the processing of data at any time. However, by the withdrawal of your consent to the processing of any of the mandatory data completed, your membership in the loyalty program will expire.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH ORDERING GOODS AT ANTONÍN´S BAKERY
At Antonín´s Bakery, we accept orders for your favourite bread or other pieces from our menu. In such a case, we process your name and surname and telephone number, for the purposes of the order execution, in order to fulfil the obligations under the contract. Therefore, this processing does not require your consent. We only process these data until your order has been processed and we will destroy them immediately thereafter.PROCESSING OF PERSONAL DATA IN CONNECTION WITH INTERNAL RESEARCH
If you sign up for internal market and customer experience research by filling in the form, we will process the provided personal data, always usually to the extent of e-mail, telephone number, and age range exclusively for the purposes of this and other researches of Albi Česká republika a.s. (selection of persons for individual research projects, statistical classification, mutual communication), for a period of 2 years.You may withdraw your consent to the processing of the personal data above at any time. The results of the research are processed anonymously and serve for the internal purposes of Albi Česká republika a.s.
PROCESSING OF PERSONAL DATA IN CONNECTION WITH PARTICIPATION IN COMPETITIONS
We also process your data if you participate in any of our competitions, and that to the extent of the information provided by you, most often the name, surname, e-mail, telephone number and delivery address and the information provided in the framework of the competition entry. We process your personal data for the purpose of communicating with you, finding out your identification, and selection of competition winners and awarding prizes. We process these personal data on the basis of the provided consent granted within the competition and further on the basis of legitimate interest, when the processing is necessary to fulfil your and our interest to organise the competition, respectively to participate in it. We process these data only for the period necessary to evaluate the competition and deliver the prizes, unless a longer period for their retention arises from legal regulations.DATA PROCESSING IN CONNECTION WITH VISITS TO OUR STORES
Our Albi brick-and-mortar stores as well as Antonín´s Bakery stores are guarded by CCTV systems. We locate cameras in those places to protect our legitimate interests, which are damage prevention and property protection. The operation of camera systems is provided for us by the company NetRex s.r.o. Only our authorised employees and authorised employees of the processor have access to the records and servers on which these records are stored. The areas where our cameras are located are always properly marked. The CCTV footage from our stores and the surrounding area is processed for a maximum of 90 days from the date of their acquisition.DATA PROCESSING IN CONNECTION WITH VISITS TO OUR WEBSITES
In connection with the browsing of our websites, we process log files on access to these websites, namely: website from where you go to us, IP-address, date and time of access, information about your browser and operating system. We process these data in order to protect our legitimate interests in ensuring the protection of the website and improving its functioning. No consent is required by law to process these log files. These files are stored for 1 month from the visit to the website.USE OF COOKIES
In order to improve the functioning of our websites and to optimize our marketing activities, we use Cookies on our websites. A cookie is a small file that a website stores on your hard disc. The information obtained may include the IP address of the connecting computer or the type of browser used. Cookies are used to distinguish individual users accessing our website and do not allow, without further, personal identification of the website users.More detailed information on Cookies can be found here.
If you do not agree with the collection of Cookies, you can disable their use in your browser settings.
GOOGLE ANALYTICS
To analyse the websites using Cookies, we use Google Analytics service provided by Google Inc., with the registered office at Amphitheatre Parkway, Mountain View, CA 94043, USA. Prior to transferring the data to this company, we strictly anonymize personal data and we only transfer to this company for analysis the abbreviated IP addresses, on the basis of which it is not possible to identify specific persons.You can prevent the collection of Cookies and Google Analytics analysis, for example, by changing your browser settings or by installing a special plugin into your browser.
As part of Google Analytics, we also use other Google services, such as reporting anonymous demographic data (e.g., age, gender, interests) or Google AdWords service to personalize advertising and improve advertising targeting. You can turn off or edit ads personalization through your Google Account.
USE OF SOCIAL PLUGINS
Our website contains third-party social plugins namely plugin of Facebook network, which is managed by Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA; plugin of YouTube service, managed by YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA; and plugin of Instagram service, managed by Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Thanks to these plugins, you can share content with other people. We do not manage these social plugins, so we are not responsible for the possible processing of your personal data by the above-mentioned operators of these plugins, who are in the position of personal data controllers towards you.TRANSMISSION OF YOUR PERSONAL DATA
In fulfilling our obligations and responsibilities and providing our services, we use professional and specialised services of other entities. If these suppliers process the personal data that we pass on to them, they have the status of personal data processors. Most often, we transfer your personal data to companies providing distribution and transport of goods (logistics companies), technical and IT support or activities of experts, lawyers, and auditors.We always transfer your personal data to these processors only to the extent necessary for the purposes of processing and solely for the purpose of providing our services. We select only such persons as a specific processor who provide us with maximum guarantees on the technical and organizational security of the transferred personal data. We have concluded contracts with all processors and none of our processors is entitled to use the provided personal data for their own, marketing or any other purposes. Processors are companies domiciled both in the Czech Republic and domiciled in a Member State of the European Union or the so-called safe states. The transfer and processing of personal data in countries outside the European Union always takes place in accordance with applicable legislation.
The current list of our processors and suppliers can be found here.
On request, we are also obliged to provide your personal data to state authorities and bodies (e.g. the Police of the Czech Republic, state authorities in the framework of performed inspections, etc.). We do this because it is our legal obligation.
METHOD OF THE PROCESSING OF PERSONAL DATA
We process your personal data both automatically and manually and keep records of processing activities. In the processing of personal data by our company, there is no decision-making based solely on automated processing without human assessment, which would have legal effects or would otherwise significantly affect data subjects whose personal data we process.PROTECTION OF YOUR DATA
At ALBI, we take all technical and organizational measures to secure the protection of personal data and to exclude the possibility of unauthorised or accidental access to the personal data, their alteration, destruction or loss, unauthorised transfers, their other unauthorised processing, as well as other misuse of personal data. We comply with all obligations imposed on us by generally binding legal regulations in the field of personal data protection.We use modern security and control mechanisms, ensuring the maximum possible data protection. All persons who come into contact with personal data in the course of fulfilling their work or contractual obligations are bound by legal or contractual obligation of confidentiality.
RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
We process your data in a transparent manner, which means that you always know the purpose for which you provide us with your data.In connection with the processing of personal data, you have the following rights relating to the processing of personal data, which we fully respect:
- the right of access to personal data: you have the right, if you comply with the legal conditions, to receive information from us free of charge at your request, whether your personal data are being processed or not, and if so, you have the right to gain access to these personal data. Upon request, we will always provide you with all the information on the processing of personal data, where we are in the position of personal data controller.
- the right to rectification of personal data processed: if you find that your personal data are being processed inaccurately or incorrectly, please let us know and we will correct them immediately.
- the right to erasure of personal data processed: if the purpose for which we process personal data ceases to exist, we will automatically anonymize or destroy your personal data. If we process personal data on you based on your consent, and you withdraw your consent, we will erase your personal data. However, the right to erasure is not absolute, and if we have an objective obligation to retain the data (e.g. bookkeeping), only those personal data that are no longer needed for the original purposes of processing will be erased.
- the right to restriction of personal data processing: you have the right to restrict our processing of personal data if: a) you deny the accuracy of your personal data and that for the time necessary to verify the accuracy of your personal data; or b) the processing is unlawful and you refuse to erase the personal data and require instead to restrict their use; or c) we no longer need personal data for the purposes of processing, but you require them from us to determine, exercise, or defend your legal claims; or d) you have raised an objection to the processing until it is verified whether our legitimate reasons outweigh your legitimate reasons.
- the right to portability of personal data: if we process your personal data in an automated manner on the basis of your consent or contract, you have the right to a copy of your personal data that you have provided to us in a structured, commonly used and machine-readable format to be delivered to you or to another person.
- the right to withdraw the consent to the processing of personal data at any time, if consent is the legal basis for the relevant processing of personal data.
- the right to object: if you fulfil the preconditions laid down by legal regulations, you also have the right to raise an objection to the processing of your personal data, if the legal basis of the processing is our legitimate interests.
In matters of your rights, you can contact us as the controller of the personal data with an inquiry or complaint, in writing by ordinary mail or e-mail to the address gdpr@albi.cz. You can also address your complaint to the supervisory body, which is the Office for Personal Data Protection, with the registered office at Pplk. Sochora 27, 170 00 Praha 7.
DATA PROTECTION OFFICER
ALBI is not obliged to appoint and has not appointed a data protection officer.EFECTIVENESS
These principles of personal data protection on visit to the websites enter into effect from 25 May 2018 and are available on-line on our website or on demand in our brick-and-mortar stores.Should the need arise to update these Principles of Personal Data Protection, we will notify you of any material changes.
