I. Basic provisions
The controller of personal data pursuant to Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”) is GS1 Czech Republic, registered office at Na Pankráci 1618/30, Post Code: 140 00, Prague 4, Company ID No: 60433591 (hereinafter “GS1” or the “Controller”).
GS1 greatly emphasizes the transparency of processing and securing your personal data, which are considered strictly confidential, and handles them in accordance with the GDPR, act no. 110/2019 Coll., on personal data processing and other valid legal regulations concerning personal data protection.
GS1 values your trust and therefore, in accordance with the principle of transparency, it informs you by means of this document (hereinafter “Privacy Policy”) about the processing of your personal data, which are needed for the purposes specified below.
This Privacy Policy applies to the www.synfony.cz website (hereinafter “Website”).
GS1 in the scope of this Website can process the personal data which is obtain from future clients of e-catalogue SYNFONY, users of e-catalogue SYNFONY, contact persons via contact form or e-mail and visitors of this website.
II. Purposes of personal data processing and their legal grounds
1. Demand and supply of services (e-catalogue SYNFONY)
GS1 is a provider of a certified electronic GDSN catalogue, which is used to share product data between the supplier and the customer. In order to gain access and use the services associated with this e-catalogue, it is necessary to have a valid GLN (Global Location Number) and contact GS1 via the inquiry form on the Website. After concluding the contract, the user will receive login details and a brief package with additional information.
The purpose of processing personal data is to implement and perform the contractual relationship, i.e. evaluation of the sent demand via the inquiry form and using the e-catalogue SYNFONY, exercise the rights and obligations arising from the contractual relationship and other contractual obligations. The legal ground for processing personal data is Art. 6(1)(b) GDPR, i.e. processing is necessary for the performance of a contract and to implement the measures adopted before concluding the contract on request of data subject.
In the inquiry form there are just personal data which are necessary for successful cooperation and supply the services. These personal data are a necessary requirement for the conclusion of the contract and its performance, without the provision of personal data it is not possible to conclude the contract or perform it by GS1.
GS1 collects the following data for the aforementioned purpose:
Company details, payment details, account details
Information about contact person for e-catalogue (name, surname, work position, telephone number, e-mail address)
Information about signing person (name, surname, work position, telephone number, e-mail address, company)
Information for create the access to the e-catalogue (name, surname, title, work position, telephone number, e-mail address)
Login details (e-mail address, password)
Necessary communication between the future customer/user and GS1
2. Fulfilment of legal obligations within the accounting, tax and evidence agenda
We process accounting documents, data about your payments and other information required by law for the fulfilment of our legal obligations, i.e. Art. 6(1)(c) GDPR.
3. Communication with the inquirers
If you contact GS1 via contact form or e-mail address, information about your contact will be processed only for the purpose of the established communication with you.
GS1 collects the following data for the aforementioned purpose:
Identification data (name, surname)
Contact data (e-mail address, telephone number)
Necessary communication between you and GS1
4. Sending commercial messages
In the inquiry form, you can grand your consent with personal data processing for sending offers of additional services or an invitation to one of our events, or the latest news in the industry on your e-mail address. The legal ground for processing personal data is your consent in accordance with Art. 6(1)(a) GDPR. If you do not wish to receive this information, reply to our e-mail or inform us of this fact by other means and we will accommodate your request.
GS1 collects the following data for the aforementioned purpose:
Identification data (name, surname)
Contact data (e-mail address)
Our customers/users, GS1 may contact them with an offer of similar events, inform them about ongoing events or otherwise contact them via the e-mail address provided in the inquiry form or other document, based on the Controller’s legitimate interest in developing its activity in accordance with Section 7(3) of Act No. 480/2004 Coll., on certain information society services. If the participant does not wish to receive such electronic messages, they may unsubscribe via every sent electronic message, or contact the GS1 via other means.
III. Period of storing personal data
We process and store your personal data for the period strictly necessary to ensure all the rights and obligations arising from the respective contractual relationship, and furthermore for the period for which GS1 as the controller of personal data is obliged to store the personal data pursuant to generally binding legal regulations. In other cases, the period of processing arises from the purpose of processing or is stipulated.
GS1 stores personal data:
- for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and GS1, and to apply any claims from these contractual relationships (for a period of 5 years from termination of the contractual relationship);
- for a period of 1 year from the end of mutual interaction as concerns personal data processed for the purpose of answering your inquiry;
- for the period stipulated by the respective laws in cases where we perform our legal obligation; in the case of accounting management, this period may be up to 10 years;
- until the withdrawal of consent by the data subject as concerns personal data processing based on consent from the data subject, but maximally for 5 years from granting consent;
After the passing of the storage period, the controller liquidates the personal data.
IV. Transfer of personal data
GS1 is authorised to hand over your personal data in the scope required to conduct and perform the contract and fulfil other obligations (provider of application and other persons who are cooperating with GS1). GS1 also hands over the personal data to parties providing services related to the operation and administration of the Website, and potential other suppliers of technologies and providers of marketing services. Personal data are always handed over to third parties in compliance with the respective legal regulations, whilst observing the highest standard of personal data protection, which requires the due preservation of data subjects’ rights and protection of their privacy. Whole list of these partners is available on your request.
GS1 also hands over personal data when fulfilling legal obligations (e.g. at the request of the Czech Police) or when defending its rights.
GS1 does not provide the personal data outside of the EU, the EEA or to international organisations.
V. Your rights
You have the following rights in connection to personal data processing:
1. Right of access to the personal data
In connection to the processing of personal data, you have the right to the provision of information and provision of a copy of your processed personal data based on your request. In the case of a repeated request, GS1 is authorised to bill a reasonable fee for the copy of the provided personal data. We will inform you of such procedure.
2. Right to rectification
If you believe that your personal data, which we process, are inaccurate, outdated or otherwise incorrect, contact us and we will rectify them. We will perform rectification without undue delay, but always with respect to technical capacities.
3. Right to erasure
If the personal data are no longer required to ensure the stipulated purpose, or if you withdraw your consent to processing, we shall erase these personal data at your request. In some cases, however, your right may be restricted. For instance, the personal data we process based on our legal obligations cannot be erased before the passing of the lawfully stipulated archiving periods.
4. Right to restriction of processing
You have the right to restriction of processing if:
- the personal data which we process is inaccurate;
- the processing is illegal;
- the personal data are no longer required, but you need them do determine, exercise or defend a legal claim;
- you object to processing.
Your personal data will only be stored with us during the restriction period and no operations will be performed with them without your consent. Restriction of processing lasts for the period for which one of the above situations lasts. You will be informed about the potential termination of restriction.
5. Right to object
You may file a justified objection to processing based on a legitimate interest and for direct marketing. The justification of the objection will be assessed and you will be informed of the decision via your chosen contact channel.
6. Right to data portability
If you want GS1 to hand over your personal data to a third party, you may exercise your right to personal data portability. If the rights and freedoms of third parties were to be affected by the exercising of this right, GS1 will not be able to accommodate your request.
7. Right to be exempted from automated decision-making including profiling
We do not conduct automated decision-making including profiling without our activity.
8. Right to withdraw consent to personal data processing
If personal data is processed based on your consent, you may withdraw this consent at any time. If you wish to do so, contact us with your request via the contact details.
9. Right to complain to the supervisory authority
If you feel that your personal data are not handled pursuant to the law, you have the right to direct your justified complaint to the Office for Personal Data Protection, registered office at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.
When exercising your rights, contact us using the contact details via e-mail at synfony@gs1cz.org. GS1 reserves the right to reasonably verify the identity of the data subject applying the above rights.
VI. Final provisions
The data subject (future customer / user / inquirer) acknowledges that he is obliged to state his personal data accurately and truthfully and that he is obliged to inform GS1 without undue delay of any change in his personal data.
By sending an electronic form on the Website, you acknowledge that you are familiar with the Privacy Policy and that you accept and agree to them in full.
This Privacy Policy was updated on November 1, 2020.