processing of personal data

internal data protection regulation

ENERGYLOW Plus s.r.o.,
with registered office at Jiráskova 701, 755 01 Vsetín,
registration number: 640 84 701,
registered in the Commercial Register maintained by the Regional Court in Ostrava, Section C, Insert 8627,
represented by Ing. Karel Zubek, managing director,
(hereinafter referred to as "employer" or "administrator"),
issues an internal regulation for the protection of personal data in the following wording:

Preamble

This Internal Data Protection Regulation (hereinafter referred to as the "Internal Data Protection Regulation") is issued in connection with the adoption of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR"), which entered into force on 25 May 2016. The purpose of issuing this internal regulation is, in particular with regard to the principle of transparency as one of the central principles of the GDPR, to determine the conditions for processing personal data, their protection and security, as well as to inform employees, as data subjects of the processing of their personal data, of their rights.

article I

definition of terms 

FOR THE PURPOSES OF THIS INTERNAL REGULATION, IN ACCORDANCE WITH THE GDPR, MEANS

1. Personal data means any information about an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, e.g. name, address, date birth, telephone number, etc.
2. Processing means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated processes, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, restriction, erasure or destruction;
3. The data subject is the employee and his or her close relative whose personal data is processed by the employer on the basis of one of the lawful grounds set out in the GDPR;
4. The controller ENERGYLOW Plus s.r.o., with registered office at Jiráskova 701, 755 01 Vsetín, ID No.: 640 84 701, registered in the Commercial Register at the Regional Court in Ostrava, Section C, Insert 8627, which determines the purposes and means of processing personal data;
5. Processor a natural or legal person who processes personal data for the controller;
6. A third party a natural or legal person, public authority, agency or other entity which is not the data subject, controller, processor or a person directly under the control of the controller or processor who is authorised to process personal data;
7. The supervisory authority is the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7.

article II

Principles for the processing of personal data

1. The controller is obliged to process the personal data of data subjects in a fair and lawful and transparent manner. The processing of personal data is lawful if at least one of the conditions set out in Article 6(1) of the GDPR is met, in particular where
   1. if the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
   2. if the processing is necessary for the performance of a contract to which the data subject is a party or for the performance of measures taken at the request of the data subject prior to the conclusion of the contract,
   3. where the processing is necessary for compliance with a legal obligation to which the controller is subject,
   4. where the processing is necessary for the purposes of the legitimate interests of the controller, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data.
2. The controller shall be entitled to process only adequate and relevant personal data limited to what is necessary in relation to the purpose for which it is processed.
3. The controller is obliged to process personal data that is accurate and up-to-date.
4. The controller shall process personal data in a manner that ensures adequate security of the personal data, including protection by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage.

article III

PROCESSING OF PERSONAL DATA BY THE CONTROLLER

1. The controller is entitled to process only those categories of personal data which are necessary for the performance of the controller's obligations to which it is subject, for the performance of a contract, or the processing of which is necessary for the purposes of the controller's legitimate interests.
2. The controller shall process personal data in accordance with the principles set out in Article II of this Internal Regulation for the purposes of the performance of its obligations under employment law, the fulfilment of the obligations imposed on it by law, including obligations arising in relation to public authorities (hereinafter referred to as the "purpose of processing"). If the controller processes personal data to the extent necessary for the purposes set out in the preceding sentence, it shall process such personal data lawfully and the data subjects shall not grant consent to the controller to process their personal data in accordance with the GDPR.
3. The controller processes:
   1. personal data of the employee to the extent of:
      - name and surname,
      - title,
      - date and place of birth,
      - birth number,
      - address,
      - surname at birth,
      - marital status,
      - nationality,
      - health handicap,
      - health insurance,
      - information on receipt of pension,
      - telephone number,
      - bank details,
   2. and personal data of persons close to the employee, up to a maximum of:
      - name, surname, birth number and address of the employee's child,
      - the name, surname, birth number and address of the employee's spouse, or the name, surname, birth number and address of the employee's employer (hereinafter referred to as 'categories of personal data').
4. The controller shall be entitled to process categories of personal data for a different processing purpose or to a greater extent than that referred to in paragraph 3 only if the data subject has given consent to the processing of the personal data for one or more specific purposes or if there is another lawful ground referred to in Article 6(1) of the GDPR.
5. The controller does not process special categories of personal data pursuant to Article 9 of the GDPR, such as personal data revealing racial or ethnic origin, political opinions, religious beliefs, etc.
6. The controller is obliged to keep records of the personal data processing activities for which it is responsible in accordance with Article 30 of the GDPR, which it shall provide on request to the supervisory authority. The controller shall update these records of personal data processing activities in the event of changes.
7. The controller shall process personal data for as long as necessary. Personal data shall be archived for no longer than the period required by law and shall be destroyed at the latest after the expiry of the archiving period.
8. The members of the controller's statutory body shall keep the personal data processed confidential.

article IV

PROCESSING OF PERSONAL DATA BY THE PROCESSOR

1. The controller shall only use a processor that provides sufficient guarantees to implement appropriate technical and organisational measures to ensure that the processing complies with the requirements set out in the GDPR and to ensure the protection of the rights of data subjects.
2. The controller is obliged to conclude a written contract with the processor for the processing of personal data. The controller is obliged to stipulate in the contract for the processing of personal data the processor's obligation of confidentiality and the processor's obligation to take appropriate technical and organisational measures to ensure the protection of the personal data processed.
3. The controller shall be entitled to transmit to the processor for processing only those personal data of the subjects whose processing by the processor is strictly necessary for the purpose stated therein.

article V

PROTECTION AND SECURITY OF PERSONAL DATA

1. The controller shall take appropriate technical and organisational measures to protect and security of the data processed, in particular
   1. ensure access to documents containing personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, misuse or disclosure to unauthorised persons;
   2. secure access to the PCs on which personal data are stored by means of secure passwords, which shall be changed regularly;
   3. install software on PCs to protect against unauthorised access and malicious code;
   4. regularly back up the data on the PC;
   5. not publish documents containing personal data in a place where unauthorised persons may have access to them.
2. The controller shall regularly evaluate the technical and organisational measures taken and adapt them to achieve the purpose of protecting and securing personal data within the meaning of the GDPR.
3. The controller shall report any personal data breach to the supervisory authority without undue delay and preferably within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The controller shall inform the data subjects concerned of the breach without delay.
4. In the event of a personal data breach, the controller shall take appropriate measures without undue delay to achieve the purpose of the protection and security of personal data within the meaning of the GDPR.

article VI

RIGHTS OF DATA SUBJECTS

1. The data subject has the following rights under the GDPRa
   1. the right of access to personal data, i.e. the right to obtain confirmation from the controller as to whether or not personal data concerning him or her are being processed and, if so, the right to obtain access to those personal data and to the information referred to in Article 15(1) of the GDPR;
   2. the right to rectification, i.e. the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay; taking into account the purposes of the processing the data subject has the right to have incomplete personal data completed;
   3. the right to erasure ('right to be forgotten'), i.e. the right to have personal data concerning the data subject erased by the controller without undue delay.
      The controller is obliged to erase personal data without undue delay if one of the grounds set out in Article 17(1) of the GDPR applies;
   4. the right to restriction of processing, i.e. the right to have the controller restrict processing in any of the cases listed in Article 18(1) of the GDPR;
   5. the right to data portability, i.e. the right to obtain personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format readable format, and the right to transmit those data to another controller without being prevented from doing so by the controller to whom the personal data have been provided, where the processing of personal data is the processing is based on the data subject's consent or on a contract and is carried out by automated means;
   6. the right to object to the processing of personal data concerning him or her on the basis of the processing of personal data for the purposes of the legitimate interests of the controller;
   7. the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of his or her personal data infringes the GDPR.
2. If the data subject has given consent to the processing of his or her personal data pursuant to Article III(4), he or she has the right to withdraw the consent at any time.
3. The data subject may exercise the rights referred to in paragraphs 1(a) to (f) and 2 of this Article in person at the registered office of the controller by contacting a member of the statutory body or by e-mail to k.zubek@energylow.cz.
4. The data subject may exercise the right referred to in paragraph 1(g) of this Article before the supervisory authority.

article VII

FINAL PROVISIONS

1. This Internal Regulation may be amended only in writing.
2. This Internal Regulation shall enter into force and effect on the date of its issue.
3. This Internal Regulation shall be issued for an indefinite period of time.
4. A declaration by the employees that they are familiar with this Internal Regulation shall be annexed to this Internal Regulation.

ENERGYLOW Plus s.r.o.,
Ing. Karel Zubek, Managing Director