Personal Data
Protection Policy

The controller of personal data is VESSAN Reality s.r.o., with its registered office at Na Zlíchově 1307, 152 00 Praha 5, Company ID: 282 52 527 (hereinafter referred to as the “Controller”).

The processing of personal data is carried out by the Controller using its own means and through selected service providers. Personal data are processed in technically and organizationally secured information systems. Personal data will not be used for decision-making based solely on automated processing.

With regard to specific categories of data subjects, the Controller is entitled, for the performance of statutory and contractual obligations, to provide personal data to other processors and recipients, namely companies within the VESSAN group, i.e.
• VESSAN ESTATE s.r.o., with its registered office at Na Zlíchově 1307, 152 00 Praha 5, Company ID: 279 45 758,
• VESSAN s.r.o., with its registered office at Na Zlíchově 1307, 152 00 Praha 5, Company ID: 279 51 553,
• VESSAN Development s.r.o., with its registered office at Vodičkova 791/41, Nové Město, 110 00 Praha 1, Company ID: 141 01 980,
• VESSAN Holding a.s., with its registered office at Na Zlíchově 1307, 152 00 Praha 5, Company ID: 072 94 743.

Other recipients include persons involved in the conclusion and recording of contracts and related documents, as well as suppliers of IT technologies.

Other processors and service providers
When processing personal data, we also use the services of the following providers, who perform technical and service functions for us in connection with the operation of the website and our activities:
• Netlify, Inc. (USA) — provider of website hosting and Netlify Forms services; in connection with the operation of the website, it may process data submitted through forms and technical operational data necessary for the security and functioning of the website.
• Google Ireland Limited and other companies within the Google group — provider of Google Analytics, which is used only after the relevant consent has been granted, and Google Workspace, which is used for e-mail communication.

Where required by applicable law, the Controller shall also transfer the data subject’s personal data to other entities if they have a lawful basis for access to the data or if this is necessary for the protection of the Controller’s rights.

Transfers of personal data outside the EEA
In connection with the use of some of the services referred to above, personal data may be processed or transferred outside the European Economic Area, in particular to the United States of America. Such transfers take place using appropriate legal mechanisms for the protection of personal data, in particular on the basis of an adequacy decision or the European Commission’s standard contractual clauses.

Within the framework of the legal relationship, the Controller processes the personal data of the data subject on the basis of compliance with legal obligations, performance of contractual obligations, its legitimate interests, or the consent of the data subject, for the following purposes:

• Performance of the contractual relationship. This processing is necessary for the performance of the contract. If the data subject does not agree to provide his or her data for this purpose, the contract cannot be concluded. For this purpose, the identification data of the data subject specified in the contract, contact details where applicable, and information relating to the subject matter of the contract will be processed to the extent necessary. The Controller is entitled to process this scope of personal data for the purpose of protecting its rights in the event of a dispute with the data subject. This processing shall take place only for the period strictly necessary for the performance of the contractual relationship and for the subsequent period required for the Controller to comply with its legal obligations.
• Marketing use of data. In addition to the performance of the contractual relationship pursuant to the preceding paragraph, the Controller is entitled, pursuant to Section 7(2) of Act No. 480/2004 Coll., on Certain Information Society Services, to use the details of the data subject’s electronic contact if the data subject has given prior consent. Pursuant to Section 7(3) of the same Act, the Controller is also entitled to use the data subject’s electronic address for the purpose of distributing commercial communications concerning its own products or services similar to those already provided to the data subject. In both cases, the Controller is entitled to use the details of the data subject’s electronic contact until the data subject expresses an objection. This processing is voluntary, and whether or not consent is granted has no effect on the conclusion of the contract. Consent is granted for a period of 5 years, but may be withdrawn at any time free of charge in the manner set out below.
• Offer of services. If the data subject expresses an interest on the Controller’s website in being contacted by submitting an inquiry form, the Controller will process the personal data provided by the data subject, to the extent of the e-mail address and/or telephone number specified by the data subject. If the data subject also provides identification data (first name, surname) in the inquiry form, the Controller will also process these data for the stated purpose. The Controller is entitled to process the data subject’s personal data until the data subject expresses an objection; if the Controller is unsuccessful in contacting the data subject, the data may be processed for a period of 1 year from the date on which the completed inquiry form was received. The data subject may express an objection in the manner set out below.

The data subject has all rights granted by Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the “Regulation”), Act No. 110/2019 Coll., on Personal Data Processing, as amended, and other legislation. The data subject may exercise these rights by contacting the Controller pursuant to Article II at the contact address specified above, by e-mail at info@vessan.cz, or by telephone at +420 2222 65 888.

In the event of doubts regarding compliance with obligations relating to the processing of personal data, the data subject may also lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 27, 170 00 Praha 7, e-mail: posta@uoou.cz, www.uoou.cz.

• Right of access to personal data. Pursuant to Article 15 of the Regulation, the data subject has, in particular, the right to request information from the Controller regarding the processing of his or her personal data for all of the purposes specified above. The Controller is obliged, without undue delay, to provide the data subject with at least information on the purpose of the processing, the personal data or categories thereof that are being processed, the recipients or categories of recipients to whom the personal data have been disclosed, information on the nature of automated processing where the data are used for decision-making concerning the rights of the data subject, and the envisaged period for which the personal data will be stored or the criteria used to determine that period.
• Right to rectification. Pursuant to Article 16 of the Regulation, the data subject has the right to have the Controller rectify inaccurate personal data concerning him or her without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.
• Right to erasure. Pursuant to Article 17 of the Regulation, the data subject has the right to have the Controller erase the personal data being processed if at least one of the conditions laid down in the Regulation is met — in particular, if the personal data are no longer necessary for the purposes for which they were collected, consent to the processing has been withdrawn and there is no other legal basis for the processing, an objection to the processing has been raised and there are no overriding legitimate grounds for the processing, the data have been processed unlawfully, or they must be erased in order to comply with a legal obligation of the Controller. These conditions shall not apply where the processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation or the performance of a task carried out in the public interest, for reasons of public interest in the area of public health, for archiving purposes, scientific or historical research and statistical purposes, or for the establishment, exercise, or defence of legal claims.
• Right to restriction of processing. The data subject has the right to restriction of the processing of personal data if he or she contests their accuracy, the processing is unlawful and the data subject requests restriction of their use instead of erasure, the processing is no longer necessary for the Controller but the data subject requires the data for the establishment, exercise, or defence of claims, or an objection has been raised against processing on the grounds of decision-making based solely on automated processing. The Controller is obliged to inform the data subject in advance before the restriction of processing is lifted.
• Right to data portability. Pursuant to Article 20 of the Regulation, the data subject has the right to receive from the Controller the personal data provided in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller, provided that the processing is based on consent or a contract and is carried out by automated means. The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• Right to object. Pursuant to Article 21 of the Regulation, the data subject has the right to object to the processing of personal data, including profiling. If the data subject exercises this right, the Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds that override the rights and interests of the data subject. The Controller may also continue to process such personal data where this is necessary for the establishment, exercise, and defence of legal claims. Where an objection is raised against processing for direct marketing purposes, the Controller’s legitimate grounds shall no longer be assessed.
• Right to lodge a complaint. Where the data subject believes that his or her personal data are being processed unlawfully, a complaint may be lodged with the supervisory authority, the Office for Personal Data Protection, using the contact details specified above.
• Right to withdraw consent. Where the processing of personal data is based on consent granted by the data subject, the data subject is entitled to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The Controller regularly reviews this Privacy Policy so that it reflects new developments and opportunities in relation to the Internet and remains compliant with applicable legislation. The Controller will provide notice of any material changes to the privacy statement on its website, including access to the current version of the statement.

The separate Cookie Policy describes which cookies this website uses, what they are used for, and how their storage can be restricted.