Privacy Policy

This document regulates the conditions of the subject's consent to the administrator SMARTEO, a.s. and administrators listed here.

By ticking the relevant box, or by any other activity of the subject aimed at granting consent, voluntary, informed and explicit consent to the processing of the subject's personal data according to these conditions is given. If the subject does not understand anything, he/she should contact the following contact details with a request for clarification:

• SMARTEO, a.s.
• Strakonická 3309/2e, 150 00 Praha 5
• E-mail: objednavky@smarteo.cz

The purpose of this document is to define the terms of processing personal data, especially administrators, the scope of data obtained, processing time, explanation of the purpose and specific operations with the subject's personal data, all this included contacts for all administrators, information about beneficiaries and, last but not least, instruction on rights and an explanation of procedures, how the subject can exercise rights and where the subject can file a complaint.

This document applies to the smarteo.cz website, all subpages or nested frames (iframes) on the smarteo.cz domain and other pages belonging to SMARTEO, a.s. (see page footer). In the event that you are redirected to any other site and your personal data is requested there, please carefully study the processing conditions stated on these other sites.

The terms and conditions can be changed at any time, but without affecting the already started and agreed processing. These conditions are effective from 25/05/2018.

1. Administrator

Consent is granted to the following companies as administrators:

1.1. SMARTEO, a.s.

2. Purpose

Personal data will be processed only for the purpose for which the subject has given explicit, voluntary and informed consent, or on the basis of another legal basis. For other purposes, administrators are authorized to process personal data only if required by law or if it is necessary to protect the rights/legitimate interests of the administrator.

A. processing a request to create an offer of a suitable insurance product from the area of ​​non-life insurance, possibly mediating the conclusion of an insurance contract for a specific product from the area of ​​non-life insurance, or sending information from the selected area including sending personalized business messages by electronic means from the area in question:

The purpose is to implement the subject's request, i.e. to process the subject's request to create an offer of a suitable insurance product from the field of life or non-life insurance, mediate the conclusion of an insurance contract for a specific a product from the field of non-life insurance or sending information from the selected field, including sending personalized commercial messages by electronic means from the given field; purpose includes the following activities:

The legal title of processing is consent. In order to select relevant information for the subject, segmentation will be carried out on the basis of the established data (e.g. by age, area of ​​interest, established preferences, etc.). Once the subject requests the termination of processing, he will not obtain further information.

B. market research and sending general business communications: the purpose is the implementation of direct marketing, i.e. market research and sending commercial messages, by all means, including electronic means of communication. The administrators' commercial communications will also contain offers of goods and services from third parties. Market research includes an evaluation of the subject's activities, data on the use of sent commercial messages and subsequent outputs. Commercial messages will be from the whole field of financial or insurance products or savings, including other useful offers. The legal title of processing is consent. In order to select relevant information for the subject, segmentation will be carried out on the basis of the established data (e.g. by age, area of ​​interest, established preferences, etc.). This processing is optional and completely voluntary for the subject and can be terminated at any time upon request.

3. Scope of personal data

Administrators collect only the data they really need for the specified purpose. Administrators collect only the data communicated or forwarded to them by the subject. The scope of personal data for defined purposes is determined as follows:

A. processing a request to create an offer of a suitable insurance product from the area of ​​non-life insurance, possibly mediating the conclusion of an insurance contract for a specific product from the area of ​​non-life insurance, or sending information from the selected area including sending personalized business messages by electronic means from the area in question:

vessel liability insurance:

3.1. identification data:

first name, last name

3.2. contact details:

address, email address, phone number

3.3. additional data according to the type of form/request:

type of vessel, use of the vessel, brand of the vessel, registration of the vessel, year of manufacture of the vessel, indicative price of the vessel, number of insured events of the policyholder, number of months of insurance of the policyholder, additional information on to the owner of the vessel (natural person/self-employed, owner's age, information on whether the owner is the same as the policyholder and the vessel operator)

accident insurance – CASKO of vessels:

3.4. identification data:

first name, last name

3.5. contact details:

address, email address, phone number

3.6. additional data according to the type of form/request:

type of vessel, use of the vessel, brand of the vessel, registration of the vessel, year of manufacture of the vessel, indicative price of the vessel, number of insured events of the policyholder, number of months of insurance of the policyholder, additional information on to the owner of the vessel (natural person/self-employed, owner's age, information on whether the owner is the same as the policyholder and the vessel operator)

property insurance:

3.7. identification data:

first name, last name

3.8. contact details:

address, email address, phone number

3.9. additional data according to the type of form/request:

length of previous insurance

B. market research and sending general commercial messages:

3.18. identification data:

first name, last name

3.19. contact details:

email, phone number

3.20. data to determine which commercial communications will be of interest to the recipient:

information about previously selected areas and requests, information about the use of websites, information obtained thanks to cookies, use of commercial communications, data found when participating in competitions

4. Processing time

The processing period is set for an indefinite period, i.e. until the consent is revoked by the subject for the selected processing purpose. Consent can be revoked for each administrator separately. The processing will be terminated immediately after the withdrawal of consent, while in justified cases the request will be processed within seven (7) calendar days at the latest.

After the end of the processing period, the subject's personal data will be disposed of, unless their retention is required by law, the submission of information may be required by a supervisory authority or their retention is necessary for the fulfillment of a concluded contract.

A. processing a request to create an offer of a suitable insurance product from the area of ​​non-life insurance, possibly mediating the conclusion of an insurance contract for a specific product from the area of ​​non-life insurance, or sending information from the selected area including sending personalized business messages by electronic means from the area in question:

The processing time for this purpose is set for an indefinite period, i.e. until the consent is revoked by the subject for the selected processing purpose. Consent can be revoked for each administrator separately. Consent to sending commercial communications can also be revoked by using the link in each commercial communication. The processing will be terminated immediately after the withdrawal of consent, while in justified cases the request will be processed within seven (7) calendar days at the latest.

B. market research and sending general commercial messages:

The processing time for this purpose is set for an indefinite period, i.e. until the consent is revoked by the subject for the selected processing purpose. Consent can be revoked for each administrator separately. Consent to sending commercial communications can also be revoked by using the link in each commercial communication. The processing will be terminated immediately after the withdrawal of consent, while in justified cases the request will be processed within seven (7) calendar days at the latest.

5. Withdrawal of Consent

Consent is granted to each administrator according to these terms. A data subject who requests to withdraw his/her consent may do so optionally with respect to all controllers or with respect to each controller individually:

5.1. in relation to all administrators:

it is possible to make an appeal at the e-mail address objednavky@smarteo.cz Deletion cannot be carried out if the client concludes a separate contract with the administrator.

5.2. against an individual administrator:

SMARTEO, a.s. at the electronic address objednavky@smarteo.cz; towards other administrators by using electronical addresses, which are listed separately for each of the administrators in the "list of administrators" document. If necessary, additional information may be required to verify the identity of the entity or assign the applicant to a specific entity.

6. Beneficiaries

Administrators generally do not transfer the subject's personal data to third parties. The only beneficiaries may be the persons listed in these terms and conditions below.

6.1. Recipients:

Recipients can only be persons within the SMARTEO, a.s. group

6.2. Processors:

In order to fulfill the stated purposes, in necessary cases, the following processors may have access to personal data to a limited extent for a limited time:

• Marketing companies,
• Accounting firms,
• Audit firms,
• Legal services companies,
• Personnel and training companies,
• Companies providing IT services,
• Internet Marketing Companies,
• Companies engaged in the development, sale and service of marketing systems,
• Companies involved in the development and implementation of enterprise systems,
• Web and mobile application development companies,
• Companies providing software license for online communication.

7. Requests, objections, complaints, supervisory body

A request, query, exercise of rights or other submissions will be processed upon receipt without undue delay, in justified cases within 30 days at the latest. If necessary, this deadline can be extended to two months, taking into account the complexity and number of applications.

If necessary, additional information may be required to match the applicant to a specific entity. In justified cases, control or verification of the subject's identification may be requested.

7.1. General requirements:

Subjects can direct their general questions, comments and requests to the following contacts:

7.2. Personal data:

The entity is obliged to direct requests and exercise of rights regarding personal data to this contact:

Complaints can be directed to this e-mail: objednavky@smarteo.cz. The withdrawal of consent is governed by the procedure specified in Article 5.

7.3. Objections, suggestions:

Objections and suggestions regarding direct marketing and the related processing of personal data can be raised by the entity as follows:

7.4. Complaints:

Complaints against the actions of any administrator will be handled by the responsible person at the following contacts:

The subject is entitled to file a complaint with the supervisory authority. The supervisory authority for the processing of personal data is the Office for the Protection of Personal Data, located at the address Pplk. Sochora 727/27, 170 00 Prague 7-Holešovice, www.uoou.cz.

8. Instruction on rights according to the Personal Data Protection Act effective until 24/05/2018

Each subject acknowledges that, in connection with the processing of his personal data, the administrator has the rights specified in §§ 11, 12 and 21 of Act No. 101/2000 Coll., on the processing of personal data, as amended, and is aware of the fact that the provision of personal data to administrators is necessary for the given purposes. Consent to the processing of personal data for the purpose of personalized offers of products, services and the provision of marketing information by administrators and third parties is, on the contrary, voluntary and may be revoked at any time in writing to the administrators' addresses in accordance with these conditions. The subject has the option to refuse the sending of offers free of charge, which according to the law are commercial communications in addition when sending each individual message. The data subject also has the right to ask the administrator or processor for information about the processing of his personal data, i.e. he has the right to so-called access to the data, its disposal, etc. In case of doubts about the observance of rights by the administrators, the subject can contact the administrator or the supervisory authority.

9. Instruction on rights according to the general regulation on the protection of personal data effective from 25/05/2018

9.1. Transparent information, communications and procedures for the exercise of the rights of the data subject

Administrators will take appropriate measures to provide each subject in a concise, transparent, comprehensible and easily accessible manner using clear and simple language means all information (e.g. about the processor of personal data and about the progress of this processing) and made all communications about the processing. Administrators will provide information in writing or by other means (for example, in electronic form). Provided that the identity of the subject is proven in other ways, he also has the right to request the provision of this information orally. Administrators will not refuse to comply with the subject's request when exercising the subject's rights (in particular the right of access), unless they prove that they cannot ascertain the identity of the data subject to whom the data in question relates. The subject has the right to have the administrators provide him with information on the measures taken upon request, without undue delay and in any case within one month of receiving the request. If necessary, this deadline can be extended by another two months, taking into account the complexity and number of applications. Administrators will notify the subject of any such extension within one month of receipt of the request, together with the reasons for such extension. If the request was submitted in electronic form, the information will be provided in electronic form, if possible and unless the subject requests another method.

If the administrators do not take the measures requested by the subject, they inform the subject immediately and no later than one month after receiving the request about the reasons for not taking the measures and about the possibility of filing a complaint with the supervisory authority and apply for judicial protection.

The administrators inform the subject that all such information, communications and actions are provided free of charge. If the requests submitted by the entity are evaluated as clearly unfounded or unreasonable, and especially if they are repeated, administrators can either:
a) ulolevy a reasonable fee taking into account the administrative costs associated with providing the requested information or communication or taking the requested actions; or
b) refuse to comply with the request.

The obvious unreasonableness or inadequacy of the request is documented by administrators.

If administrators have reasonable doubts about the identity of the natural person submitting the request, they may request the provision of additional information necessary to confirm the subject.
The information to be provided to the subject may be supplemented by standardized icons in order to provide an overview of the intended processing in an easily visible, comprehensible and clear way. If the icons are presented in electronic form, they must be machine readable.

9.2 Right to Correction

The subject has the right to have the administrators correct inaccurate personal data concerning the subject without undue delay. Taking into account the purposes of processing, the subject also has the right to supplement incomplete personal data, including by providing an additional statement.

9.3 Right to erasure (right to be forgotten)

The subject has the right to have the administrators delete personal data concerning the subject without undue delay, and the administrators have the obligation to delete personal data without undue delay if given one of the following reasons:

If the administrators have published personal data and are obliged to delete it according to the above-mentioned "Right to erasure", they are accepted taking into account the available technology and the costs of taking reasonable steps, including technical measures to inform the administrators who process this personal data that the data subject requests them to delete all references to, copies or replications of this personal data.

9.4 Right to restriction of processing

If the processing has been restricted according to the aforementioned "Rights to restrict processing", these personal data, with the exception of their storage, may only be processed with the subject's consent, or from for the purpose of determining, exercising or defending legal claims, for the purpose of protecting the rights of another natural or legal person or for reasons of important public interest of the Union or a member state.

If the subject has reached the restriction of processing, the administrator will be notified in advance that the restriction of processing will be lifted.

Notification obligation regarding correction or deletion of personal data or restriction of processing.

Administrators shall notify individual recipients to whom personal data has been disclosed of any correction or deletion of personal data or restriction of processing, except where this proves impossible or requires undue effort. Administrators will notify the subject of these recipients if the subject so requests.

9.5 Right to Data Portability

When exercising its right to data portability, the subject has the right to have Personal Data transferred directly from one administrator to another administrator, if this is technically feasible.

p>

The exercise of the above "Right to Data Portability" is without prejudice to the above "Right to Erasure". This right does not apply to processing necessary to fulfill a task carried out in the public interest or in the exercise of public authority with which the administrators are entrusted.

The above "Right to Data Portability" must not adversely affect the rights and freedoms of other persons.

9.6 Right to Object

For reasons related to the specific situation of the subject, the subject has the right to object at any time to the processing of personal data concerning him. Administrators do not further process personal data unless they demonstrate serious legitimate reasons for processing that outweigh the interests of the subject or the rights and freedoms of the subject, or for the determination, exercise or defense of legal claims.

If personal data is processed for direct marketing purposes, the subject has the right to object at any time to the processing of personal data concerning him for such purpose, which includes profiling as it relates to direct marketing.

If the subject objects to processing for direct marketing purposes, personal data will no longer be processed for these purposes.

In connection with the use of information society services, the entity may exercise its right to object by automated means using technical specifications.

If personal data is processed for the purposes of scientific or historical research or for statistical purposes, the subject has the right, for reasons related to his specific situation, to object to the processing personal data relating to him, unless the processing is necessary to fulfill a task carried out for reasons of public interest.

9.7 Automated individual decision-making, including profiling

The subject has the right not to be the subject of any decision based solely on automated processing, including profiling, which has legal effects for the subject or significantly affects him in a similar way.

The administrator does not base any of his decisions solely on automated processing.

10. Terms and definitions

All terms below used in the terms and conditions generally have the meaning according to the following definitions:

10.1. personal data

Personal data is any information relating to an identified or determinable data subject. A data subject is considered determined or determinable if the data subject can be directly or indirectly identified, in particular on the basis of a number, code or one or more elements specific to his physical, physiological, psychological, economic, cultural or social identity; for example, personal data is e-mail, mobile phone, personal data can also be information about a purchase preference in connection with a surname;

10.2. subject

The subject is a natural person whose personal data is processed according to these conditions;

10.3. special category of personal data

A special category of personal data is data indicating racial or ethnic origin, political opinions, trade union membership, religious or philosophical beliefs, health status, sex life or sexual orientation of the data subject. Administrators never require data falling into a special category of personal data. These are not processed;

10.4. processing

The processing of personal data is any operation or set of operations that the controller or processor systematically performs with personal data, either automatically or by other means. The processing of personal data means in particular the collection, storage on information carriers, making available, modification or alteration, search, use, transmission, dissemination, publication, storage, exchange, sorting or combining, blocking and disposal; by collecting personal data, a systematic procedure or a set of procedures, the aim of which is to obtain personal data for the purpose of their further storage on an information carrier for their immediate or later processing; the retention of personal data is the retention of data in the form that it is enables further processing; blocking of personal data is an operation or a set of operations which limit the method or means of personal data processing for a specified period of time, with the exception of necessary interventions; the disposal of personal data means the physical destruction of their carrier, their physical deletion or their permanent exclusion from further processing;

10.5. administrator

The administrator is any entity that determines the purpose and means of personal data processing, performs the processing and is responsible for it. By processing personal data, the administrator can authorize or authorize the processor. The administrator is the companies listed here;

10.6. purpose

The purpose of processing is the reason why administrators process personal data;

10.7. trustee

The trustee is appointed by the administrator and monitors the compliance of the administrator's activities according to legal regulations, cooperates with the supervisory authority and is the point of contact for the supervisory authority in matters related to processing. Subjects can contact the commissioner in all matters related to the processing of their personal data and the exercise of their rights;

10.8. scope

Scope means specific personal data that we need for processing, for example first and last name;

10.9. processor

The processor is a natural or legal person, public authority, agency or other entity that processes personal data for the controller;

10.10. recipient

The recipient is a natural or legal entity, public authority, agency or other entity to which personal data is provided, whether it is a third party or not. However, public authorities that may obtain personal data as part of a special investigation in accordance with legal regulations are not considered recipients;

10.11. conditions

Conditions means this document "Conditions for the processing of personal data", which contains the conditions for the processing and protection of personal data;

10.12. website

Internet pages mean the website www.smarteo.cz, or pages belonging to the company SMARTEO, a.s.