Business Partner’s Privacy Policy

1  General Provisions

We are committed to respecting your privacy and protecting your personal data, which is any information that is capable of identifying you as an individual person. This Business Partners’ and Marketing Privacy Policy (the “Privacy Policy”) describes how CTP Invest, spol. s r.o.  (“CTP” or “we”) handles, processes and protects personal data of our business partners such as our tenants or suppliers (the “Business Partner”), their contact persons, and other persons whose personal data we may process such as subscribers to our newsletter. As used in this Privacy Policy, “personal data” means information that identifies our business partners, their contact persons and other persons (“you”).

This Privacy Policy also informs you about your rights regarding personal data processing and how and by what means you can exercise them.

We recommend that you carefully familiarize yourself with this Privacy Policy.

2  Data Controller and Contact Details

The controller of your personal data is CTP Invest, spol. s r.o., with its registered office at CTPark Humpolec 1571, 396 01 Humpolec, ID: 261 66 453, registered in the Commercial Register maintained by the Regional Court in České Budějovice, file C 15647.

As set in this Privacy Policy, your personal data may be shared with other CTP Invest’s affiliates or subsidiaries being part of CTP Group (“CTP Group”).

Updated contact details and other information on all companies of the CTP group can be found at https://ctp.eu/contact.

For requests and/or complaints related to this Privacy Policy you can contact us via e-mail privacy@ctp.eu.

3  Personal Data of Business Partners and Their Contact Persons

3.1  Purposes of the processing and retention period

We may process personal data relating to you as our Business Partner and/or Business Partner’s board members, employees, sub-contractors and/or other contact persons provided to us (the “Contact Persons”) in order to perform the contractual obligations arising from an agreement (such as lease, supply, vendor or any other agreement) and to ensure more effective communication between the contractual parties. It follows that the personal data are processed mainly for the following purposes:

3.1.1    Fulfilment of contractual obligations. Personal data are processed for the purpose of performance of the agreement that you, as a Business Partner, have concluded with us, and further also for potential warranty claims related to goods and services that you provide us with and for maintaining records of our suppliers. The data are stored for the period of existence of the contractual relationship between you and us. Provision of personal data in these cases is an indispensable condition for the conclusion and performance of the agreement and without the personal data it is impossible to enter into, maintain or perform the agreement.

3.1.2    Effective communication. We process personal data relating to you (our Business Partner and/or Contact Persons) for the purpose of ensuring effective communication between you, as our Business Partner, and us, as well as for the purpose of ensuring effective administration of our contractual relationship. This may include, for example, communication with you and your employees and workers, defects management, ensuring the security of all persons on our premises, preventing damage to the property of our tenants, suppliers and other persons and mitigating the damage already incurred, etc. The personal data necessary for this purpose is retained primarily for the period of the duration of our relationship.

3.1.3    Accounting records. Some personal data may be included in the accounting records (mainly invoices). According to applicable laws of the Czech Republic (e.g. Accounting Act, VAT Act), we have obligations to keep these records for the period of 10 years. If we have a legal obligation to archive these records, we archive them together with your personal data stated therein.

3.1.4    Determination, exercise and defense of legal claims. Following the termination of our contractual relationship we may continue to process the personal data that are necessary for the protection of our rights and for the potential defense of our legal claims, including collection of outstanding payments. The personal data that are no longer needed, or there is no longer a legal basis for their retention, are irreversibly rendered anonymous or destroyed in a secure manner. If disputes arise and we must defend ourselves, act or even make claims against you or third parties, we may retain the personal data that we deem reasonably necessary for processing for these purposes, for a period of time in which such a claim can be pursued.

3.2  Extent of personal data processing

We process personal data that we have obtained directly from our Business Partners or you as a Contact Person. In order to ensure that we process only data that are accurate and up-to-date, we may regularly update the data also from public sources (mainly the commercial register, the trade licensing register, ARES, the insolvency register and Business Partners’ web sites).

The scope of personal data that we usually process for the purposes described above includes: name, company name, work position, phone number, email address and/or other information relating to the performance of the agreement between the Business Partner and us, including, but not limited to, the information about payments, service deliverables etc.

4  Marketing Communications

4.1  Newsletter and information about CTP activities

Based on your consent, we can send our newsletter and other related information about CTP Group’s activities such as information about our services and products, promotion deals, and events organized by us or other entities within the CTP group (ctp.eu). You can subscribe to the newsletter via an online form which is accessible on several websites operated by us or another entity of the CTP group (such as ctp.eu, www.domeq.cz, www.vlnena.eu, jobs.ctp.eu, www.ponavka.eu).

If you wish to subscribe to our newsletter you will be asked to submit your personal data in the extent of name, surname, email address and phone number (optional). We may also process your reactions or feedback regarding the newsletters that we send to you.

4.2  Photos and videos from our events

If you give us your consent, we may also process additional personal data for marketing purposes of the CTP or other entities within the CTP Group, e.g. recording, publishing and storing of photographs or videos capturing you which were recorded at one of the events organized by us or another entity of the CTP group.

4.3  Purposes of the processing and retention period

The purpose of the processing is the market research, promotion of products and services, particularly sending offers and personalized commercial information, organization and promotion of events and other marketing activities of the CTP and other entities of the CTP group.

The personal data are process based on your consent, that you can withdraw at any time. The retention period corresponds to the duration of the consent and shall not exceed the period of three years from the date when the consent was granted.

5  Social Media

When you visit, like, follow or otherwise engage with our social media pages or accounts (including, to the applicable extent, use of your social media user account), we may be considered joint-controllers of your personal data with the provider of the particular social media/network. We do not use your personal data in any other way than described in this Privacy Policy. In order to find out more information about how the social media/network provider uses your personal data and other information, please contact the respective provider.

6  Cookies

We use cookies so that the users can login into the system and fully navigate within the system; turning off cookies would result in the user being unable to login to the system.

Additionally, we use cookies and other technologies (such as site measuring software and user experience software) to enhance your online experience and learn about how you use our services in order to improve the quality of the Services. We may combine data gained through cookies with other data you provide to us.

Further information relating to the use of cookies is available at ctp.eu/ctp-website-cookie-policy.

7  Sharing and Transfer of Personal Data (Recipients of Personal Data)

Your personal data may be shared with:

• within the CTP Group (ctp.eu);
• providers of IT, marketing or administrative services, such as ETTEA Group s.r.o., Enerfis s.r.o., TMF Czech, a.s. or Management Data Praha spol. s.r.o., Google LLC, IMPER CZ, s.r.o.;
• external auditors, consultants, tax advisors and legal representatives bound by confidentiality obligation for the protection of our legitimate interests;
• public prosecution bodies, courts and administrative authorities in accordance with our legal duties.

We have entered into agreements on processing of personal data with the processors of personal data, as per the previous paragraph (with the exception of cases where the conclusion of such agreement is not obligatory, for example, when transferring personal data to public authorities), which ensure at least the same level of protection thereof as this Privacy Policy.

8 Data Security

We have implemented and maintain appropriate technical and organizational measures, internal controls and information security processes in accordance with legal requirements and market standards corresponding to a possible threat to you as the data subject. We also take into consideration the state of technological development in order to protect your personal data from accidental loss, destruction, alterations, unauthorized disclosure or access. Such measures may, among other things, include taking reasonable steps to ensure the liability of relevant employees who have access to your data, training of employees, regular backups, procedures for data renewal and management of incidents, software protection for devices on which personal data are stored, etc.

9  Your Rights as a Data Subject

If you wish to exercise any of your rights according to this Article or according to applicable legislation, please contact us using the contact information listed in Article 2 above.

Also, if applicable, we will inform each recipient to whom your data have been provided according to Article 7 of this Privacy Policy of the measures taken or of the erasure of your personal data or of the restriction of processing in accordance with your request, if such a notification is possible and/or does not involve disproportionate effort.

9.1  Access to and portability of your personal data

You have the right to obtain confirmation as to what personal data we process or do not process with respect to you. Should you request it, we can send some of your personal data (namely the data that we process on the basis of the fulfilment of a contract and/or your consent) directly to a third party (to another data controller) whom you state in your request, provided that such request does not affect the rights and freedoms of other persons, and provided that it is technically feasible

You can access your personal data via aforementioned contact details.

9.2  Withdrawal of consent

Granted consent to the processing of your personal data can be withdrawn at any time without giving reason. For such purpose, please contact us via the contact details set out in Article 2 of this Privacy Policy. In such a case, we will erase your personal data within 30 days from the withdrawal of your consent.

Please note that the withdrawal of your consent does not affect the lawfulness of processing conducted on the basis of consent prior to its withdrawal

9.3  Rectification of your personal data

According to applicable legislation, you have the right to rectification of your personal data that we are processing if you find that they are inaccurate or incomplete.

To request rectification of your personal data, please contact us via the aforementioned contact details.

9.4  Erasure of your personal data

You can request erasure of your personal data at any time. The scope within which we can comply with your request for erasure of personal data may be limited by our statutory obligations to store some personal data, particularly on the basis of accounting and tax regulations, etc. Further, we will also erase all of your personal data (and ensure erasure thereof by the processors that we engage) if you withdraw your consent.

9.5  Restriction of processing

If you request us to restrict the processing of your personal data, for example when you contest the accuracy, lawfulness or our need to process your personal data, we will limit processing of your personal data to a necessary minimum (storage), and if applicable we will only process this data to establish, exercise or defend legal claims or where necessary in order to protect the rights of other natural or legal person, or for other limited reasons required by the applicable law.. In case the restriction is lifted, and we continue processing your personal data, you will be informed accordingly without undue delay.

The request for restriction of processing can be made using the aforementioned contact details.

9.6  Objections to processing

You can object to data processing. If we do not demonstrate any compelling legitimate reasons for the processing which would override your interests or rights and freedoms, we will no longer process your personal data and will delete it without undue delay.

Objections to processing can be raised using the aforementioned contact details.

9.7  Complaint to a Data Protection Authority

You have the right to lodge a complaint pertaining to processing of data conducted by us with the competent data protection authority, i.e. in Czech Republic the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7; website: www.uoou.cz.

10  Updates to the Privacy Policy

We may modify or update the Privacy Policy from time to time. Any changes to this Privacy Policy shall become effective with publication of the updated Privacy Policy at ctp.eu/business-partners-privacy-policy.