Farma Zadní Hrádek s.r.o., ID No. 08462291 (hereinafter referred to as the “Company”), in connection with the exercise of its rights and obligations arising from its status as a service provider, collects and processes personal data regarding natural persons (hereinafter referred to as “Individuals”) who are its clients or contractual partners.

1. For what purpose do we process personal data?

Before commencing any processing of personal data, the Company determines the purpose for which it processes personal data. In the case of Individuals, such a purpose typically involves the exercise of rights and the fulfillment of obligations arising from a contractual relationship, as well as compliance with legal obligations (regulations in the areas of accounting and taxation, social security, occupational safety, etc.). The Company also processes Individuals’ personal data based on the Company’s legitimate interests for the purpose of protecting the Company’s assets, securing the Company’s premises, or, where applicable, for the purpose of establishing, exercising, and defending the Company’s legal claims in the event that Individuals assert legal claims.

Personal data is processed at all times exclusively to the extent strictly necessary and in a manner that achieves the predetermined purpose.

Once the purpose of processing has been fulfilled, the Company deletes the personal data in accordance with the principle of data minimization (processing of personal data is adequate, relevant, and limited to what is necessary in relation to the purpose of processing) and the storage limitation principle (personal data is stored in a form that allows for the identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed), unless it is necessary to retain it for another purpose.

2. What personal data of Individuals is processed, for what purpose, to what extent, and for how long

2.1 Performance of a contract

Purpose of processing: Performance of a contract

Legal basis for processing: Processing is necessary in connection with the performance of a contract establishing the Company’s contractual relationship with the individual (even indirectly)

Scope of personal data processed: Identification data and bank account information

Duration of processing: For the duration of the obligation arising from the contract to which the data subject is a party

2.2 Establishment, exercise, and defense of the Company’s legal claims

Purpose of processing: To establish, exercise, and defend the Company’s legal claims after the termination of the contractual obligation to which the individual is a party

Legal basis for processing: Processing is necessary for the legitimate interests of the Company

Scope of personal data processed: Identification data

Processing period: For the duration of the statute of limitations for any claims by the data subject, or for a longer period if, for example, the statute of limitations is tolled

2.3 Ensuring the security of the Company’s property and protecting the Company’s headquarters

Purpose of processing: Ensuring the security of the Company’s property and protecting the Company’s headquarters

Legal basis for processing: Processing is necessary for the legitimate interests of the Company in the areas of security and operations

Scope of personal data processed: Video and audio-visual recordings of the data subject related to the Company’s activities

Processing period: Video and audio recordings from the Company’s entrance areas, common areas, and server rooms. Recordings are captured when a person is present in the relevant area and are retained for a period of 7 days

2.4 Maintenance of tax and accounting records

Purpose of processing: Maintenance of tax and accounting records

Legal basis for processing: Processing is necessary to fulfill the Company’s legal obligation

Scope of personal data processed: Identification data, data on income from contractual partners (natural persons), and documents evidencing the Company’s compliance with its accounting and tax obligations

Processing period: For the period specified by individual laws, in particular the Accounting Act

3. Who are the recipients or categories of recipients of personal data?

The Company does not transfer personal data of Individuals to third parties nor does it use them for the processing of personal data.

Furthermore, recipients of personal data may include public authorities (e.g., courts, tax authorities, social security agencies, or the police) and other entities, such as health insurance companies, under the conditions set forth by law.

4. Information on Automated Individual Decision-Making, Including Profiling

The Company does not engage in automated individual decision-making regarding data subjects.

5. On what legal basis do we process personal data?

The Company always processes personal data based on at least one of the legal grounds listed in Article 6 of the Regulation (legal basis for processing). The most commonly applied legal grounds for the processing of Individuals’ personal data by the Company are:

1. performance of a contract to which the individual is a party;
2. compliance with a legal obligation to which the Company, as the controller, is subject; or
3. the legitimate interests of the Company or a third party, which override the interests and fundamental rights and freedoms of the data subject requiring the protection of personal data.

5.1 Conclusion or performance of a contract

The Company collects and processes data about Individuals for the purpose of entering into a contract. Specifically, this refers to data that the Company needs to fulfill an employment contract.

5.2 Compliance with a Legal Obligation

Processing for the purpose of complying with a legal obligation is prescribed by law, by a subordinate legal regulation issued pursuant to that law, or by a provision of European law. For this purpose, the Company processes only those personal data of data subjects whose processing is required by law, or those necessary to fulfill a legal obligation.

5.3 Legitimate Interest of the Company

The Company’s legitimate interest is determined by the Company. Before the Company begins processing personal data based on a specified legitimate interest, it will weigh this interest against the legitimate interests and fundamental rights and freedoms of the data subjects whose personal data it processes (it will conduct a so-called “balancing test”).

If the Company’s legitimate interest serves as the basis for processing a data subject’s personal data, the data subject has the right to object and request erasure.

The Company processes personal data based on legitimate interests, such as, in particular, the establishment, exercise, and defense of the Company’s legal claims, for the duration of the statute of limitations periods for any claims the data subject may have against the Company or the Company may have against the data subject, or for a longer period if, for example, the statute of limitations is tolled.

6. How long do we process personal data?

Personal data will be processed only for the time necessary to fulfill the purpose of processing personal data, which is determined on a case-by-case basis. Beyond the period thus specified, the Company is authorized to process the data subject’s personal data for the period specified by special legal regulations or for the period necessary to enforce the Company’s rights against the data subject. The data subject will be informed of the specific period for which the data subject’s personal data will be processed in Article 4 of these Terms and Conditions.

7. Information on the Data Subject’s Rights

If you have any questions regarding privacy or wish to exercise any of the rights listed above, please contact the Company via [please enter email address].

7.1 Right of Access to Personal Data

In connection with the processing of personal data, the data subject may request information about the processing of personal data and a copy of the personal data being processed.

7.2 Right to Rectification

If a data subject believes that their personal data is inaccurate, out of date, or otherwise incorrect, they may contact the Company, which will ensure that the necessary corrections are made.

7.3 Right to Restriction of Processing

In cases specified in Article 18 of the Regulation—for example, if the processed data is inaccurate or an objection has been filed—a request may be made to restrict processing.

During the period of restriction, personal data will only be stored, and no operations will be performed on it without the data subject’s consent. The restriction on processing lasts for as long as any of the above-mentioned situations persist (e.g., evaluation of an objection or until a correction is made). The data subject will be informed of any termination of the restriction.

7.4 Right to Erasure

In cases under Article 17 of the Regulation—for example, if consent to the processing of personal data is withdrawn or the personal data is no longer necessary—the data subject has the right to request the erasure of such personal data.

In some cases, however, the right to erasure is limited. For example, personal data processed based on legal obligations cannot be erased before the expiration of the statutory retention periods, and data processed based on a legitimate interest cannot be erased until that legitimate interest ceases to exist.

7.5 Right to Object

A reasoned objection may be filed against processing based on a legitimate interest and for direct marketing purposes. The validity of the objection will be assessed, and the data subject will be notified of the decision via the chosen contact method.

7.6 Right to Withdraw Consent to the Processing of Personal Data

In cases where personal data is processed based on consent, such consent may be withdrawn at any time.

7.7 Right to Data Portability

If personal data provided in connection with the performance of a contract or based on consent is processed entirely by automated means and is stored in a structured, machine-readable format, you may request that it be provided to you in a structured, machine-readable format.

7.8 Right to File a Complaint with a Supervisory Authority

If a data subject feels that their personal data is not being handled in accordance with the law, they may contact the relevant supervisory authority at their place of residence, place of work, or the location where their rights were violated. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection.

8. Where and how can a data subject exercise their rights?

The data subject may exercise the rights listed above against the Company: electronically at the email address [●].

The right specified above in Section 7.8 of these Terms may be exercised by the data subject with the Office for Personal Data Protection:

1. electronically at the email address posta@uoou.gov.cz;
2. via data box ID: qkbaa2n;
3. by phone at +420 234 665 111; or
4. in writing at the address Pplk. Sochora 27, 170 00 Prague 7.

9. Final Provisions

These Terms and Conditions took effect on July 28, 2026. These Terms and Conditions will be revised and updated as needed.

Farma Zadní Hrádek s.r.o.

‍