BOWNESSIE s.r.o., K Horkám 2284/1, 149 00 Prague 4, business ID number: 06177433 (hereinafter “Cirkus park”) processes personal data in accordance with the acts and regulations in force in the Czech Republic. Of these, the dominant ones are Act 101/2000 Coll., on personal data protection, and Regulation (EU) No 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).
Pursuant to the GDPR, Cirkus park is the controller of the personal data processed in the individual fields of work, as described in its Record of Processing. Its registered office is at the address: K Horkám 2284/1, 149 00 Prague 4, business ID number: 06177433, tax ID number: CZ06177433, the establishment is located at OC Olympia Teplice, Srbická 464, 415 01 Teplice. The company is headed by its director.
The company does not have a data protection officer, so please send any communication regarding the exercise of a data subject’s rights directly to the company’s director either in writing to the business address stated above or by e-mail to: info@cirkuspark.cz. For its main business activities, Cirkus park processes the following categories of personal data: first name, surname, mobile phone number, e-mail address, telephone number, number of children/attendees, client password. In addition, Cirkus park processes the following personal data for its internal needs (mainly HR, accounting and tax): First name and surname; Bank account; ID card number; Date; Date of birth; Delivery address; E-mail address; Company; Business/Tax ID number; DBIS; Birth number; Age; Number of children, Insurance company, Permanent residence; Mailing address; . In accidental cases, Cirkus park may process other unspecified personal data, of which it will inform the natural person to whom the personal data relate upon request. All personal data is always processed only to the extent strictly necessary within the individual fields as described in the Record of Processing – Summary of Fields or for the purpose of concluding or fulfilling a contractual relationship to which the relevant natural person is a party. The source of lawfulness of processing is either a duty imposed on the organization by law or the establishment and performance of a contractual relationship. Cirkus park transfers personal data processed only based on its legal duty, namely to the Financial Authority of the Czech Republic, the Czech Social Security Administration and a health insurance company. Cirkus park does not transfer any personal data to other countries. The purposes of processing personal data as they relate to Cirkus park’s individual needs are described in the Record of Processing – Summary of Fields. Namely, the following purposes: Bookkeeping and reporting; Employee payroll; Protection of property, persons and IT security; Protection of rights and legal claims; Establishment, management and termination of employment relationships with employees; Fulfilling the business objective and achieving economic results. The following acts govern the processing of personal data at Cirkus park: 563/1991 Coll., the Accounting Act; 89/2012 Coll., the New Civil Code; 133/1985 Coll., the Fire Protection Act; 262/2006 Coll., the Labour Code; 326/1999 Coll., the Act on the Residence of Foreigners in the Czech Republic; 586/1992 Coll., the Income Taxes Act; 589/1992 Coll., the Act on Insurance Premiums for Social Security and Contributions to the State Employment Policy; 592/1992 Coll., the Act on General Health Insurance Contributions and the GDPR mentioned in the introduction. Cirkus park is the Data Controller within the meaning of the GDPR.
Cirkus park does not transfer any personal data to a recipient in a third country or an international organization to which the GDPR does not apply.
Cirkus park processes individual personal data only for as long as the legal grounds exist (i.e. as long as the act applicable to the relevant processing applies) or as long as the contractual relationship to which the data subject is a party continues. In the case of orders and bookings, this is a maximum of two years after the event. The processing dates are clearly listed in the Record of Processing – Summary of Fields. After the end of the processing period, the personal data is either shredded or anonymized.
Advice on a personal data subject’s statutory rights for the period until 24 May 2018 pursuant to Act No. 101/2000 Coll., on personal data protection:
In accordance with Sections 5, 11, 12 and 21 of Act No. 101/2000 Coll., on personal data protection, Cirkus park informs all natural persons whose personal data it processes (hereinafter a “Data Subject”) of the following legal rights:
Each Data Subject has the right to access personal data and the right to rectification of personal data. Any Data Subject who becomes aware or believes that the controller or processor is processing his/her personal data where the processing is contrary to the protection of privacy or the law (in particular where the data are inaccurate with regard to the purpose of the processing) may request an explanation or the rectification, completion or erasure of the data. If the request is justified, it will be implemented without delay. Otherwise, the Data Subject has the right to contact the Office for Personal Data Protection directly.
Advice on the legal rights of the Data Subject for the period from 25 May 2018 pursuant to Regulation (EU) No 2016/379 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”):
A natural person whose personal data is processed by Cirkus park (hereinafter the “Data Subject”) has and may exercise the following rights regarding Cirkus park:
request access to personal data that Cirkus park processes about the subject, which means the right to obtain confirmation from Cirkus park as to whether or not data are processed and, if so, to access them and other information pursuant to Article 15 of the GDPR;
request the rectification of personal data, if it is inaccurate or incomplete.
request the erasure of personal data in the cases referred to in Article 17 of the GDPR, in particular if the purpose or lawful grounds for the processing ceases.
request the restriction of data processing in the cases referred to in Article 18 of the GDPR;
obtain personal data relating to the Data Subject
that Cirkus park processes based on his/her consent; or
that Cirkus park processes for the performance of a contract to which the subject is a party or for the implementation of measures taken before the conclusion of the contract at his/her request
in a structured, commonly used and machine-readable format.
The Data Subject has the right to transmit such data to another controller, subject to the conditions and limitations set out in Article 20 of the GDPR and
the Data Subject has the right to object to processing within the meaning of Article 21 of the GDPR on grounds relating to his/her particular situation.
withdraw consent to the processing of personal data. This rescinding does not affect the lawfulness of data processing that took place before rescinding.
If Cirkus park receives a request from the Data Subject to exercise these rights, it will inform the Data Subject without undue delay and at the latest within one month of the measures taken. This period may be extended by a further two months if necessary.
In certain cases provided for in the GDPR, Cirkus park does not have to grant requests – in particular if the requests are manifestly unfounded, repeated or in breach of other legal regulations.
impose a reasonable fee taking into account the administrative costs involved in providing the information or communication requested or in carrying out the acts;
refuse to grant the request.
If Cirkus park does not take the measures requested by the Data Subject, it will promptly inform the Data Subject of the reasons the measures were not taken, within one month of receipt of the request.
If Cirkus park receives a request to exercise these rights, but has doubts about the applicant’s identity, it may request additional information to reliably identify the applicant.
For any comments and questions concerning the protection of personal data or to contact us regarding the exercise of your statutory rights, please use the following e-mail address: info@cirkuspark.cz or send a written request to: BOWNESSIE s.r.o. (Cirkus park), Director, Srbická 464, 415 01 Teplice.
If the Data Subject is not satisfied with the manner in which Cirkus park makes it possible to exercise his/her rights, he/she may contact the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, switchboard +420-234 665 111, e-mail address: posta@uoou.cz, www.uoou.cz.