Privacy and Personal Data Protection Policy
We, the Archa Theatre, with its registered office at Na Poříčí 1047/26, Prague 1, 110 00, identification no.: 26723000 (the "Archa Theatre"), are aware of the importance of protecting the personal data of our visitors and other customers, and therefore we have decided to adopt this general privacy policy (the "Policy"). This Policy applies to all processing of personal data that takes place within the activities of the Archa Theatre, and thus applies to the processing of personal data of our visitors and other customers, employees, suppliers and artists working in our theatre. The Archa Theatre processes personal data of data subjects in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC effective from 25 May 2018 (the "GDPR") and other legal regulations governing the issue of personal data protection, in particular Act No. 110/2019 Coll., on Personal Data Processing.
1 CONTACT INFORMATION
1.1 The Archa Theatre hereby informs you about the following contact details:
(a) Mailing address: Na Poříčí 1047/26, Prague 1, 110 00
(b) Tel.: +420 221 716 111
(c) E-mail address: archa@divadloarcha.cz
(d) Contact person in matters of personal data processing: Zbyněk Ondřich, e-mail: zbynek.ondrich@divadloarcha.cz
2 SOURCES OF PERSONAL DATA
2.1 The Archa Theatre mainly obtains personal data directly from data subjects, through orders and inquiries from data subjects, e-mail communication, telephone communication, websites, the contact form on our website, social networks, business cards, etc. We also collect personal data from publicly accessible registers, lists and records (e.g. the Commercial Register, Trade Licensing Register, Land Register, public telephone directory, etc.).
3 SCOPE OF PERSONAL DATA PROCESSING
3.1 Personal data are processed to the extent that the relevant data subject provided them to the Archa Theatre, in connection with the conclusion of a contractual or other legal relationship with the Archa Theatre, or which our company collected otherwise and processes in accordance with applicable law or to fulfil our legal obligations.
4 PROCESSING OF PERSONAL DATA OF VISITORS TO OUR THEATRE AND OTHER CUSTOMERS
4.1 To ensure the proper provision of our services, we must process personal data of visitors to the Archa Theatre and our other customers ("Clients"). We also process personal data of those data subjects who have not yet become our Clients, but in some way have shown interest in using our services. We mainly process the following categories of personal data of these data subjects:
(a) first name, surname
(b) contact and/or mailing address
(c) e-mail
(d) telephone number
(e) data on provided services
(f) photographs
(g) video record
(h) payment information.
4.2 Fulfilment of the contract for the provision of services or another contract between the Client and the Archa Theatre
(a) We process the personal data of our Clients primarily for purposes related to the fulfilment of obligations under the concluded contract for the provision of our services, or in connection with the implementation of measures necessary for the conclusion of such a contract. In such a case, the legal basis of processing is Art. 6 (1) (b) GDPR. The processing of your personal data is therefore necessary in particular for the following purposes:
(i) negotiations on the intention to enter into a contractual relationship with us and the fulfilment of the contractual relationship that arose between the Archa Theatre and you, especially on the basis of a contract, order, inquiry, etc.;
(ii) answering your questions, requests or other comments sent to the Archa Theatre;
(iii) provision of other services and performance related to the subject of the concluded contractual relationship, including the organization of the provision of our services.
(b) The provision of your personal data and their subsequent processing for these purposes is a prerequisite for concluding a contract between you and the Archa Theatre. Failure to provide the required personal data by you may result in the impossibility of fulfilling the contract and therefore its invalidity from the beginning.
(c) We process the personal data in question for the duration of the contractual relationship between you and the Archa Theatre. In justified cases, the processing time of personal data may exceed the duration of the contractual relationship, especially due to the exercise of legal claims of the Archa Theatre from already expired contracts. The Archa Theatre undertakes that the period of processing personal data in this case will never exceed the statutory limitation period of 10 years.
4.3 Legitimate interests of the Archa Theatre
(a) The personal data of our Clients may also be processed for the purposes of our legitimate interests in the documentation of our performances and presentations on the websites and social networks of the Archa Theatre, as well as for purposes related to optimizing and improving the quality of our services, as well as for purposes of security and protection of health and property. In such a case, the legal basis of processing is Art. 6 (1) (f) GDPR. The processing of your personal data is therefore necessary in particular for the following purposes:
(i) the legitimate interest of the Archa Theatre in the documentation of past performances, concerts and other events organized by the Archa Theater and the presentation of this documentation on the Archa Theatre website and social networks;
(ii) the legitimate interest of the Archa Theatre in the live broadcast of ongoing performances, concerts and other events organized by the Archa Theatre on the Archa Theatre website and social networks;
(iii) improvement of the quality of provided services and possible development of new services, e.g. websites, competitions, etc. Development of new services and improvement of existing ones occurs by identifying Clients' needs and wishes through telephone calls, questionnaires, website analyses, interest in certain services and texts, etc.;
(iv) the legitimate interest of the Archa Theatre in sending commercial messages to its Clients;
(v) the legitimate interest of the Archa Theatre in the operation of the camera system in our company's building in order to ensure the protection of health and property;
(vi) the defence of our legal claims.
(b) The processing of the personal data in question for these purposes is based on our legitimate interests, except where those interests are superseded by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular if the data subject is a child. In case of any doubts in relation to our legitimate interests, you have the right to contact us at any time with an objection to processing under the conditions and in the manner specified in this Policy.
(c) We process the personal data in question for a period appropriate to the duration of our legitimate interest. The Archa Theatre undertakes that the processing time of personal data will never exceed 10 years in this case.
4.4 Fulfilment of the Archa Theatre's legal obligations
(a) The Archa Theatre has a duty to comply with all laws of the Czech Republic, especially the laws in the area of billing our services and bookkeeping and tax records. In such a case, the legal basis of processing is Art. 6 (1) (c) GDPR. The provision of your personal data is therefore a legal requirement in these cases. Failure to provide the required personal data by you may be sanctioned by applicable law.
(b) The Archa Theatre is also obliged to pass on your personal data to the relevant state administration bodies, either under a legal obligation or upon request. These bodies can be, for example, a tax office, a court or other bodies. In such cases, the transfer of personal data will take place only in accordance with the rules laid down in the relevant legislation or decision of the authority concerned.
(c) For these purposes, we process personal data for the period specified by applicable law. If you are interested in more detailed information, please contact us via the above contact details.
4.5 Your consent to personal data processing
(a) We also process the personal data of our Clients based on their expressed consent to processing. In such a case, the legal basis of processing is Art. 6 (1) (a) and Art. 7 of the GDPR. The processing of your personal data is therefore necessary in particular for the following purposes:
(i) sending and distributing our newsletter or other commercial messages;
(ii) presentation of our company on our website;
(iii) use in marketing and promotional materials in paper and electronic form, including our websites and social networks.
(b) For these purposes, we process personal data until your consent is revoked, for a maximum period depending on the specific consent granted. You acknowledge that personal data may remain on already printed and distributed physical media after that period.
5 PROCESSING OF PERSONAL DATA OF VISITORS TO OUR WEBSITE
5.1 The Archa Theatre is the operator of the divadloarcha.cz website. For this reason, to ensure the optimal functioning of this website and its optimization, we must process the following personal data about visitors to our website:
(a) IP address;
(b) cookies.
5.2 Legitimate interests of the Archa Theatre
(a) We process personal data of visitors to our website primarily for the purposes of our legitimate interests in ensuring the functionality of our website, its optimization and continuous updating. In such a case, the legal basis of processing is Art. 6 (1) (f) GDPR. The processing of your personal data is therefore necessary in particular for the following purposes:
(i) ensuring the functionality of our website;
(ii) performing analyses and measurements, e.g. of traffic, readability, number of pages viewed, the device from which you come to our website and more. We collect this data through anonymized data in order to be able to offer quality content that is relevant to users and to develop services that visitors to our site are clearly interested in;
(iii) improvement of the quality of provided services and possible development of new services, e.g. development of websites, competitions, etc. Development of new services and improvement of existing ones occurs by determining the needs and wishes of visitors to our website through analyses on websites, interest in certain services and texts, etc.
(b) The processing of the personal data in question for these purposes is based on our legitimate interests, except where those interests are superseded by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular if the data subject is a child. In case of any doubts in relation to our legitimate interests, you have the right to contact us at any time with an objection to processing under the conditions and in the manner specified in this Policy.
(c) We process the personal data in question for a period appropriate to the duration of our legitimate interest. The Archa Theatre undertakes that the processing time of personal data will never exceed 3 years in this case.
6 PROCESSING OF PERSONAL DATA OF OUR EMPLOYEES
6.1 The Archa Theatre also processes personal data as an employer. To fulfil its obligations under concluded employment contracts, as well as relevant legislation, the Archa Theatre processes the following categories of personal data in connection with the employment of our employees:
(a) First name and surname; birthdate; birth registration number; sex; nationality;
(b) Residence address; telephone number; e-mail address;
(c) Job; place of work; salary data; record of the number of hours worked; bank account number; data on previous employers; professional history; educational attainment; other information contained in your CV;
(d) Marital status; data on children; other data needed to prepare a tax return;
(e) Data on work incapacity; details of medical examinations performed; disability data.
6.2 Fulfilment of an employment or other contract concluded with the Archa Theatre
(a) We process the personal data of our employees primarily for purposes related to the fulfilment of obligations under the concluded employment contract. The legal basis for processing in such a case is Art. 6 (1) (b) GDPR. Processing is especially necessary for the purpose of enabling the performance of your job duties, management, planning and organization of work, keeping personal files and records of employees, reporting working hours and providing payment under the contract. This purpose also includes the implementation of measures necessary to conclude the contract in question. The provision of personal data of our employees and their subsequent processing is a prerequisite for concluding a contract between the given employee and the Archa Theatre. Failure to provide the required personal data by the employee may result in the impossibility of fulfilling the contract and therefore its invalidity from the beginning.
(b) We process the personal data of our employees for the duration of the contractual relationship between the given employee and the Archa Theatre. In justified cases, the processing time of personal data may exceed the duration of the contractual relationship, especially due to the exercise of legal claims of the Archa Theatre from already expired contracts. The Archa Theatre undertakes that the period of processing personal data in this case will never exceed the statutory limitation period of 10 years.
6.3 Fulfilment of legal obligations in the field of employment law and social security law
(a) The Archa Theatre is obliged to comply with all laws of the Czech Republic, especially those in the areas of employment law, occupational safety and health, tax laws and laws governing social and health insurance. The personal data of our employees are therefore also processed for purposes relating mainly to payroll, compensation of employees, payment of mandatory contributions for employees, ensuring occupational safety and health, etc. The legal basis for processing in this case is Art. 6 (1) (c) GDPR. The provision of personal data of our employees is therefore a legal requirement in these cases. Failure to provide the required personal data by the employee may be sanctioned by applicable law.
(b) The Archa Theatre is also obliged to pass on the personal data of its employees to the relevant state administration bodies, either based on a legal obligation or upon request. These bodies can be, for example, a tax office, a social security administration or a court. In such cases, the personal data will be transferred only in accordance with the rules laid down in the relevant legislation or decision of the authority concerned.
(c) The Archa Theatre respects the special regime of processing the birth registration number, therefore it processes it exclusively in cases stipulated by law. The Archa Theatre processes the birth registration number mainly in connection with the taxation of the employee's income and the payment of social and health insurance contributions and for communication with state administration bodies.
(d) For these purposes, we process personal data for the period specified by applicable law. If you are interested in more detailed information, please contact us via our contact details above.
7 PROCESSING OF PERSONAL DATA OF OUR SUPPLIERS AND ARTISTS WORKING IN OUR THEATRE
7.1 The Archa Theatre also processes personal data about its suppliers and artists operating in our theatre ("Suppliers"). In order to fulfil its obligations under concluded artistic and supplier contracts, as well as the relevant legislation, the Archa Theatre processes the following categories of personal data about its Suppliers:
(a) First and last name; date of birth; company ID no.; tax ID no.; birth registration number;
(b) Residence address; telephone number; e-mail address;
(c) Type of activity performed; the amount of the agreed remuneration; bank details;
7.2 Fulfilment of the Contract concluded with the Archa Theatre
(a) We process the personal data of our Suppliers primarily for purposes related to the fulfilment of obligations under the concluded contract. The legal basis for processing in such a case is Art. 6 (1) (b) GDPR. Processing is necessary in particular for the purpose of enabling the exercise of rights and obligations arising from the subject of the contract, the management, planning and organization of the performance of these obligations and the provision of performance under the contract. This purpose also includes the processing of personal data in the negotiations necessary for the conclusion of the contract in question. The provision of the Supplier's personal data and their subsequent processing is a prerequisite for concluding a contract between the Supplier and the Archa Theatre. Failure to provide the required personal data by the Supplier may result in the impossibility of fulfilling the contract and therefore its invalidity from the beginning.
(b) We process the personal data of our Suppliers for the duration of the contractual relationship between the relevant Supplier and the Archa Theatre. In justified cases, the processing time of personal data may exceed the duration of the contractual relationship, especially due to the exercise of legal claims of the Archa Theatre from already expired contracts. The Archa Theatre undertakes that the period of processing personal data in this case will never exceed the statutory limitation period of 10 years.
7.3 Fulfilment of legal obligations in the field of invoicing and accounting
(a) The Archa Theatre has a duty to comply with all laws of the Czech Republic, especially those in the area of civil and commercial law, bookkeeping and tax laws. Personal data of our Suppliers are therefore also processed for purposes relating in particular to invoicing, accounting and tax agenda, etc. The legal basis for processing in such a case is Art. 6 (1) (c) GDPR. The provision of personal data is therefore a legal requirement in these cases. Failure to provide the required personal data by the Supplier may be sanctioned by relevant law.
(b) The Archa Theatre is also obliged to pass on the personal data of the Suppliers to the relevant state administration bodies, either on the basis of a legal obligation or upon request. These bodies can be, for example, a tax office, a social security administration or a court. In such cases, the transfer of personal data will take place only in accordance with the rules laid down in the relevant legislation or decision of the authority concerned.
(c) The Archa Theatre respects the special rules governing personal number processing, therefore it processes it exclusively in cases stipulated by law (especially in cases where the subject of the contract concerns the performance of activities pursuant to Section 3 (1) (b) of Act No. 455/1991 Coll., on Trade Licensing). The Archa Theatre processes birth registration number mainly in connection with the invoicing of the Supplier's services, bookkeeping and communication with state administration bodies.
(d) For these purposes, we process personal data for the period specified by applicable law. If you are interested in more detailed information, please contact us via the above contact details.
8 METHOD OF PROCESSING AND PROTECTION OF PERSONAL DATA
8.1 The Archa Theatre undertakes to comply with these main principles of personal data processing when processing your personal data:
(a) In storing, securing and further processing personal data, the Archa Theatre proceeds only in accordance with applicable legal regulations, especially in accordance with the GDPR;
(b) The Archa Theatre processes your personal data only for the purposes and in the manner resulting from this Policy;
(c) The Archa Theatre has appropriate technical and organizational measures in place to ensure an adequate level of security for your personal data. All personal data provided by the data subject to the Archa Theatre are secured by standard procedures and technologies, but it is not objectively possible to guarantee 100% security of the data subjects' personal data. In this context, the Archa Theatre regularly checks the security measures, which are then regularly updated as necessary;
(d) As a data subject, you always have the opportunity to contact the Archa Theatre at any time in a simple way, in any way specified in this Policy.
9 RECIPIENTS OF PERSONAL DATA
9.1 In addition to the employees and managers of the Archa Theatre, third parties may also be the recipients of your personal data. The Archa Theatre carefully selects its suppliers to whom it entrusts the data subjects' data and who are able to ensure such technical and organizational security of the data subjects' personal data as to prevent unauthorized or accidental access to or other misuse of this data.
9.2 In the context of legal relations, our suppliers are bound inter alia by a duty of confidentiality and may not use the data provided for any purposes other than those for which we have made them available and must also take additional measures to secure the personal data of data subjects.
9.3 Third parties who may have access to the data subjects' personal data, depending on the nature of the service which the data subjects use or have used, are:
(a) persons who provide for us the technical operation of a certain service or operators of technologies that we use for our services, in particular the operator of the GoOut.cz ticket sales system;
(b) persons who ensure and adequately test the security and integrity of our services and websites for us;
(c) providers of postal and communications services and electronic communications services;
(d) payment service providers and payment processors for the purpose of securing and executing payment transactions;
(e) business partners or sponsors who participate in the organization of our performances, concerts, events, conferences, seminars, etc.;
(f) authorized employees of the Archa Theatre;
(g) persons who enforce the claims of the Archa Theatre for us.
9.4 Under certain, precisely defined conditions, the Archa Theatre is obliged to transfer certain personal data of data subjects on the basis of applicable legal regulations, e.g. to the Police of the Czech Republic, the Tax Office, the Office for Personal Data Protection and other public administration bodies.
10 TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
10.1 The Archa Theatre does not intend to transfer personal data of data subjects to a third country. If personal data of a data subject are transferred to third countries outside the EU, this will be in accordance with legislative requirements and in any case the protection of personal data of data subjects will be ensured. The Archa Theatre undertakes to inform you immediately of any such transfer.
11 RIGHTS OF DATA SUBJECTS
11.1 In connection with the processing of personal data, data subjects may exercise the following rights:
(a) the right to request access to your personal data from the Archa Theatre;
(b) the right to request information from the Archa Theatre regarding the processing of your personal data;
(c) the right to correct your personal data;
(d) the right to supplement your incomplete personal data;
(e) the right to restrict processing. Processing restrictions mean that we must mark your personal data for which processing has been restricted and we may not continue to process them for the duration of the restrictions, except for their storage. You have the right to restrict processing if:
(i) you deny the accuracy of your personal data for the time necessary to verify the accuracy of your personal data;
(ii) the processing is unlawful and you refuse to delete the personal data and ask instead to restrict their use;
(iii) if we no longer need your personal data for processing purposes, but you request it for the purpose of determining, enforcing or defending legal claims;
(f) the right to delete your personal data. The Archa Theatre has the obligation to delete only in cases specified by the GDPR, unless it is prevented from doing so by other legal regulations (e.g. when the statutory retention period for personal data has already expired);
(g) the right to the transferability of your personal data. You may request that we provide you with your personal data in order to pass it on to another personal data controller, or that we may pass it on to another personal data controller. However, you only have this right with regard to the data that we process automatically on the basis of your consent or contract with you;
(h) the right to request information from the Archa Theatre regarding the transfer of your personal data to third parties;
(i) the right to lodge a complaint with the supervisory authority, if you believe that the processing of personal data violates personal data protection law. You can lodge a complaint with the supervisory authority at your place of habitual residence, place of employment or at the place where the alleged infringement took place. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz;
(j) the right to object to processing in cases specified by the GDPR.
11.2 If you believe that the Archa Theatre is processing personal data in violation of your right to the protection of your private or personal life, you may ask the Archa Theatre to provide an explanation and to remove this status.
11.3 You can exercise all rights through the contacts listed in this Policy.
12 INSTRUCTION
12.1 The content of our website is protected by the relevant provisions of intellectual property law. If you use the content of our website in any form, you must have our express written consent.
12.2 Archa Theatre clients acknowledge that during performances, concerts and other events organized by the Archa Theatre, or by any third party on the premises of the Archa Theatre, it is strictly forbidden to make any audio or video recordings or to provide any transmissions. Violation of this article of the Policy by the Client will give the Archa Theatre the right to pursue all its claims against the Client through the courts in civil proceedings. The Client also acknowledges that a breach of this article of the Policy may result in a penalty within the framework of administrative, criminal or other proceedings pursuant to the applicable legal regulations of the Czech Republic.
13 CHANGES TO THE POLICY
13.1 We reserve the right to amend this Policy if necessary, in particular with regard to the development of national legislation, the decision-making practice of the Office for Personal Data Protection and other recommendations and opinions of other bodies whose outputs relate to the field of personal data protection. We encourage you to review this Policy regularly to be informed of how we are helping to protect the personal data we process.
14 CONTACT
14.1 In case of any questions about the protection of personal data or withdrawal of consent to further processing of your personal data, you can contact us at the above contact details.
14.2 In this context, we would like to inform you that we may want you to prove your identity to us in an appropriate manner so that we can verify it. This is a precautionary measure to prevent unauthorized access to your personal data.
15 EFFECTIVENESS
15.1 This Policy is effective from 20 December 2019.