Personal Data Processing Policy at WELAPY

The purpose of this document is to provide you with a comprehensive and intelligible summary of information on the processing of personal data when using WELAPY, in particular how, to what extent, for what purpose and for how long we will process personal data, and to inform you of all your individual rights that you may exercise in connection with the processing of personal data.

If you do not understand anything in this document, please do not hesitate to contact us using the contact details below; we will be happy to explain everything in more detail.

We also refer in particular to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as well as Czech Act No. 110/2019 Coll., on the Processing of Personal Data, which adapts Czech law to that Regulation and under which our relationship in connection with the processing of personal data is primarily governed.

I. Who is the controller of your personal data?

The controller is generally the person who, alone or jointly with other entities, determines the purposes and means of the processing of personal data and bears the corresponding responsibility.

For the purposes of this Personal Data Processing Policy, the controller is Welapy s.r.o., Company ID No. 084 48 558, with its registered office at Rohanské nábřeží 693/10, Prague 8, 186 00, registered in the Commercial Register maintained by the Prague 8 Municipal District Authority, C.

You may contact the controller by email at info@welapy.cz.

II. Data Protection Officer

No Data Protection Officer has been appointed.

III. Our main principles

When processing your personal data, we honour and respect the highest data protection standards and, in particular, observe the following principles:

  • we process your personal data for specified purposes, by specified means and in a specified manner, and only for the period strictly necessary in view of the purposes of the processing;
  • we protect your personal data and ensure that it is processed with the highest level of security in order to prevent any unauthorised or accidental access to, alteration, destruction or loss of your personal data, unauthorised transfers, or other unauthorised processing;
  • we comply with appropriate technical and organisational measures to ensure a level of security appropriate to all possible risks; all persons who come into contact with personal data are obliged to maintain confidentiality regarding information obtained in connection with the processing of such data.

IV. What personal data do we collect?

The nature of the personal data that we collect from you and subsequently process depends primarily on the nature of your relationship with us and the purpose for which the personal data is collected.

In particular, we will collect the following types of information from you:

Identification data

Your first name, surname, title, gender, date of birth, residential address, nationality, identification number (if you are an entrepreneur), registered office or place of business address (if you are an entrepreneur), and signature.

Contact details

Residential address, correspondence address, email address, telephone number, or other details that you provide to us for the purpose of contacting you or using our services.

Records of our mutual communication

In particular, records of email or written communication between us. We do not use a telephone call recording system.

Data about your activity on WELAPY

We will obtain information about the services you offer or request on WELAPY, including their price and the address where they are provided.

Billing data

Data from issued invoices or other data relating to our mutual transactions (for example, where we act as a collection point for payments for you).

Other data

For example, data that we obtain from your internet browser, mobile phone or through the storage of cookies.

V. How do we obtain personal data?

You provide us with personal data primarily on a voluntary basis, in person, by telephone, by completing forms, by setting up user accounts, or as part of information and data provided for the purpose of using WELAPY. We also obtain personal data through our own activities. We may further obtain personal data from third parties with whom we cooperate or have another relationship and which are entitled to process and share your personal data.

VI. For what purposes do we collect personal data?

We use your personal data for purposes arising from our activities. For most such processing, we do not need to obtain your consent because processing is permitted directly by legislation. We are also entitled, where applicable, to process personal data or categories thereof for different purposes.

If your consent is required for a particular purpose, you may withdraw it at any time during the period for which it was granted. Please note that withdrawal of consent takes effect only for the future and therefore does not affect the lawfulness of processing before its withdrawal.

The specific main purposes of processing personal data are as follows:

  • operation of WELAPY – the legal basis for this processing is the conclusion and performance of a contract and the protection of our legitimate interests;
  • conclusion and performance of cooperation agreements or other agreements with our partners – the legal basis for this processing is the conclusion and performance of a contract;
  • communication with you and other persons in the course of our activities and for the purpose of improving our services – the legal basis for this processing is the conclusion and performance of a contract and the protection of our legitimate interests;
  • direct marketing (sending newsletters or other marketing emails, SMS messages or similar activities) – the legal basis for this processing is the protection of our legitimate interests;
  • in connection with direct marketing (sending newsletters, marketing emails, SMS messages or similar activities) – we do not use any data obtained through Google Calendar, Google OAuth or other Google services. We obtain all contact details for marketing purposes exclusively from users who have provided them voluntarily outside the scope of a Google integration;
  • providing assistance to public authorities – the legal basis for this processing is the fulfilment of our legal obligations;
  • establishment and protection of legal rights; protection of our privacy, security or property and/or the rights of you or other persons; and seeking available remedies or limiting our damage – the legal basis for this processing is the protection of our legitimate interests and the fulfilment of legal obligations applicable to us.

VII. How long will we retain your personal data?

We take all steps to ensure that the personal data we collect and process is appropriately safeguarded and serves its intended purpose. We will therefore retain personal data only for the period necessary, in accordance with the principle of data minimisation. We continuously assess whether there remains a need to process certain personal data required for the relevant purpose. If we find that it is no longer needed for any of the purposes for which it was processed, we will delete it.

Below are examples of some of the retention periods we observe in this context:

  • personal data in connection with the performance of our contract is retained for a period corresponding to the applicable limitation periods;
  • if we obtain certain personal data from you before a contract is concluded and the contract is ultimately not concluded, we will retain the personal data for a maximum of one year from its collection;
  • for direct marketing purposes, we retain personal data for the duration of our contractual relationship and for a maximum of one year after it ends;
  • if you give us consent to process personal data for a purpose other than direct marketing, we will retain such personal data for the period stated in that consent or until you withdraw it;
  • accounting and tax records that document our accounting and fulfil tax obligations (and may contain billing personal data in particular) are retained for the period prescribed by special legislation, starting from the end of the relevant accounting or tax period.

VIII. With whom do we share your personal data?

As a rule, we process your personal data internally. However, where necessary to achieve any of the purposes above, we may share your personal data with third parties acting as processors, independent controllers or joint controllers. In such cases, we undertake to transfer personal data only to entities that guarantee a sufficient level of protection in accordance with data protection legislation. In some cases, we are also obliged to provide your personal data to public authorities where required by law. Finally, we share certain personal data with third parties on the basis of your prior consent.

Subject to the conditions above, we may make your personal data available to:

  • our contractual partners and service providers – we share personal data in order to provide our services with other entities, such as service providers, postal and transport service providers, IT service providers, debt collection entities, law firms, accounting and tax advisers, and providers of printing, advertising and marketing services;
  • public authorities and third parties involved in judicial or similar proceedings – in compliance with our other legal obligations, we are obliged to provide your personal data to competent public authorities, such as law enforcement authorities. In the event of a dispute, your personal data will also be shared with third parties participating in such proceedings;
  • other third parties – we are also entitled to share personal data, for example, with payment recipients, service providers and, in emergency situations, fire, police and medical emergency services.

IX. What rights do you have in connection with the processing of personal data?

In connection with the processing of personal data, you have a number of rights that you may exercise against us using the contact details above.

Your request to exercise any of the rights below will be handled no later than within one month (or within three months in justified cases, in which case we will inform you in advance and in a timely manner of the extension). We will not charge you a fee. However, if we receive a manifestly unfounded or excessive request (for example, a repeated request within a short period), we are entitled to charge a reasonable administrative fee to cover the costs of handling that request.

  • Right of access to your personal data – you have the right to request information as to whether we process your personal data and, if so, to obtain an extract of that data as well as information about the purposes for which we process it and the period for which we intend to retain it. We will provide the first copy of the processed data free of charge; we may charge an administrative fee for each additional copy to cover our costs.
  • Right to rectification and completion of your personal data – if you find that the personal data we process about you is inaccurate, out of date or incomplete, you may ask us to rectify or complete it.
    • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; or
    • you have withdrawn your consent on the basis of which we processed the personal data (and there is no other legal basis for processing); or
    • you have successfully objected to the processing and there are no overriding legitimate grounds for the processing; or
    • the personal data has been processed unlawfully; or
    • the personal data must be erased in order to comply with our legal obligation.
    • we have your consent; or
    • it is necessary for the establishment, exercise or defence of our legal claims; or
    • it is necessary for the protection of the rights of other natural or legal persons.
    • you have objected to the processing and verification is pending as to whether our legitimate grounds override your objection.
  • Right to data portability – where processing is based on your consent or for the conclusion or performance of a contract, you have the right to request that we provide you with the personal data concerning you in a structured, commonly used and machine-readable format, or to have that data transmitted to another controller.
  • Right to object – you have the right to object to the processing of personal data carried out for the purposes of our legitimate interests. If we cannot subsequently demonstrate compelling legitimate grounds for such processing which override your interests, rights and freedoms, or which are necessary for the establishment, exercise or defence of legal claims, the processing of your personal data will cease.
  • You also have the right to object at any time to the processing of your personal data for direct marketing purposes. If you raise such an objection, the personal data will no longer be processed for those purposes.
  • Right to withdraw your consent to the processing of personal data – if we rely on your consent to process your data, you are entitled to withdraw that consent at any time. Withdrawal of consent takes effect only for the future and therefore does not affect the lawfulness of previous processing. The withdrawal must state who is withdrawing it (therefore include your first name, surname, residential address, date of birth and, where applicable, other identification details) and which specific consent you are withdrawing and to what extent.
  • You have the right to lodge a complaint with the Office for Personal Data Protection – if, for any reason, you consider that the processing of your data is not being carried out properly, you may contact the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.cz, telephone: +420 234 665 111.

X. Do we use automated individual decision-making?

In the course of our activities, we do not process any personal data automatically and do not use automated decision-making.

XI. Personal data of other persons

If you provide us with personal data of other persons, you undertake to: (i) inform those persons of the contents of this document; and (ii) obtain all consents required by law for the collection, use, disclosure and transfer (including international transfer) of those persons' personal data in accordance with this document.

XII. Do we transfer personal data to a third country or international organisation?

We will not transfer personal data to countries outside the European Union or the European Economic Area, or to any international organisation, unless we are obliged to do so in order to fulfil our legal obligations.

XIII. Do we use data analytics services?

For the possible personalisation of the content of our websites, we use data analytics services, in particular Google Analytics.

However, we always request your prior consent during each visit to our websites in order to use or store your cookies.

XIV. Cookies

We use cookies only where their use and processing is necessary for technical storage on our website or for the operation of WELAPY. Any use of cookies other than that stated above takes place only on an opt-in basis, i.e. when you give your consent to such use. You may withdraw this consent at any time.

Among other things, we use third-party services to store cookies, such as Google Ads, Google Analytics, Sklik, Meta (Facebook, Instagram), Adwords 360, Ecomail, Lookerstudio and payment gateways (such as Google Pay).

XV. Security

In an effort to ensure the greatest possible security of your personal data, we take appropriate technical, physical, legal and organisational measures in accordance with applicable privacy and data security laws. If you have reason to believe that your communication with us is no longer secure (for example, if you believe that the security of any personal data entrusted to us has been compromised), please notify us immediately using the contact details above.

This Policy is valid and effective from 1 February 2024.