I. Basic Provisions
- The personal data controller pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”) is xITee k.s., ID No.: 27224830 (hereinafter the “Controller”).
- Contact details of the Controller:
address: Rybná 682/14, Prague 1, 110 00
email: firstname.lastname@example.org, email@example.com
phone: +420 234 262 311
- Personal data mean any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- The Controller has appointed a data protection officer. The Officer’s contact details are:
phone: +420 774 984 485
II. Sources and Categories of Processed Personal Data
- The Controller processes the personal data you have provided or the personal data the Controller has obtained based on fulfilling your request.
- The Controller processes your identification and contact information and data necessary to execute your request.
III. Legal Basis and Purpose of Personal Data Processing
- The legal basis for processing the personal data is
- the consent granted by the data subject to its personal data being processed for one or more specific purposes pursuant to Article 6(1a) of the GDPR,
- the legitimate interest of the Controller in providing direct marketing (in particular for sending commercial messages and newsletters, including services or merchandise of third parties) under Article 6(1f) of the GDPR.
- performance of contract based on the legitimate interest,
- legislative decree.
- The purpose of personal data processing is
- the selection procedure for the job position in question; for such purpose, the personal data required are necessary in order to include the applicant into the selection procedure (including the first and last name, address, phone number and e-mail). The provision of personal data is a necessary requirement for the selection procedure, and without it, it is not possible to include the applicant into the selection procedure,
- registering your person as a potential employee of the Controller; for such purpose, the personal data required are necessary to enter the applicant into the job applicant register (e.g. first and last name, address, phone number, e-mail etc.). The provision of personal data is a necessary requirement for entering the applicant into the register, and without it, it is not possible to enter the applicant into the register; the consent is granted for a period of 1 year from the date of submitting the personal data,
- processing enquiries sent to the Controller via the online contact form (including the first and last name, company name, e-mail, phone number and the text of your message),
- performing statistical analyses and research or adapting the content of its services (within the IP address),
- sending commercial communications, newsletters (including services or goods from third parties) and performing other marketing activities,
- records of customers and job applicants.
2. The Controller is not involved in automated individual decision-making within the meaning of Article 22 of the GDPR.
- maintaining User sessions; such cookies are essential for the Controller to be able to differentiate between individual Users when displaying the website and thus for displaying relevant data for specific Users only;
- basic settings for the Website and for Users who are not logged in that affect how the website is displayed according to the User’s preferences (e.g. when a user blocks certain graphic elements, such cookies allow such preference to be implemented) or the frequency and order of website browsing (e.g. during the first visit, information can be displayed that is not displayed during future visits).
- For more detailed information, please refer to the Terms and Conditions of Using Website or the Controller’s website: https://www.xitee.com/en/terms-and-conditions/.
V. Data Retention Period
- The Controller retains personal data
- for the period necessary to exercise the rights and obligations,
- for the period absolutely necessary when processing data to resolve enquiries,
- until the voluntary consent to process personal data is withdrawn in the case of registering your person as a potential employee, but no longer than 1 year from the date of submitting your personal data,
- until the voluntary consent to the processing of personal data for marketing purposes is withdrawn if personal data are processed under a consent.
- Upon the lapse of the retention period, the Controller shall erase the personal data.
VI. Recipients of Personal Data (Controller’s Subcontractors)
- The only recipients of personal data obtained from customers/job applicants are authorised employees of the Controller. We use all personal data solely for the internal use of the company, we protect them against misuse and do not provide them to third parties without prior notice or your consent.
- Exceptions are institutions which can receive personal data from the Controller based on legislative regulations (e.g. mandatory reports to state administration bodies, insurance companies, financial administration authorities etc.) or to the appropriate extent to selected service providers. We have entered into contractual relationships with such providers and such contain the necessary rules for handling personal data within the parameters required under Article 28 of the GDPR.
- Exceptions also include external companies (the processors below) which provide support services for us only to the extent necessary for processing purposes:
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for the purpose of processing stated in Article III under point 2 item d)
- Facebook, Facebook Headquarters, 1 Hacker Way, Menlo Park, CA 94025, for the purpose of processing stated in Article III under point 2 item e)
VII. Your Rights
- Under the conditions set out in the GDPR, you shall have
- the right to access your personal data pursuant to Article 15 of the GDPR,
- the right to rectify your personal data pursuant to Article 16 of the GDPR or to restrict processing pursuant to Article 18 of the GDPR.
- the right to erase your personal data pursuant to Article 17 of the GDPR.
- the right to object to processing pursuant to Article 21 of the GDPR and
- the right to data portability pursuant to Article 20 of the GDPR.
- the right to withdraw your consent to processing in writing or electronically using the address or e-mail of the Controller specified in Article I of these Terms.
- You shall also have the right to file a complaint with the Office for Personal Data Protection if you believe that your right to privacy has been violated.
- The Controller declares that it has taken the appropriate technical and organisational measures to secure the personal data.
- The Controller has taken the appropriate technical measures to secure the data storages and personal data storages in paper copies, in particular, by: management of access rights, data encryption, application firewall protection, regular backups and many other secondary measures performed by the Controller as the holder of the ISO 27001 Certificate (information security management system).
- The Controller declares that personal data can only be accessed by persons authorised by the Controller.
IX. Final Provisions
These Terms shall enter into effect as of: 25 May 2018