Privacy Policy

INFORMATION ON PROCESSING PERSONAL DATA for clients and suppliers
according to the General Data Protection Regulation (GDPR)

The Company provides information about the processing of personal data provided by the data subject to the data controller in the context of the commencement of the activity in the performance of a contractual relationship:

The English version of this document is a translation of the Czech version, which is provided to international visitors for their convenience. From a legal point of view, the Czech original, which is published here on the website and complies with all applicable EU directives and regulatory provisions, is the governing text.

(1) The data controller:
The controller of the personal data is AV Medical CZ s.r.o.
Contact person: Alexandros Valsamis
Tel: +420 241 773 869
E-mail: [email protected]

(2) Purpose of processing:
The data controller will process the personal data of the data subject for the purpose of fulfilling the contractual relationship in the field of sale of medical technologies and consumables, including related activities.

(3) Legal basis:

• Consent of the data subject: for marketing purposes.
• Performance or conclusion of the contract: for the purpose of supplying goods and services
• Legal obligation (Act No. 89/2012 Coll., the Civil Code; Act No. 499/2004 Coll., on archiving and filing services; Act No. 455/1991 Coll., the Trade Licensing Act; Act No. 563/1991 Coll., on accounting; Act No. 235/2004 Coll., on value added tax)
• Legitimate interest: for the purposes of direct marketing and reporting of the company’s activities

(4) Personal data processors:
Personal data is provided by the data controller for further processing to external providers of accounting services, legal services, transport companies, whose identity will be disclosed to the data subject upon request.

(5) Other recipients:
The data controller may, for legitimate interest reasons, disclose the personal data provided by the data controller to authorised contractors in the field of IT services and technology, marketing services, consulting services, certification services, whose identity will be disclosed to the data subject on request.
Due to the necessary transfer, backup and archiving of electronic data, personal data is provided outside the EU (authenticated cloud services with servers outside the EU of Google, Inc.).

(6) Other third parties:
The Data Controller provides personal data to the relevant public authorities or other entities authorised to process personal data for the purposes of state surveillance, prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the protection against and prevention of threats to public security.

(7) Other processing purposes:
The data controller may also use the personal data provided for commercial and marketing purposes.

(8) Duration of storage of personal data:
The data controller shall retain the personal data for the duration of the performance of the contractual relationship and for the period imposed by law. An exception may be the retention of personal data for commercial and marketing purposes.

(9) Automated processing of personal data:
There is no automated processing of Personal Data in the Company.

(10) Rights of the data subject:
Right of access to personal data – the data subject has the right to access the personal data concerning him/her, the data controller is obliged to provide a copy of the personal data processed.
Right to rectification and completion of personal data – the data subject has the right to have inaccurate personal data concerning him or her rectified or completed by the data controller without undue delay.
Right to erasure – the data subject has the right to have personal data concerning him or her erased by the data controller without undue delay if:

• the personal data are no longer necessary for the purposes for which they were processed
• the data subject withdraws consent to the processing of the personal data
• the data subject objects to the processing
• the personal data have been unlawfully processed
• the retention of the personal data is not prescribed by other relevant legal provisions
• it is not in the public interest in the field of public health, archiving, scientific or historical research, statistics
• it is not for the exercise or defence of legal claims.
  Right to restriction of processing – the data subject has the right to have the data controller restrict the processing of personal data in justified cases.
  Right to data portability – the data subject has the right to obtain personal data concerning him or her in a structured, commonly used and machine-readable format and to transmit that data to another controller.
  Automated individual decision-making – the subject has the right not to be subject to any decision based solely on automated processing, including profiling, unless this is necessary for the performance of a contract.
  Right to lodge a complaint with a supervisory authority – the data subject has the right to lodge a complaint with a supervisory authority, i.e. the Office for Personal Data Protection.
  Right to object – the data subject has the right to object to the processing of personal data, the data controller may not further process the data in unjustified cases. An objection may be raised at any time against processing for direct marketing purposes.

(11) Failure to provide personal data:
The data subject must provide the personal data for legal reasons or as specified in the commercial contract, otherwise the performance of the commercial contract would be prevented.

(12) Other provisions:
If the data subject provides consent to the data controller for the processing of personal data or does not enter into a business relationship with the data controller and there are no other reasons for the processing, the personal data in written form will be shredded and the personal data in electronic form will be deleted.
Other personal data which the data subject has not personally provided to the data controller may be obtained from publicly available sources.