PRINCIPLES FOR THE PROCESSING AND PROTECTION OF PERSONAL DATA

The purpose of these Principles for the Processing and Protection of Personal Data (the “Principles”) is to provide the data subject with information about which personal data relating to natural persons are processed when the website operator provides its services, for what purposes and for how long the operator processes such personal data in accordance with applicable legal regulations, to whom and for what reason it may disclose them, and also to inform natural persons about the rights they have in connection with the processing of their personal data. The Principles are effective from 1 May 2022 and are issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”).

1. Controller of personal data, contact details for GDPR matters

The controller of personal data is WeMarry s.r.o., Company ID No. (IČO) 22269347, with its registered office at Hořanská 1510/1, Žižkov, 130 00 Prague 3 (the “Controller”). Any questions concerning the processing of personal data may be sent to the Controller’s registered office address or to the e-mail address info@wemarry.io.

2. Scope of processing and categories of personal data processed

Personal data are processed to the extent that the data subject concerned has provided them to the Controller in connection with the conclusion of a contractual or other legal relationship with the Controller, or that the Controller has collected otherwise and processes in accordance with applicable legal regulations or to fulfil the Controller’s legal obligations. The Controller processes the following categories of personal data:

a) first name and surname, or academic title where applicable,

b) business name,

c) Company ID No. (IČO), Tax ID No. (DIČ),

d) permanent residence address,

e) address of the registered office or place of business,

f) delivery address,

g) contact e-mail address,

h) contact telephone number,

i) job position and/or role in a company,

j) bank account details,

k) profile photograph,

l) biographical data,

m) data on the date and place of the wedding,

n) personal preferences,

o) records of behaviour on websites administered by the Controller obtained from cookies, where cookies are enabled in the web browser.

3. Purpose of processing personal data

3.1 Processing for the performance of a contract, the fulfilment of legal obligations and the legitimate interests of the Controller

Providing the personal data necessary for the performance of a contract, the fulfilment of the Controller’s legal obligations and the protection of the Controller’s legitimate interests is mandatory. Without the provision of personal data for these purposes, it would not be possible to provide the services. The Controller does not need the data subject’s consent to process personal data for these purposes.

The basic specific purposes of processing personal data are in particular:

a) processes related to identifying and possibly contacting the user (performance of a contract),

b) provision of services (performance of a contract),

c) billing for services, issuing tax documents (performance of a contract),

d) fulfilment of statutory tax obligations (fulfilment of legal obligations),

e) recovery of receivables from the user and other customer disputes (legitimate interest),

f) records of debtors (legitimate interest).

Personal data for these activities are processed to the extent necessary to carry out these activities and for the period necessary to achieve them or for the period directly laid down by legal regulations. The personal data are then erased or anonymised. The basic periods for processing personal data are set out below in Article 5 of the Principles.

3.2 Processing of customer data with their consent for marketing and commercial purposes

With the data subject’s consent, the Controller processes personal data for marketing and commercial purposes in order to possibly create a suitable offer of products and services and in connection with approaching the customer, exclusively by means of electronic communication via the contact e-mail address. Giving consent for marketing and commercial purposes is voluntary and the data subject may withdraw it at any time. This consent remains valid for 5 years from the date it was given, or for the period of use of the Controller’s services and the following 5 years thereafter, or until the data subject withdraws it. All categories of data listed in Article 2 of these Principles may be processed for marketing and commercial purposes on the basis of consent. If the data subject withdraws their consent, this does not affect the processing of their personal data by the Controller for other purposes and on other legal grounds in accordance with these Principles.

3.3 Processing of cookies from websites operated by the Controller

If the data subject has cookies enabled in their web browser, the Controller processes records of their behaviour from cookies placed on websites operated by the Controller, for the purpose of ensuring better operation of the Controller’s websites or for the purposes of the Controller’s online advertising. Where consent to the processing of personal data for marketing and commercial purposes has been given, these data are processed together with the other personal data for that purpose.

4. Method of processing and protection of personal data

Personal data are processed by the Controller. Processing is carried out at its establishments and registered office by individual authorised employees of the Controller, or by a processor where applicable. Processing takes place by means of computer technology, or also manually in the case of personal data in paper form, in compliance with all security principles for the management and processing of personal data. To this end, the Controller has adopted technical and organisational measures to ensure the protection of personal data, in particular measures to prevent unauthorised or accidental access to personal data, their alteration, destruction or loss, unauthorised transfers, their unauthorised processing, and any other misuse of personal data. All entities to which personal data may be made accessible respect the data subjects’ right to privacy and are obliged to act in accordance with applicable legal regulations on the protection of personal data. When the Controller processes personal data, no automated decision-making within the meaning of Article 22 GDPR takes place.

5. Period of processing personal data

Personal data are processed for the period necessary for the purposes for which they are processed, in accordance with the periods set out in the relevant contracts, in the Controller’s filing and shredding rules or in the relevant legal regulations. The period for which personal data will be stored is determined as follows:

a) In the case of customers of the services, provided that they have fulfilled all their obligations towards the Controller, the Controller is entitled to process in its customer database their basic personal, identification and contact data, data on services and data from their communication with the Controller for 4 years from the date of termination of the last contract with the Controller.

b) In the case of negotiations between the Controller and a potential customer on the conclusion of a contract that did not result in the conclusion of a contract, the Controller is entitled to process the personal data provided for 6 months from the end of the pre-contractual negotiations.

c) Tax documents issued by the Controller are archived, in accordance with Section 35 of Act No. 235/2004 Coll., on Value Added Tax, for 10 years from the end of the tax period in which the supply took place. Because the legal basis for issuing invoices must be documented, customer contracts are also archived for 10 years from the date of termination of the contract.

6. Categories of recipients of personal data

In fulfilling its contractual commitments and obligations, the Controller uses the professional and specialised services of other entities. Where these suppliers process personal data transferred by the Controller, they have the status of processors of personal data and process personal data only within the Controller’s instructions and may not use them in any other way. These are in particular payment gateway providers, attorneys, accountants, auditors, IT system administrators, online advertising providers or commercial agents. The Controller carefully selects each such entity and concludes with each of them a data processing agreement in which the processor is subject to strict obligations to protect and secure personal data.

7. Rights of data subjects

In accordance with the GDPR, the data subject has the rights listed below. Where these are rights against the Controller, the data subject is entitled to exercise them at the contact addresses given in Article 1 of these Principles.

7.1 Right of access to personal data

Under Article 15 GDPR, the data subject has the right of access to personal data, which includes the right to obtain from the Controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, the right to access those personal data and information about:

a) the purposes of processing,

b) the categories of personal data concerned,

c) the recipients to whom the personal data have been or will be disclosed,

d) the envisaged period of processing,

e) the existence of the right to request from the Controller rectification or erasure of personal data concerning the data subject or restriction of their processing, or to object to such processing,

f) the right to lodge a complaint with a supervisory authority,

g) any available information as to the source of the personal data, where they are not collected from the data subject,

h) the existence of automated decision-making, including profiling,

i) appropriate safeguards for the transfer of data outside the EU.

Where the rights and freedoms of other persons are not adversely affected, the data subject also has the right to request a copy of the personal data processed. In the case of a repeated request, the Controller is entitled to charge a reasonable fee for the copy of the personal data.

7.2 Right to rectification of inaccurate data

Under Article 16 GDPR, the data subject has the right to rectification of inaccurate personal data, or completion of incomplete personal data, which the Controller processes about them. The data subject is obliged to notify changes to their personal data and to provide evidence that such a change has occurred. They are also obliged to cooperate with the Controller if it is found that the personal data the Controller processes about them are not accurate.

7.3 Right to erasure

Under Article 17 GDPR, the data subject has the right to erasure of personal data concerning them, unless the Controller demonstrates legitimate grounds for processing those personal data.

7.4 Right to restriction of processing

Under Article 18 GDPR, the data subject has the right, until their request is resolved, to restriction of processing if they contest the accuracy of the personal data or the grounds for their processing, or if they object to their processing. Where processing has been restricted, the personal data concerned may, with the exception of their storage, be processed only with the data subject’s consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the EU or of a Member State.

7.5 Controller’s notification obligation regarding rectification or erasure of personal data or restriction of processing

In the event of rectification, erasure or restriction of processing of personal data, the Controller is obliged under Article 19 GDPR to inform the individual recipients of the personal data of this fact, except where this proves impossible or involves disproportionate effort. At the data subject’s request, the Controller will provide the data subject with information about those recipients.

7.6 Right to portability of personal data

Under Article 20 GDPR, the data subject has the right to portability of the data concerning them which they have provided to the Controller, in a structured, commonly used and machine-readable format, and the right to request the Controller to transmit those data to another controller, where the processing of personal data was based on the conclusion and performance of a contract or on the data subject’s consent and the processing is carried out by automated means. Where the exercise of this right could adversely affect the rights and freedoms of third parties, such a request cannot be granted.

7.7 Right to object to the processing of personal data

Under Article 21 GDPR, the data subject has the right to object to the processing of their personal data on the grounds of the Controller’s legitimate interest. If the Controller does not demonstrate that there are compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, the Controller will end the processing without undue delay on the basis of the objection.

7.8 Right to withdraw consent to the processing of personal data

Consent to the processing of personal data for marketing and commercial purposes may be withdrawn at any time. The withdrawal must be made by an express, clear and definite expression of will. The processing of data from cookies can be prevented by adjusting the settings of the web browser.

7.9 Right to be informed of a personal data breach

Under Article 34 GDPR, the data subject has the right to be informed by the Controller without undue delay of a breach of the security of personal data received by the Controller, where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

7.10 Right to contact the Office for Personal Data Protection

The data subject has the right to contact the Office for Personal Data Protection (ÚOOÚ) (www.uoou.cz) if they find or believe that the Controller or a processor is processing their personal data contrary to the protection of the data subject’s private and personal life or contrary to the relevant legal regulations.