Visitor Rules and GDPR

Visiting Rules

The company Výstaviště Praha, a.s., ID: 25649329, with its registered office at Výstaviště 67, 170 00 Praha 7, registered in the Commercial Register maintained by the Municipal Court in Prague, section B, file 5231, informs you about how it processes your personal data.

The processing of personal data is always carried out only to the extent given by the specific purpose of the processing. We process the processing of your personal data with due care and in accordance with the laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council, on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

If you have any questions, we will be happy to answer them. Please use email for your questions gdpr@prahaexpo.cz.

What personal data do we process?

We only process such personal data in order to provide and use services related to the operation of the Prague Exhibition Centre and related to the subject of our business, in order to comply with our legal obligations and protect our legitimate interests or the legitimate interests of visitors to the Exhibition Centre.

In particular, we process personal data of customers (tenants, visitors to the Exhibition Centre) and our suppliers.

In particular, we process the following categories of personal data:

• basic identification data
  
  • name and surname, date of birth, address of residence
  • in the case of entrepreneurs ID, TIN, address of registered office
• contact details
  
  • phone number, e-mail
• bank connection details
• data from the use of the website
• Other data
  
  • CCTV footage, license plates of cars

What sources does the personal data come from?

We process in particular the personal data we have received from you, as well as data from public registers.

We primarily process personal data that you provide to us or that arise from your activity through the websites operated by us. Where we particularly need to verify the accuracy of personal data, we enrich it with data from public registers such as trade registers or trade registers.

For what purposes do we process personal data and for what reasons?

We process your personal data to the extent necessary for the relevant purpose. We need to identify you for the conclusion of the contract, we also need the data in order to fulfill the concluded contract. The obligation to process personal data is also stipulated by law. For example, the law on the register of contracts. We have to process a large amount of personal data for archiving purposes. We process certain data because it is necessary for the protection of rights and interests protected by law. For example, it is about taking CCTV footage, when we try to prevent the commission of crimes.

In other cases, we process your personal data only on the basis of your consent.

Provision and use of services

• We process your identification data in order to conclude a contract with you.
• We process your contact data in order to fulfill the concluded contract. Likewise, so that you can provide the correct and timely fulfillment that we have ordered from you. We need the bank connection data so that we can pay you the price charged for the service, or to be able to pair your payment when you do not enter a variable symbol. We also need to disclose some of your personal data as part of fulfilling our obligations related to the register of contracts and maintaining the public procurement agenda.

In this way, we may process personal data because it is necessary to fulfill a contract to which you are a party, or to fulfill an obligation imposed on us by law, or because it is necessary to protect our legitimate interests.

Evaluation of the use of the website

• We process data about how you use our website. For this purpose, we use so-called cookies stored on your computer. We have informed you about the processing of so-called cookies in a separate document.

This is how we may process personal data because you have given us your consent to do so.

It's marketing

• As part of our marketing activities, we send commercial communications to our business partners in various forms, including the use of paper correspondence and e-mail. For this purpose, we only use your identification and contact information.

This is how we may process personal data because it is necessary to protect our legitimate interests.

• In order to present our activities to the public, in particular through presentations on websites or other promotional materials, we use photographs and videos.

This is how we may process personal data because you have given us your consent to do so.

Accounting and Taxation

• We process your identification data and data on completed transactions for the purpose of our accounting and tax obligations, which are imposed on us in particular by the Accounting Act and tax laws.

In this way, we may process personal data because it is necessary to comply with legal obligations and to protect our legitimate interests.

It's security

• We need to protect, in particular, the physical property of the Exhibition Centre and at the same time those who move in the premises against illegal acts — prevention and clarification of theft, vandalism or violent illegal acts. That's why we installed and operate a CCTV system. In this context, we process CCTV footage.

This is how we may process personal data because it is necessary to protect our legitimate interests.

Exercise and defense of rights

• If we enforce our claims through legal means or are parties to legal proceedings and these matters concern you, we use your identification data to the extent necessary, and the data necessary to prove our claim.

This is how we may process personal data because it is necessary to protect our legitimate interests.

Internal administration

• Our employees work with your data in the performance of their job duties in connection with the provision and use of the services we offer or receive. We also disclose certain data to the shareholder as part of the exercise of his shareholder rights.

In this way, we may process personal data because it is necessary to comply with legal obligations or to protect our legitimate interests.

When you do not provide us with personal data?

Not all personal information is required to be disclosed to us. The provision of personal data that you provide to us on the basis of your consent is voluntary. This is data about so-called cookies.

We must obtain all other personal data in order to fulfill the contract or obligations imposed on us by law, or to protect our own interests. These are identification and contact details, bank connections or CCTV footage.

Who can process your data?

Your data is processed mainly by us, the company Výstaviste Praha, a.s., ID: 25649329, with registered office at Výstaviště 67, 170 00 Praha 7, registered in the Commercial Register maintained by the Municipal Court in Prague, section B, file 5231.

If we entrust another person to perform a certain activity, the processing of the relevant personal data may take place. In some cases, these suppliers become processors of personal data. The processor is entitled to process the data exclusively for the purpose of carrying out the activities to which it has been entrusted by us as the controller.

In carrying out our activities, we may use the services of archiving service providers, lawyers and external consultants, printing and postal service providers, including couriers, insurance providers.

• The information is processed by up to 20 entities, a list of them can be submitted upon request.

We are also obliged by law to transfer certain personal data provided by you to state authorities.

We may also transfer personal data to our suppliers such as, in particular, archiving service providers, solicitors, printing and postal service providers, including couriers, insurance providers, our shareholder.

We do not transfer personal data to other countries of the European Union or to countries outside the European Union or to international organizations.

How long do we retain personal data?

We only store your personal data for a strictly long period of time, most often it is 10 years from the provision of the performance, since during this period we are obliged under tax laws to keep documents to prove the fulfillment. Most often, the period for which we can process personal data is determined by law.

Where the law does not specify the length of retention of personal data, we retain it for 10 years from the termination of the contractual relationship.

We process personal data obtained on the basis of your consent for the period for which you have given us your consent. We keep photos and videos of organized events for 3 years from their inception.

To whom do you give consent to the processing of personal data?

You consent to the processing of personal data to us, Výstaviste Praha, a.s., ID: 25649329, with registered office at Výstaviště 67, 170 00 Praha 7, registered in the Commercial Register maintained by the Municipal Court in Prague, section B, file 5231.

How can you withdraw consent to the processing of personal data?

If we want to process your data on the basis of your consent, its provision is voluntary and you can therefore refuse such consent. If you refuse your consent, we will no longer process your personal data.

When you give your consent to the processing of your data, you can revoke it at any time by sending an email to gdpr@prahaexpo.cz or a letter to the address Výstaviště Praha, a.s., Výstaviště 67, 170 00 Praha 7.

What legal rights do you have when processing personal data?

Right of access to personal data

• You have the right to ask us to provide information about the personal data processed about you, the purpose and nature of the processing of personal data, about the recipients of personal data, about the period for which we store personal data, about the right to file a complaint, about the source of personal data.

Right to rectification

• If you find that we are processing inaccurate or erroneous data about you, you have the right to ask us to correct such data.

Right to erasure (“right to be forgotten”)

• If we process your personal data for the purpose of fulfilling a purpose and that purpose has already ceased, we will automatically delete it. If we process your personal data on the basis of consent and you withdraw your consent, we will delete the personal data. Furthermore, it should be noted that the right to erasure is not absolute and if we have some objective obligation to keep personal data further (e.g. accounting), we will delete those personal data that we no longer need for the original purposes of processing.

Right to restriction of processing

• You have the right to restrict the processing of your personal data if:
  
  • you deny the accuracy of the personal data for as long as it takes for us to verify the accuracy of the personal data; or
  • the processing is unlawful and you refuse to delete the personal data and instead request a restriction of its use; or
  • we no longer need personal data for the purposes of processing, but you require it to establish, exercise or defend your legal claims; or
  • you have objected to the processing, and this time until it is verified that our legitimate reasons outweigh your legitimate reasons.

Right to object

• During the duration of the selection process, where we process your personal data, you have the right to object to this processing.

Right to privacy

• If you believe that we process personal data in violation of the protection of your private and personal life or in violation of the law, you can file a complaint about the violation of our obligations to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, tel. 234665111, web www.uoou.cz.

You can send your requests in writing to Výstaviště Praha, a.s., Výstaviště 67, 170 00 Praha 7, or by e-mail to gdpr@prahaexpo.cz.

How do we protect your personal data?

To protect your personal data, we have taken all technical and organizational measures to ensure the protection of personal data and to exclude the possibility of unauthorized or accidental access to personal data, accidental or unlawful destruction, loss, alteration, unauthorized transfers, other unauthorized processing of personal data, as well as other misuse of personal data.

We use modern security and control mechanisms, ensuring the maximum possible data protection. We use user access control, rights and role management system to ensure data protection against unauthorized access. All persons who come into contact with your personal data as part of the performance of their employment or contractual obligations must comply with the obligation of confidentiality, which arises directly for them from the legislation or has assumed it contractually. We only use processors that meet the conditions for the protection and security of personal data and we have concluded personal data processing agreements with all of them.