GDPR

Personal Data Processing Policy of Lesy České republiky, s.p.

Information on personal data processing at Lesy ČR, s.p.

Lesy České republiky, s.p., with registered office at: Přemyslova 1106/19, Nový Hradec Králové, 500 08 Hradec Králové, Company ID: 42196451, registered in the Commercial Register maintained by the Regional Court in Hradec Králové under file no. AXII 540 (hereinafter referred to as “Lesy ČR”) as the data controller considers all processed personal data confidential and handles it exclusively in accordance with the applicable legal regulations in the field of personal data protection. Ensuring the security of processed personal data is one of the priorities of the state enterprise Lesy ČR, and it pays due attention to it.

With regard to the above, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”), the state enterprise Lesy ČR fulfills the information obligation towards data subjects regarding the implemented personal data processing, informs them about the adhered principles of personal data processing, and about the possibility and method of exercising their rights related to the implemented personal data processing.

Purposes of personal data processing at the state enterprise Lesy ČR

The state enterprise Lesy ČR processes (in particular collects, records, stores, and uses) personal data of data subjects in the performance of its activities stipulated by legal regulations (in particular Act No. 289/1995 Coll., the Forest Act, as amended), the memorandum of association, the articles of association, and the object of business defined in the Commercial Register (i.e., in particular, the proper management of forest property owned by the state, its preservation, improvement, and development, the exercise of the right to manage forests owned by the state, and agricultural production).

Therefore, the state enterprise Lesy ČR may process your personal data for the following purposes:

Conclusion and performance of a contract – if you have a contract with the state enterprise Lesy ČR, your personal data are processed to the extent necessary for the possibility of its conclusion and performance by the state enterprise Lesy ČR; for this purpose, personal data of customers and suppliers (service providers) of the state enterprise Lesy ČR are processed in particular;
Fulfillment of a legal obligation – the state enterprise Lesy ČR always processes personal data to the extent stipulated by legal regulations, in particular the Forest Act, accounting and tax regulations;
Fulfillment of tasks carried out in the public interest or in the exercise of public authority with which the state enterprise Lesy ČR is entrusted – the state enterprise Lesy ČR processes your personal data to the extent necessary for the fulfillment of tasks carried out in the public interest or in the exercise of public authority; for this purpose, your personal data may be processed in particular within the framework of the proper management of forest property owned by the state, its preservation, improvement, and development;
Legitimate interests of the state enterprise Lesy ČR – your personal data may also be processed in cases where certain processing is a legitimate interest of the state enterprise Lesy ČR, and conversely, your rights and freedoms to privacy are not adversely affected by such processing; your personal data may be processed in particular for the purpose of ensuring the safety of persons and property by the state enterprise Lesy ČR or in the protection and enforcement of the rights of the state enterprise Lesy ČR;
Consent – the state enterprise Lesy ČR is entitled to process your personal data if you have given it your explicit consent for their processing for a specific purpose, for the duration of the validity of such consent or until the revocation of such consent; your personal data are processed on the basis of consent, for example, within the framework of marketing activities or monitoring website traffic of the state enterprise Lesy ČR.

The state enterprise Lesy ČR processes the following categories of personal data

The state enterprise Lesy ČR may process primarily the following categories of your personal data, always with regard to the extent necessary to achieve the given purpose of processing:

Identification data – these are all personal data through which we can uniquely identify you; specifically for a natural person: name, surname, title, date of birth, permanent address, identity card number (national ID card, passport), signature, Company ID (for a self-employed natural person); specifically for a legal entity: identification of statutory bodies and contact persons;
Contact details – these are all personal data through which we can contact you; specifically: delivery address, telephone number, e-mail address, and other similar information;
Payment details – these are all personal data related to the execution of payments, specifically: bank account number, bank identification, VAT ID, related transaction data;
Data relating to the performance of the contract – these are all personal data relating to the performance of the contract you have concluded with us, specifically: subject and date of deliveries, date and amount of payments, information from delivery notes, inspection sheets, handover protocols, and other similar documents.

Means of personal data processing

Personal data are processed by the state enterprise Lesy ČR both manually and automatically (through information systems). Automated processing of personal data takes place in particular for the purposes of recording and fulfilling contracts concluded by the state enterprise Lesy ČR.

Categories of recipients of personal data

The state enterprise Lesy ČR does not transfer the processed personal data to a third country or an international organization.

Only employees and persons cooperating on the basis of civil law contracts process personal data at the state enterprise Lesy ČR. The state enterprise Lesy ČR transfers the processed personal data to other controllers or processors only if it is necessary for the fulfillment of individual processing purposes, in accordance with the corresponding legal title for personal data processing (e.g., providers of postal and banking services, external legal and economic advisors, external providers of IT solutions, executors). Personal data may also be transferred on the basis of legal regulations to the relevant public authorities (e.g., courts, tax authorities).

Retention period of personal data

The state enterprise Lesy ČR processes (stores) personal data only for the period necessary to achieve the purpose of their processing (in particular for the duration of the contractual relationship), and further for the period of their mandatory storage according to legal regulations (in particular Act No. 499/2004 Coll., on Archiving and Records Management, as amended) and for the period necessary for the determination, exercise, or defense of its legal claims. We process personal data processed on the basis of your consent only for the period for which your consent was granted, or until the revocation of your consent.

Processing of personal data – websites

1. Cookies

Cookies are text files that the websites of the state enterprise Lesy ČR (https://lesycr.cz/) store on your computer or mobile device when you start using these websites. The websites thus remember for a certain period of time the actions you have performed on them, including preferences (e.g., login details, language, font size, and other display preferences), so you do not have to enter these data again and skip from one website to another.

If you have enabled cookies in your browser (you have agreed to their use by confirming the icon “consent to the use of cookies – Yes, I understand”) on the above-mentioned websites, the state enterprise Lesy ČR processes records of your behavior on these websites for the purpose of improving them and for marketing purposes. You can disable the storage of cookies in your browser settings. However, by disabling cookies, some functions of the above-mentioned websites may become unavailable to you.

2. Web analysis – use of Google Analytics

The state enterprise Lesy ČR uses Google Analytics provided by Google, Inc. to analyze the traffic of the websites of the state enterprise Lesy ČR (https://lesycr.cz/) and to improve them. Google Analytics uses cookies (see point 1 above). Non-personal (anonymized) data about users of the above-mentioned websites are thus collected. The information generated by the cookie about the use of the website is transferred by Google and stored on servers in the USA.

Google, Inc. uses this information for the purpose of evaluating the use of the above-mentioned websites and creating statistics. Google, Inc. may also transfer this anonymized information to third parties, if required by law or if these third parties process the information on behalf of Google, Inc. It does not associate the IP address of website users with any other data and information it has available. You can refuse the use of cookies by selecting the appropriate settings in your browser. Detailed information about Google Analytics and the protection of personal data when using them can be found at Google Privacy Policy.

3. Subscription to newsletters

Each user of the websites of the state enterprise Lesy ČR (http://lesycr.cz/) can subscribe to newsletters at the link available here. As part of the registration form, the user fills in their username and e-mail. These personal data of the user are processed by the state enterprise Lesy ČR for the purpose of providing the service to the user consisting in sending newsletters, until the user unsubscribes from this service.

4. Registration in the e-shop – seed plant in Týniště nad Orlicí

The state enterprise Lesy ČR operates on its websites e-shop of the Seed Plant Týniště nad Orlicí, where wood products, seeds intended for ornamental and non-forestry purposes, and seeds intended for forestry purposes are sold. As part of the e-shop registration form, the user fills in their username and e-mail. These personal data of the user are processed by the state enterprise Lesy ČR for the purpose of enabling purchases through the e-shop, until the user cancels the registration in the e-shop. To successfully complete a purchase in the e-shop, the user (natural person) is asked to fill in their name, e-mail, permanent address, delivery address, or telephone number. These personal data are processed by the state enterprise Lesy ČR until the delivery and payment of the ordered goods and further for a maximum of 3 years after the delivery of the ordered goods to the buyer (corresponds to the general limitation period). Personal data provided by individual users within the operation of the e-shop are processed by the state enterprise Lesy ČR exclusively for the above-mentioned purposes and in accordance with legal regulations. The state enterprise Lesy ČR provides personal data of e-shop users to third parties only on the basis of a valid legal title, i.e., in cases stipulated by legal regulations (financial administration and other public authorities) or necessary for the fulfillment of the contract (transport companies).

Principles of personal data processing adhered to in the state enterprise Lesy ČR

The state enterprise Lesy ČR follows the following principles corresponding to the requirements of Article 5 GDPR when processing personal data:

Personal data are always processed fairly, lawfully, and in a transparent manner in relation to the data subject (principle of lawfulness, fairness, and transparency of processing);
Personal data are collected only for specified, explicitly stated, and legitimate purposes and must not be further processed in a manner that is incompatible with those purposes (principle of purpose limitation of processing);
Personal data are processed only to the extent necessary in relation to the purpose for which they are processed (principle of minimization of processed data);
Personal data are processed in an accurate and, where necessary, up-to-date form, the state enterprise Lesy ČR has taken all reasonable measures to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (principle of accuracy of processed data);
Personal data are stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed (principle of limitation of storage period);
Personal data are processed exclusively in a manner that ensures adequate security of personal data, including their protection by means of appropriate technical or organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage (principle of integrity and confidentiality of processed data).

Security measures for the protection of personal data

In order to ensure compliance with the above-mentioned principles of personal data processing, the Internal Directive of the state enterprise Lesy ČR entitled “Processing and Protection of Personal Data in LČR” was adopted and organizational and technical security measures were implemented to protect the processed personal data in accordance with the requirements of legal regulations.

The implemented security measures are confidential in nature, but it can be declared that within the state enterprise Lesy ČR, all employees and persons cooperating on the basis of civil law contracts are bound by the obligation of confidentiality, access to personal data is limited only to those persons who need it for the performance of their work activities, and processing is limited only to the purposes of performing work activities. Personal data processed in electronic and paper form are properly secured.

What rights can you exercise in connection with the processing of your personal data?

At the state enterprise Lesy ČR, you can exercise the following rights in connection with the processing of your personal data under the conditions set out in Articles 15 to 22 GDPR:

Right of access to processed personal data
Within the right of access to personal data, you can obtain the following information: whether your personal data are processed by the state enterprise Lesy ČR, for what purpose and what personal data are processed, whether personal data are transferred to other recipients, for how long personal data are processed, and information about your rights in relation to the processed personal data. At the same time, you have the opportunity to obtain a copy of your processed personal data.
Right to rectification of processed personal data
Within the right to rectification of processed personal data, you have the right to demand the rectification or completion of your personal data incorrectly or incompletely processed by the state enterprise Lesy ČR.
Right to erasure of processed personal data
You have the right to request the erasure of your personal data in the absence of a valid legal title of the state enterprise Lesy ČR for their processing. Conversely, you do not have the right to request the erasure of processed personal data for the duration of their lawful processing (e.g., on the basis of the legal title of fulfilling a concluded contract or fulfilling a legal obligation). You are always entitled to request the erasure of processed personal data if the legal title of the state enterprise Lesy ČR for their processing is your prior consent.
Right to restriction of processing of personal data
You are entitled to request the state enterprise Lesy ČR to restrict the scope of processing of your personal data in the following cases: (i) you dispute the accuracy of the processed personal data – processing may be restricted until a decision is made, (ii) processing is unlawful, but you only request restriction of processing, not complete erasure, (iii) the state enterprise Lesy ČR only needs personal data for the determination, exercise, or defense of its legal claims, or (iv) you have objected to the processing of personal data, and this request has not yet been settled by the state enterprise Lesy ČR.
Right to portability of processed personal data
You are entitled to request the state enterprise Lesy ČR to transfer your processed personal data in a structured, commonly used, and machine-readable format, for the purpose of their subsequent transfer to another controller. Alternatively, you have the right to request, in technically feasible cases, their transfer directly to another controller. This right can only be exercised on the condition that the processing is based on the legal title of fulfilling the contract or on your consent, and at the same time is carried out automatically within the state enterprise Lesy ČR (through information systems).
Right to object to the processing of personal data
You are entitled to object in cases where the processing of your personal data is carried out by the state enterprise Lesy ČR on the basis of the legal title “legitimate interests of the controller” pursuant to Article 6(1)(f) GDPR. After submitting an objection, the state enterprise Lesy ČR is not entitled to further process your personal data, unless it demonstrates serious legitimate grounds for their further processing, which outweigh your interests, rights, and freedoms, or demonstrates the necessity of their further processing for the determination, exercise, or defense of legal claims. If it concerns personal data processed for direct marketing purposes, you can object at any time and the state enterprise Lesy ČR will no longer process personal data for this purpose.

You are entitled to exercise the above-mentioned rights at the state enterprise Lesy ČR in the following ways:

requests in written paper form (with a notarized signature) delivered to the address Lesy České republiky, s.p., Přemyslova 1106/19, 500 08 Hradec Králové; or
requests in written electronic form (e-mail with a recognized electronic signature) delivered to the e-mail address gdpr@lesycr.cz; or
requests in written electronic form (data message) delivered to the data box ID: e8jcfsn.

According to legal regulations (Article 12 GDPR), the state enterprise Lesy ČR is obliged to clearly identify the applicant when settling the request. If the request is submitted in a form other than the one required above, the state enterprise Lesy ČR will ask you to clearly identify yourself by submitting an identity document or resubmitting the request using one of the methods required above.

Data Protection Officer

For more information about the processing of your personal data by the state enterprise Lesy ČR, you can contact the Data Protection Officer:

Ing. Bc. Petr Guth

gdpr@lesycr.cz
956 999 262
delivery address: Lesy České republiky, s.p., Data Protection Officer, Přemyslova 1106/19, 500 08 Hradec Králové

Complaint against the processing of personal data

If you believe that the processing of your personal data by the state enterprise Lesy ČR has violated the rules on personal data protection established by legal regulations (GDPR), you have the right to lodge a complaint against such processing with the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

In Hradec Králové on 24. 9. 2018

Lesy České republiky, s.p.