Nathan Peterson International s.r.o., identification number 27927261, registered office at 28. října 375/9,
Staré Město, 110 00 Prague 1 (hereinafter "Company") as a company focusing on seeking suitable candidates
for clients, job mediation or other analogous relationship, employee
recruitment and direct searching for candidates, career counselling, team and
individual diagnostics, including training and education, processes personal
data of their clients and candidates according to valid legal regulations, in
particular according to regulation (EU) 2016/679 of the European Parliament and
of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation)
(hereinafter " Regulation GDPR").
In order to provide complete information regarding the processing of personal data of clients and candidates, the Company issues the following principals of processing and personal data protection (hereinafter "Principles").
I. Personal data controller
1.1 Nathan Peterson International s.r.o.
Registered office at: 28 října 375/9, Staré Město, 110 00 Prague 1
Identification number: 27927261
E-mail: info@nathanpeterson.cz
Phone: +420 272 272 289
www: http://www.nathanpeterson.cz/en/
II. Scope of processed personal data
2.1 The Company, as a personal data controller, processes personal data regarding its clients who are natural persons as follows:
(i) Identification data: name, surname, date of birth, place of residence;
(ii) Contact details: phone number, e-mail address.
2.2 The Company, as a personal data controller, processes personal data regarding candidates, in which the scope is determined by the content of the CV and other information that the candidate has provided to the Company at his/her own will. It can be:
(i) Identification data: name, surname, date of birth, photograph;
(ii) Contact details: place of residence, phone number, e-mail address;
(iii) Other data: marital status, number of children, data about previous employment and experiences including reference persons and their contact details, data about education level, skills and knowledge. Additionally, also data obtained from public available sources, - in particular from web presentations, profiles of candidates published on social networks or websites providing job offers, etc;
(iv) Special categories of personal data: state of health, nationality.
III. Purpose of processing, legal basis and period of processing
3.1 The Company processes personal data provided by client for the purpose of implementing a business relationship related to:
(i) Searching and recommending suitable candidates;
(ii) Providing training and education.
3.2 The Company processes personal data provided by candidate for the purpose of:
(i) Mediation of employment or other analogous relationship;
(ii) Providing career counselling.
3.3 Personal data of clients and candidates (clients and candidates collectively hereinafter "data subject") may be processed on the basis of:
(i) Compliance with the statutory obligations of the Company laid down by legal regulations, in particular the Accounting act and tax regulations, when documents containing personal data, in particular invoices and other documents showing the legal grounds for issuing invoice, for a period resulting from particular legal regulation.
(ii) Performance of the contractual obligations of the Company resulting from the existence of a relationship between the Company and data subject in the provision of services to the data subject (in particular, the data necessary for ordering training or request for searching a suitable candidate) for a period of time necessary to provide such service.
(iii) Legitimate interest of the Company including the protection of the rights and legal claims of the Company. On this basis are processed:
a) personal data of clients for the purpose of protecting the rights and legal claims of the Company, to the extent necessary for a period of 4 years from the date of termination of the relationship between client and the Company.
b) personal data of the candidates for the purpose of protecting the rights and legal claims of the Company, to the extent necessary for a period of 4 years from the date of termination of mediation of employment or other analogous relationship by the Company, based on candidate's consent.
(iv) Consent of the data subject, for a period of time laid down in a consent of data subject. With the consent of data subject, the Company processes personal data to the extent and for the purpose resulting from the particular given consent. The consent is given by data subject voluntarily and at its own free will. If the data subject does not provide consent, it is not in any way detrimental to it and must not be disadvantaged by the Company. If the consent is withdrawn or it is no longer necessary to process personal data, personal data are deleted immediately.
IV. Transferring of personal data
4.1 The Company does not share personal data of data subject with another entity unless the law or principles of the company allow it. Personal data may be transferred to the third parties, which have the legal authority to request the transfer of such personal data, on the basis of legal obligation or request of a public authority.
4.2 Based on the candidate's consent, the Company transfers personal data of candidate to client that is searching for candidate on job positions.
4.3 To comply with legal obligations of the Company, the Company uses other entities – providers who, under contractual provisions with the Company, are obligated to process personal data of data subject and that provide, under the contractual provisions with the Company, sufficient guaranties of personal data protection.
4.4 Personal data of the clients are transferred in the meaning of above-mentioned:
(i) Company providing tax and accounting counselling;
(ii) IT professionals providing management and maintenance of information technology of the Company.
4.5 Personal data of the candidates are transferred in the meaning of above-mentioned to:
(i) Company providing tax and accounting counselling;
(ii) IT professionals providing management and maintenance of information technology of the Company;
(iii) Consultants cooperating with the Company on individual operations of mediation of employment or other analogous relationship;
(iv) Potential employers who are clients of the Company.
4.6 The Company respects personal data protection principles of the data subject and thoroughly ensures and verifies that those to whom it transfers personal data of data subjects are obligated to comply with all personal data protection principles, in particular, not to make personal data further accessible to other entities, not to abuse and/or to misuse personal data otherwise.
V. Rights of the data subject
5.1 In connection with the processing of personal data, the data subject has the following rights:
(i) Right to information
The data subject has the right to be informed about the processing of its personal data that concerns it. This information includes contact details of the controller, the purpose and legal basis of the processing, information about its legitimate interests, the recipients of personal data, the storage period of personal data, all rights of the data subject, the ground for the provision of personal data, the information about the transfer of personal data to third countries outside the European union and as the case may be, information whether automated decision-making, including profiling takes place.
(ii) Right of access to personal data
The data subject also has the right to ask the Company to inform it whether the Company processes any personal data about it and if so what kind. Of course, the data subject may require disclosure of specific data or a complete overview of all personal data.
The Company will provide the first copy of the required information for free.
(iii) Right to rectification or completion
In case the Company processes inaccurate, incorrect or incomplete personal data, the data subject has the right to ask the Company to correct or complete it.
In order for the Company to be able to provide rectification or completion, it must verify that personal data processed so far is accurate or complete.
(iv) Right to erasure
The data subject may exercise this right to the company if:
a) personal data are no longer necessary in relation to the purpose for which they were collected or otherwise processed;
b) withdraws its consent on which the processing is based on and where there is no other legal ground for the processing;
c) objects to the processing and there are no overriding legitimate grounds for the processing;
d) personal data have been unlawfully processed;
e) personal data have to be erased for compliance with a legal obligation;
f) personal data have been collected in relation to the offer of information society services referred to in article 8 paragraph 1 Regulation GDPR.
Once the Company has verified that all conditions necessary to comply with a request for erasure of personal data have been met, personal data of the data subject will be erased.
(v) Right to restriction of processing
This right entitles the data subject to ask the Company to restrict the processing of its personal data if:
a) contests the accuracy of personal data, for a period enabling the Company to verify the accuracy of personal data;
b) the processing is unlawful, and the data subject opposes the erasure of personal data and requests the restriction of their use instead;
c) the Company no longer needs personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pending the verification whether the legitimate grounds of the Company override those of the data subject.
If the Company restricts processing in the meaning of above-mentioned, personal data of the data subject, with exception of their storage, can only be processed by the Company with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of European Union or of a Member State. In this case, the Company will notify the data subject in advance that the restriction of processing will be lifted.
(vi) Right to data portability
Based on this right, the data subject is entitled to receive its personal data, which were provided to the Company, in a structured, commonly used and machine-readable format and transmits those data to another controller at the same time.
At the same time, the data subject is entitled to ask the Company to transmit its personal data in a structured, commonly used and machine-readable format directly to another controller, where technically possible.
The data subject has the right to data portability only if the data are processed:
a) by automated means, and at the same time
b) based on the consent of the data subject or based on the performance of contractual obligations.
It follows from the above-mentioned that not all data available to the Company about the data subject will be able to be transferred to other controller by the above-mentioned method.
(vii) Right to withdraw consent to the processing of personal data
If the Company processes personal data of the data subject on the basis of the given consent, the data subject is entitled to withdraw consent at any time. It is not needed to justify the withdrawal of consent to the processing of personal data. However, the withdrawal of consent shall not affect the lawfulness of processing of personal data that occurred after the consent was given prior to its withdrawal.
If there is no other legal ground for processing, the Company will erase personal data of data subject immediately upon the withdrawal of consent.
(viii) Right to object
The data subject is entitled to object to the processing of its personal data at the Company for the purposes of the legitimate interest of the Company.
If the controller does not demonstrate compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims, the Company is obligated to cease processing personal data of the data subject.
(ix) Right to lodge a complaint with a supervisory authority
If the data subject assumes that there is and/or has been a breach of legal regulation caused by processing of its personal data, the data subject is entitled to lodge a complaint with the supervisory authority.
The appropriate supervisory authority in the Czech Republic is the Office for Personal Data Protection, registered office at Pplk. Sochora 27, 170 00 Prague 7, website: https://www.uoou.cz/en/.
5.2 The data subject has all the above-mentioned rights even after termination of the legal relationship with the Company.
5.3 All above-mentioned rights may be exercised by the data subject as follows:
(i) via e-mail to e-mail address info@nathanpeterson.cz;
(ii) in writing at the registered office of the Company, i.e. 28. října 375/9, Staré Město, 110 00 Prague 1;
(iii) in person at the registered office of the Company, i.e. 28. října 375/9, Staré Město, 110 00 Prague 1.
5.4 In order to ensure the appropriate protection of personal data and the rights of data subjects and to prevent misuse of personal data by other persons, the Company must verify the identification of the data subject.
5.5 If the data subject is not identifiable based on information stated in the request for rights, the Company is entitled to request the data subject to complete the data that would additionally allow the Company to verify the identity of the data subject. If the data subject cannot be identified after disclosure of the additional information, the Company cannot comply with the request of data subject.
5.6 The Company handles all received requests without undue delay, no later than 1 month after delivery of such request. If the request of data subject cannot be processed within this period (in particular because of the complexity of the application), the Company is entitled to extend the period for processing the request by up to two months. The Company will inform the data subject along with the justification for the extension of the period within 1 month of receipt of the request.
5.7 If the Company appraise that the request does not meet the above-mentioned requirements for its positive performance, the Company is entitled to refuse the application and inform the data subject about the reasons for the refusal. In such a case, the data subject is entitled to lodge a complaint with the supervisory authority (see above in Article 5.1 (ix) of the Principles) and/or apply for judicial protection at the general courts.
5.8 If the Company complies with the request, the Company will take appropriate action under this decision and inform the data subject.
VI. Personal data protection
6.1 The priority of the Company is protection of personal data of the data subject from unauthorized or accidental access to personal data, its change, destruction or loss, other unauthorized transfer, and other misuse of personal data of the data subject.
6.2 In the event of a breach of personal data security or suspected breach of this security, the Company shall assess whether a breach of security has actually occurred, assessing the seriousness and according to the seriousness (risk-free, low risk, high risk) the Company will inform the data subject and supervisory authority, which is the Office for Personal Data Protection.
6.3 To this purpose, the Company has taken appropriate technical and organizational measures, including internal staff training for the handling of personal data. The Company regularly tests all personal data security measures, checks and verifies that personal data are up-to-date, proportionate, and adequate.
6.4 The Company also carries out random checks and audits of its suppliers to whom the Company made accessible personal data of the data subject in order to establish compliance with personal data protection.
6.5 At the same time, all employees of the Company, as well as all its providers and their employees are contractually and/or legally bound by confidentiality of all information and personal data that have been made available to them.
VII. Useful contacts
7.1 Nathan Peterson International s.r.o.
Registered office at: 28. října 375/9, 110 00 Prague 1
E-mail: info@nathanpeterson.cz
Phone: +420 272 272 289
www: http://www.nathanpeterson.cz/en/
7.2 The Office for Personal Data Protection
Registered office at: Pplk. Sochora 27, 170 00 Prague 7
E-mail: posta@uoou.cz
Phone: +420 234 665 111
www: https://www.uoou.cz/en/
