Principles and processing of personal data

I. Processing of personal data from contact forms, in connection with the processing of inquiries, queries related to the provision of services by the Company on the website

In the event of a request for the purchase of a vehicle and/or a request for services on the Company's website www.tomanmotors.com through the enquiry form or by sending an inquiry to the relevant email provided on the website, the Company will process the personal data of the potential customer, in the range of name, surname, e-mail address, telephone contact, or company, only on the basis of your consent or on the basis of a request before the conclusion of the contract. You can withdraw your consent at any time by sending an explicit message to zdenka.toman@tomanmotors.com.

After processing the relevant request, the Company may use the above-mentioned data, based on your consent, for its marketing purposes related to the offer of its services. In this case, the Data Subject has the right to withdraw the consent granted at any time by sending an express communication to zdenka.toman@tomanmotors.com.

The processing of the personal data provided will be carried out by the Company itself, or through the processor referred to in art. VIII below. By sending a query through the contact form, personal data is also collected, which is located in an encrypted interface, and these are the following data:
- date and time of submission of the contact form;
- data from the submitted contact form;
- Visitor inquiry.

Personal data about visitors to the Company's website processed in connection with the administration of the Company's website and/or the implementation of Internet marketing will therefore only be processed provided that the relevant Data Subject has given consent to the processing in question within the meaning of Article 6 (1) (a) GDPR, for the period during which the consent in question will be valid. In the absence of the consent of the Data Subject within the meaning of Article 6 (1) (a) GDPR, the personal data of the Data Subjects will be processed at the request of the Data Subject within the meaning of Article 6 (1) (b) GDPR.

II. Processing of personal data for newsletter mailing

In the event of a website visitor's interest in sending newsletters and other advertising messages, the Company will process for these purposes, on the basis of consent, the provided personal data of such user, always at least within the scope of e-mail address, name and surname. The content of the newsletter and other advertising messages may be personalized on the basis of the data provided and other data for personalization of the content that the Company detects from the behavior of the visitor on the website or the newsletter.

The Company begins to process the personal data of the visitor only after the visitor fills in the appropriate form for ordering the newsletter and other advertising messages and confirms these via the button “subscribe to the newsletter” and/or via the contact form. If the entry is not confirmed and/or the contact form has been sent, the completed data will not be stored anywhere.

The personal data provided are processed until the consent granted is withdrawn.

The consent to this processing of personal data is completely voluntary, and the User may withdraw it at any time by sending a notice of withdrawal of consent in writing to the address of the registered office of the Company (see below).

The given consent can also be revoked by the user by clicking on the link “You can unsubscribe” in a mailed newsletter or advertising message.

III. Processing of personal data in connection with photo documentation from organized events

For events organized by us, we take photo documentation (situational footage of events) to a reasonable extent in order to subsequently publish selected photos on our website for the Company's promotional purposes. In this way, it is not primarily the visitors of a particular event, but the overall atmosphere of the event, the footage is not published in detailed resolution, we do not attach descriptions of specific people attending the event to them. According to the expert opinion of the Office for Personal Data Protection, in such cases it is not primarily an issue of personal data protection, but privacy protection according to the Civil Code; consent to the processing of personal data for “illustrative” images does not need to be required.

Visitors are notified in advance of taking photo documentation in the form of a camera pictogram, our photographers are visibly marked and photo documentation is taken only in the main area of the event, so visitors always have the opportunity to stay in spaces where photo documentation is not taken. If you have any doubts or questions about taking photo documentation, you can contact us at the contacts below.

IV. Processing of data on the basis of booking or purchase of a vehicle

On the basis of a reservation or purchase of a vehicle, we process personal data of clients to the following extent:
‍
- identification and contact details (first and last name, address of place of permanent residence, if applicable, birth number, identity card number, or similar document, and, where applicable, e-mail address, telephone number and bank account number);
- in the case of entrepreneurial natural persons also the designation of the entrepreneurial natural person, registered office, ID number, VAT number, data on the VAT payer.

A) Processing for the purpose of fulfilling legal obligations
The provision and processing of the above personal data, with the exception of e-mail address and telephone number data, is necessary for the purposes of fulfilling the Company's legal obligations, in particular obligations arising from accounting and tax regulations.

B) Processing necessary for the performance of the contractual relationship
The processing of your identification data is also necessary for the purpose of fulfilling the contractual relationship related to the acquisition of vehicles and related services provided by the Company, i.e. securing orders and reservations, concluding and fulfilling contracts and other services provided by the Company.

C) Processing necessary for the purposes of legitimate interest
We process your personal data in the range of name, surname and e-mail address on the basis of the legitimate interest of the Company for the purpose of direct marketing. The purpose of processing here is exclusively the possibility to send you marketing and business messages, i.e. information about interesting news, discounts, services of the Company, etc. In the event of legal and/or criminal proceedings (reporting of crimes or threats to public safety), the Company would be obliged to process the data to the extent necessary for the conduct of such a dispute, solely for the purpose of protecting the Company's rights in such a dispute. Similarly, the Company would be obliged to process the necessary data also in case of non-payment of services and/ or the purchase price of the vehicle, or in case of damage caused to the Company.

D) Automated processing of your data
In no case do we carry out automated decision-making or other automated processing of your personal data that would have legal effects for you or would affect you in a similar way significantly.

V. Google Analytics and Google AdWords

To analyze the website using cookies, the Company uses Google Analytics, developed and operated by Google Inc., located at Amphitheatre Parkway, Mountain View, CA94043, USA (”Google“).

Google will not transfer data, incl. IP addresses, combine with other data. Google's privacy statement is available for review here.
‍
The collection of cookies and their analysis through Google Analytics can be prevented by the visitor of the website, on the one hand, by changing the browser settings as mentioned above, and by:
- click on the following referenceto place an opt-out cookie on the computer, which prevents the future storage of data about the visit to the website;
- by installing the plugin in the browser available hereunder. This plugin only works in the appropriate browser on the respective computer and must not be deactivated or deleted after installation to preserve the deactivation of Google Analytics.

Within the framework of Google Analytics, the Company also uses related advertising functions provided by Google, such as impressions reports in the Google advertising network, enhanced reporting of anonymous demographic data (e.g. age, gender, interests), or display ads in the content network based on viewed products (so-called remarketing), including Google AdWords, which serves to personalize advertising and improve advertising targeting and so-called remarketing.

VI. Information text about the camera system in the premises of the Company and its showroom

The purpose of processing is to protect property and increase the safety of persons. The processing scope includes only the video recording of the camera system, without sound recording. The administrator of these records is the Company. The recording of the camera system is stored on the HDD device/hard drive operated by the Company for this camera system no other processor is used. The place of processing is the headquarters of the Company, with a total of 12 cameras.

Only law enforcement or administrative authorities for the purposes of infraction proceedings may be the recipient of CCTV data.

Cameras occupy the entrance area and reception area, showroom areas, service areas, detailing studio spaces, exterior, driveway.

The retention period of the recordings is a maximum of 14 days, after which the data is automatically deleted by overwriting with a new record, since the camera system is based on loop mode. The operation of the cameras is continuous (or based on an automatic motion sensor).

The contact details for accepting requests for information are listed below.

VII. Period of processing of personal data

Personal data about visitors to the Company's website will be processed only for the period strictly necessary. Personal data about visitors to the Company's website processed in connection with the administration of the website and/or the implementation of Internet marketing will be processed for no more than the period during which the consent in question will be valid.

Personal data will be processed only for the period strictly necessary in relation to the processing of personal data of the addressees of electronic communications conducted by the Company. Unless otherwise specified by the Data Subject, personal data will be processed for a maximum period of 2 years from the date of their first processing by the Controller. In the event of the consent of the Data Subject within the meaning of Article 6 (1) (a) GDPR, the Personal Data of the Data Subject will be processed in the form of the validity and effectiveness of this consent. In the case of processing Personal Data at the request of the Data Subject within the meaning of Article 6 (1) (b) GDPR, the Personal Data of the relevant Data Subject will be processed for the period necessary for the implementation of the measures taken before the conclusion of the contract.

The Company processes personal data, for which the obligation to process them arises from the relevant legislation, only for the period necessary under these laws. (For example, the accounting and tax documents issued by the Company also contain some of your personal data (name and surname, type of service provided, date of issue of the document). We keep these documents only for the purpose of fulfilling the obligations established by the relevant accounting and tax legislation, for the period imposed by those regulations.)

The name, surname, e-mail address and, if applicable, telephone number of the Data Subject for the purposes of direct marketing to the Company (sending information about interesting news, offers, services or discounts, etc.) are processed by the Company until the Data Subject discloses his or her consent to further such processing.

The Company processes the data necessary for the purposes of existing or real impending disputes only until the final decision of the dispute and fulfilment of the obligations arising from the decision, or until such time as disputes over the services provided may arise under applicable law.

After the above periods, the Company will regularly dispose of personal data, both in paper and electronic form.

VIII. Further information on the processing of personal data

Personal Data are the basic contact details of Data Subjects obtained from Data Subjects and/or from publicly available sources (in particular the addresses' websites), the Personal Data having been or are in each case maintained by the Data Subject and/or by a third party, with the presumed consent of the Data Subject, as contact data for the purpose of serving third parties to establish first contact and/or maintain communication with the Data Subject and/or by a third party represented by the Subject data. Personal data may also have been obtained from the visits of Data Subjects and/or third parties represented by the Data Subject and/or as part of prior communication with the Data Subject and/or a third party represented by the Data Subject.

Personal data about Data Subjects will be obtained from and/or may be provided to the following persons and/or entities involved in:
(a) marketing services;
(b) detailing services;
(c) ensuring the registration of vehicles;
d) comprehensive management of the Company's IT systems;
(e) the acceptance of contracts;
f) the creation and content of the website; and
g) security and CCTV of the Company.

These entities (processors) may process personal data in accordance with the instructions of the Company. The Company does not intend to transfer the personal data of Data Subjects to a third country and/or international organization.

IX. Other rights related to the protection of personal data

Data subjects whose personal data are processed by the Company have the following rights related to the processing of their personal data when fulfilling the prerequisites established by law:
- the right to access personal data consisting in the right to receive, free of charge, upon request, information about which of their personal data is processed by the Company;
- the right to rectification of their processed personal data;
- the right to erasure of their processed personal data;
- the right to restrict the processing of their personal data;
- the right to the portability of personal data;
- the right to withdraw the consent granted to the processing of personal data at any time, if the consent is the legal basis for the relevant processing of personal data (i.e. for sending newsletters and other advertising messages).

Furthermore, data subjects whose personal data are processed by the Company have the right to object to the processing of their personal data if the legitimate interests of the Company are fulfilled, if the legal basis for the processing is the legitimate interests of the Company. If personal data are processed for direct marketing purposes, the Data Subject has the right to object to such processing at any time.

The above rights may be exercised by Data Subjects whose personal data is processed by the Company in writing or by e-mail with the Company as the controller of personal data, through the contacts listed below.

The company can be contacted:
(a) in writing at no. 482, 271 01 Rynholec;
(b) by telephone using the telephone number 777 821 841;
c) electronically via e-mail: zdenka.toman@tomanmotors.com.

The rights of the data subject mentioned above are not absolute rights. The applied rights will be assessed by the Company individually and with respect to its rights or those of third parties. If the Data Subject considers that there has been an infringement of the legislation relating to the protection of his/her personal data, he/she has the right to lodge a complaint with a supervisory authority. The supervisory authority for the territory of the Czech Republic is the Office for the Protection of Personal Data Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.cz).