GDPR

Information on processing of personal data

Our company TaxVision s.r.o., Id. No. 27921450, with its registered office at Prvního pluku 17, 186 00 Prague 8 - Karlín, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 126641 is authorized to carry out the activities of accounting advisors, bookkeeping, tax record keeping and tax consulting. Our clients can be both legal entities and natural persons. However, personal data is only data that relates to a natural person.

This document contains detailed information about the processing of personal data by our company, in particular:

• what personal data our company processes;
• the purpose for which it does so;
• what rights you have as the person to whom the personal data relates (i.e. the data subject) and how you can exercise those rights.

Bookkeeping, payroll and tax agenda of our clients

As part of this activity, we collect and process the personal data of the client in the case of a natural person and the personal data of the client’s representatives or contact persons in the case of a legal entity. We obtain personal data directly from the contract or from the client in other ways (via e-mail, written or telephone communication).

We process the following personal data: name, surname, title, address, e-mail address, telephone number (for entrepreneurs also the business name, identification number and registered office). In case of payroll processing and other activities required for the performance of contracts, it may also include other details such as date of birth, birth registration number, etc.

The purpose of the processing of personal data is to provide the agreed services to the client, in particular bookkeeping, processing the payroll of the client’s employees, processing and filing tax returns and other submissions to the relevant authorities.

The legal basis for processing is the performance of a contract concluded with our company by a client - natural person. In the case of a client - legal entity, our company has a legitimate interest in the processing of the personal data of its representatives, otherwise we would not be able to provide the services.

We process personal data for this purpose for the duration of the contract between the client and our company and after its termination for the period of time required by the legal regulations (in particular accounting and tax regulations).

As part of this activity, our company sends information about the client to the relevant tax authority and/or the competent court. None of this personal data is transferred by our company to third countries outside the EU.

When processing personal data, our company:

• protects personal data to prevent their unauthorised use or disclosure to persons not authorised to process the personal data;
• does not disclose personal data unless it has the consent of the data subject;
• uses the services of processors - IT system providers - to process personal data;
• the processing of personal data does not involve decision-making based solely on automated processing, including profiling, which would have legal effects on the natural person or similar effects significantly affecting the natural person in a similar way.

For clarification:

• automated individual processing is an operation with personal data which does not involve human intervention in any way;
• profiling is an automated processing of personal data to evaluate certain aspects of a natural person (e.g. interests, preferences, movements, etc.).

Rights of the data subject in relation to the processing of their personal data

The data subject has various rights arising in particular from Articles 15 to 22 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (also known as “GDPR”). To exrecise such rights, our company provides their list and content in the summary below.

In general, the following applies to the exercise of these rights:

• The rights may be exercised against the data controller. In most cases, when providing services to our clients (where personal data is processed), our company is in the position of a processor, i.e. a person who does such processing for the controller and according to the controller’s instructions. However, in the aforementioned activities, it is in the position of a controller and natural persons have the right to turn directly to our company to exercise their rights.
• We may need to verify the identity of the applicant before processing the request. This precaution is important in terms of protection to prevent us from providing personal data to a person to whom it does not belong. If the applicant refuses to provide us with information to verify their identity, we will not be able to satisfy the request.
• We will respond to the request without undue delay, but no later than within 1 month after receiving the request. In the event that the request cannot be processed within this deadline, we will inform the data subject within this deadline of an extension, which will not exceed two months (i.e. the maximum deadline will equal three months).
• We primarily respond to requests electronically, i.e. via e-mail communication. In a particular case, the communication can be adapted to the preferences of the data subject if the data subject informs us in advance.
• All communications and all acts related to the exercise of the rights under Articles 15 to 22 of the GDPR are generally made by us free of charge. However, in accordance with the said Regulation, if the request would be unreasonable (in particular due to its repetitiveness), we may request reimbursement of the costs of providing the requested information or communication or performing the requested acts; or we may refuse to satisfy the request.
• You can contact our company to exercise your rights at osobniudaje@taxvision.cz, or in writing or in person at our company’s registered office at Prvního pluku 17, 186 00 Prague 8 - Karlín.

Right of access to personal data

A natural person has the right to obtain information about whether or not we process his/her personal data. If his/her personal data is processed, s/he also has the right of access to it and to information about the processing. If s/he requests so, our company will provide the natural person with a copy of the personal data processed. Our company may charge an administrative fee for any additional copies that may be requested. Our company will inform the applicant of the amount of such fee in advance. If the issuance of a copy of the personal data could adversely affect the rights and freedoms of other persons, a copy of the personal data will not be provided by our company.

Right to rectification of personal data

Our company processes personal data in the good faith belief that it is accurate and up-to-date. If we process inaccurate or incomplete personal data, the data subject has the right to have such data corrected or completed upon request.

Right to erasure of personal data

In cases where:

1. a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
2. b) the data subject revokes his/her consent on the basis of which the data was processed and there is no other legal ground for processing;
3. c) the data subject raises objections to the processing on grounds of legitimate interest or public interest and there are no overriding legitimate grounds for the processing or against the processing for direct marketing purposes;
4. d) the personal data was processed unlawfully;
5. e) the personal data must be erased in order to comply with a legal obligation applicable to our company as a controller;
6. f) the data subject is 13 years of age or older and his/her personal data has been collected in connection with the offer of information society services on the basis of consent, or on the basis of the consent of a legal representative (if under 13 years of age);

the data subject has the so-called “right to be forgotten”, i.e. the right to have his/her personal data erased.

Please note that there are situations in which this right does not apply to the data subject, in particular where the processing of personal data is necessary for the determination, exercise or defence of legal claims, etc. Article 15(3) of the GDPR provides an overview of the exceptions.

Right to restriction of personal data processing

In the cases described below, the data subject has the right to restrict the processing of his/her personal data:

1. a) if he or she denies the accuracy of the personal data, then our company will restrict the processing to the time necessary to verify its accuracy;
2. b) if the processing of the personal data is unlawful but the data subject requests a restriction on the use of the personal data instead of its erasure;
3. c) where our company no longer needs the personal data for the purposes of the processing, but the data subject requests it for the determination, exercise or defence of legal claims;
4. d) if the data subject objects to the processing based on legitimate interest, the processing will be restricted in time until it is verified that the legitimate grounds of our company do not override the legitimate grounds of the data subject stated in the objection.

During the restriction of the processing, we will only process personal data on the basis of the data subject’s consent to such processing. The restriction does not apply to the storage of personal data or to the processing of personal data for the determination, exercise or defence of legal claims, for the protection of the rights of another natural person or legal entity or for reasons of important public interest.

Before resuming the processing of personal data, we will inform the data subject in advance.

Right to data portability

In cases where our company:

• performs automated processing of personal data,
• this personal data has been provided to us by the data subject,
• such processing is based on the data subject’s consent or results from the performance of a contract to which he or she is a party,

the data subject has the right to obtain his or her personal data in a structured, commonly used and machine-readable format. The data subject also has the right to transfer this personal data to another controller. If technically feasible and requested by the data subject, our company will transmit his/her personal data directly to the designated controller.

For the avoidance of doubt, all of the above conditions must be met simultaneously in order to exercise the right of portability.

Right to object

The data subject has the right to object if we process his/her personal data on the basis of a legitimate interest (ours or third party’s) or in the public interest. If the data subject objects, we will not process the personal data unless we have compelling legitimate grounds for such processing which override the interests of the data subject or the rights and freedoms of the data subject, or for the determination, exercise or defence of legal claims. We will inform the data subject of such legitimate grounds or claims.

Where we process personal data for direct marketing purposes, including profiling for this purpose, you may object at any time.

On the basis of such an objection, we will no longer process personal data for these purposes.

Right to lodge a complaint with the supervisory authority

You can contact the competent supervisory authority in an EU Member State regarding the processing of personal data. For the Czech Republic, you can contact the Office for Personal Data Protection. For more information about the Office, please visit its website at www.uoou.cz. 

In Prague, 24 April 2018

Blanka Štarmanová, Executive Director

Legal time limits for archiving accounting documents

Annex: Information on processing of personal data by TaxVision s.r.o.