Informative Text for Clients on Personal Data Processing

Dear Clients,

On the basis of the applicable legislation of Act No. 101/2000 Coll. on personal data protection and on the amendment of certain laws, as amended, and primarily with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), which comes into effect on 25 May 2018, we have a whole range of obligations regarding the protection of your personal data. Please trust in the fact that we place a maximum emphasis on meeting these obligations, and that we would like to hereby relate important information concerning personal data processing to you.

1. Contact Information of the Controller

Léčebné lázně Jáchymov a.s., with its registered office at T. G. Masaryka 415, 362 51 Jáchymov, Company ID: 29211808, registered in the Company Register administered by the Regional Court in Pilsen, Section B, Insert 1603 (hereinafter the “Controller”).

2. On what basis, for what purpose, and for how long will we process your personal data?

The data contained in spa care proposals and the data filled out in your registration card, as well as the data on your payments for the stay are processed on the basis of the legal relationship between you and our spa, the object of which is the provision of curative and therapeutic spa care and related services (accommodation, board, etc.). The purpose of such processing is the provision of the aforementioned services. Our spa receives spa care proposals from your health insurance company.

Similarly, information about your spa stays are processed on the same legal basis; in the case of the paid services of curative and therapeutic spa care (comprehensive or contributory care), we also have the obligation of providing your health insurance company with information on the healthcare provided to you in our facilities, and other information required by health insurance companies. We also have the obligation of allowing insurance companies to audit such information.

The sending of commercial electronic messages without your consent must be directly related to the service or product that was provided by fulfilling the contract (order) within which the personal contact information of the client was provided. The reason for processing personal data for the purposes of direct marketing is the legitimate interest of the controller. The future sending of such marketing messages can be refused at any time.

In case you have given us consent with the processing of your contact data and information about your stays with us, we process such data on the basis of your consent (a similar case is your membership in our loyalty programme, Radon SPA Club). The purpose of processing is our ability to inform you about our offers of products and services.

We process information about the care provided to you for the purpose of providing curative and therapeutic spa care and related services during your curative stay in our spa and after this stay ends, and that for the period in which the health insurance company is authorised to audit the provision of paid services and their billing on the basis of generally binding legislation. Similarly, in the case of contributory care or of the care provided to self-payers, we process information on provided care for the period in which the self-payer is entitled to contest the care provision.

Accounting and tax documents issued to keep records on the provided care also contain some personal data (name and surname of client, type of service provided, date of document issue). We store such documents solely for the purpose of meeting the obligations determined by relevant accounting and tax legislation, and that for the period given by these provisions.

The contesting of provided services by health insurance companies or by you as a self-payer does not occur in our spa. If such a situation should occur, however, we would be obligated to process the information about the provided care during the course of the dispute, and that solely for the purpose of defending our rights in such a dispute. We shall inform you of this fact without undue delay in case of such processing of your personal data.

We have a camera system installed in our facilities for the purpose of protecting property and people against illegal acts. We process camera recordings. We have introduced strict mechanisms for the protection of your data.

In the case of data processed on the basis of your consent, the processing period is the period of the validity of our consent, which is ten years, unless the consent is withdrawn before this period ends.

3. Are you required to give us your personal data?

The data you give us with your consent is given voluntarily. We request that you give us other data, the processing of which is necessary for fulfilling contractual obligations, meeting our legal obligations, or protecting our legitimate interests. If you do not provide such data to us, we cannot provide you with the given product, service, or other fulfilment for which we need your personal data.

We collect and process some data only with your consent. These are primarily data processed for marketing purposes. Providing us with such data is voluntary, and you can withdraw your consent at any time.

In the other cases when we request your personal data, their provision is compulsory. We typically collect your identification data, since such data is required to conclude and fulfil contracts with you, to fulfil our other legal obligations, or to protect our legitimate interests.

4. Who do we make your personal data accessible to, or who do we give it to?

We render your personal data accessible solely to the pertinent health insurance company for the purpose of auditing, which is an obligation of the health insurance company based on binding legislation (Act No. 48/1997 Coll. on public health insurance and on the amendments and addenda to certain related laws, as amended). If you are a self-payer for the provided care, then we do not render your personal data accessible to anyone.

We can provide your personal data to those third parties who ensure supporting activities for us – sending shipments, recovering receivables, or providing legal services. These third parties assume the position of being the processors of personal data, and we provide them with only such personal data necessary for the given purpose (sending shipments, recovering receivables, or legal services), and only the data of those clients to whom each specific activity pertains. We choose the processors of personal data who ensure the aforementioned services very carefully, and we also continuously change them and add to their ranks. Keeping in mind such updates and changes, we are ready to send you an up-to-date list of those subjects who may be provided with the aforementioned data as per your written or e-mail request.

We do not provide your personal data to third countries.

5. Your rights according to valid legislation

Your data is processed transparently, duly, and in accordance with the law. You have the right to access your data, to clarifications, as well as other rights in case you believe that the processing is not correct. We would like to also inform you that according to valid legislation governing personal data protection, you have the following rights:

• the right to access the personal data that we process about you. We are entitled to request an adequate fee for this access, not exceeding, however, the costs necessary for providing the information. As a matter of principle, your transaction data is provided in the form of statements about the pertinent services you have ordered. You may send your request:
  • Electronically by an e-mail containing a certified signature,
  • In writing, containing a signature certified by a notary public or in person, whereby your identity will be checked upon delivering the request. Please distinctly write the words “PERSONAL DATA” on the envelope.
• the right to the rectification of your personal data in case they are in any way incorrect or inaccurate,
• in case that you should discover or believe that we are processing your personal data in a manner that infringes on the protection of your private or personal life, or that infringes the law, and especially if your personal data should be inaccurate in light of the purpose for which they are processed, you have the right to request an explanation from us, as well as requesting us to rectify this situation (e.g. by blocking, rectifying, adding to, or erasing your personal data),
• the right to require the erasure of your personal data, or eventually to the restriction of their processing,
• the right to object the processing for the purpose of discerning whether we have breached our obligations determined by valid legislation,
• in case we process your personal data on the basis of your consent, you have the right to withdraw your consent,
• aside from the aforementioned, you also have the right to lodge a complaint with the supervisory authority, which is The Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.
• You also have the right to the transferability of the data that you have provided us and that we process on the basis of needing to fulfil contractual obligations. In case you are interested in transferring these data to another controller, we will enable you to receive your personal data in a structured, commonly used, and machine-readable format, or eventually, if technically possible, we will transfer them to the other controller directly.

In case of any ambiguity or inquiries about the processing of your personal data, you can turn to us by writing at any time to the address: Léčebné lázně Jáchymov a.s., T. G. Masaryka 415, 362 51 Jáchymov, or you can also contact our Data Protection Officer at telephone number +420 775 083 762, or by e-mail to the address mirais@mirais.cz .

In Jáchymov, 21 May 2018

Personal Data Protection Officer

The Data Protection Officer was appointed under the General Personal Data Protection Act (GDPR) at Jáchymov Radon Spa and is an independent guarantor of the proper handling of personal data within the company.

Contact a Data Protection Officer:

QISO - MIRAIS, s.r.o.

Contact e-mail:
mirais@mirais.cz

Contact phone:
+420 775 083 762

Camera systems with recordings

The company Léčebné lázně Jáchymov operates camera systems with recordings. The purpose for processing these recordings is the protection of property and the health of individuals. Cameras are installed only in the public areas of corridors and of the indoor entrance areas into the buildings Radium Palace, Běhounek, Curie, Praha, LC Agricola, and they monitor the property of the Josef mining pit by the Svornost Mine. Notifications of use of camera systems with recordings are always found at the entrance to the buildings or to the property.