Privacy Policy Statement

Introduction

Pluxee Česká republika a.s., with its registered office at Spaces SmíchOff, Plzeňská 3350/18, Praha 5 - Smíchov, Postcode 150 00, ID No, 61860476, listed in the Commercial Register maintained by the Municipal Court in Prague, under File No. B 2947 (hereinafter referred to as the "Company") is dedicated to compliance with the principles and rules for the protection of individuals in connection with the processing of their personal data.

This Privacy Policy Statement (hereinafter referred to as the "Statement") describes how the Company processes personal data. This Statement ensures that personal data is processed in compliance with generally binding laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR“), so that the rights of data subjects are adequately protected.

The processing of personal data via cookies is regulted under Annex 2 Pluxee Benefity Cookie Policy.

Pursuant to Articles 13 and 14 of the GDPR, the Company hereby provides data subjects with information on the processing of their personal data.

Company’s contact information:
Mailing address: Pluxee Česká republika a.s., Spaces SmíchOff, Plzeňská 3350/18, Praha 5 - Smíchov, Postcode 150 00
Phone number: 233 113 435
E-mail: gdpr.cz@pluxeegroup.com Web: www.pluxee.cz

Data Protection Officer: Jakub Diviš LLM.,
Pluxee Česká republika a.s, Spaces SmíchOff, Plzeňská 3350/18, Praha 5 - Smíchov (e-mail: gdpr.cz@pluxeegroup.com).

A. What principles do we follow when processing personal data?

The Company processes accurate and up-to-date personal data on the basis of law, in a fair and transparent manner, only for specific, explicit and legitimate purposes and with a restriction to the minimum amount of necessary data, stores it in a form that permits identification of data subjects only for the period of time necessary in relation to the purpose of the processes and ensures integrity and confidentiality of the data using appropriate technical or organisational precautions and appropriate security against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The Company ensures that any inaccurate data, taking into account the purpose for which it is processed, is deleted or rectified without delay.

The Company properly documents all activities related to personal data and the protection thereof, in particular, it keeps records of all processing activities and other documents on the processing of personal data to fulfil the accountability principle laid down under the GDPR. The Company cooperates with the supervisory authority, namely the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.cz, tel.: +420 234 665 111.

B. Whose personal data do we process and for what purpose?

I. Users of our services and job applicants

The Company offers their users a wide range of products and related services, including the Pluxee Gastro meal voucher and its electronic version, Pluxee Gastro, leisure vouchers and cards, the Active Pass card, the e-shop with Pluxee Cafeteria, mojeBenefity benefits and the SayReward incentive programme. In connection with the provision of its products and services, the Company needs to process the personal data of the users of these products and services as set out below.

1. How do we process your personal data on the Pluxee Connect portal?

I. User portal

Purpose of processing: providing services to clients,

Legal basis for processing: the processing is necessary in connection with the provision of services under concluded contracts, legitimate interest. Types of personal data processed: name, e-mail, telephone number. Reason for data provision: if the data is not provided to the Company, the service cannot be provided in a proper manner or the contract cannot be concluded and performed.

Processing period: for the duration of the user's registration on the web portal.

II. Two-factor authentication of online payments to ensure strong user authentication

Purpose of processing: to ensure strong user authentication and related security of online payments on the Pluxee payment gateways in the form of sending an SMS verification code for all online payments.

Legal basis of processing: ensuring strong user authentication when making online payments on the basis of Act No. 370/2017 Coll., on payment transactions, as amended.

Types of personal data processed: telephone number.

Reason for data provision: Unless the personal data is provided, the Company cannot send an authentication SMS to the user with a view to verifying the online payment, thereby ensuring strong user authentication in accordance with applicable law.

2. How do we process your personal data at Pluxee

I. Pluxee personal account

Purpose of processing: provision of the service, i.e., the relevant benefits on the basis of the contract as set out below and in the context of the administration of your Pluxee account on the https://pluxee.cz/blog/darkovy-pass-doporuc-a-ziskej-treba-az-50000-kc/

Legal basis of processing: legitimate interest of the Company – the processing is necessary in connection with the provision of the service on the basis of a contract concluded with your employer or another person who provides you with our benefits.

Types of personal data processed: name, e-mail, login, password, transaction history (payee, amount of payment, place of payment, date of payment).

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided. Processing period: for the duration of the user's registration on the web portal.

II. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data is provided to the Company or consent is granted to the Company, marketing communications cannot be sent to the user.

Processing period: 5 years or until the consent is revoked.

The user may opt out of receiving the Company’s commercial communications at any time:
directly in their Pluxee personal account after logging in, by clicking on User Profile and then revoking the consent next to the Consent to the processing of user data for marketing purposes field. The edit must be confirmed by clicking on Save;
by clicking on the "Unsubscribe" link in each marketing communication, or by sending an email to gdpr.cz@pluxeegroup.com

III. Personalised commercial communications

Purpose of processing: sending the Company’s or its business partner’s personalised commercial communications. Legal basis of processing: consent.

Types of data processed: name, surname, transaction history

Reason for data provision: unless personal data is provided or consent is granted to the Company, personalised commercial communications cannot be sent to the user.

Processing period: 5 years or until the consent is revoked.

The user can opt out of personalised ads at any time:
directly in their Pluxee personal account after logging in, by clicking on User Profile and then revoking the consent next to the Consent to the processing of user data for the purposes of personalised ads The edit must be confirmed by clicking on Save; or
by sending an email to gdpr.cz@pluxeegroup.com

3. How do we process your personal data at www.mojebenefity.cz?

I. Cafeteria Pluxee account

Purpose of processing: provision of services, i.e., the benefits under the below contract and administration of your Cafeteria Pluxee Account.

Legal basis of processing: the legitimate interest of the Company – the processing is necessary in connection with the provision of the services under a contract with your employer or another person who provides you with our benefits.

Types of personal data processed: email, transaction history (payee details, payment amount, payment location, date of payment).

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided. Processing period: for the duration of the user's registration in the Pluxee Cafeteria account.

II. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: e-mail.

Reason for data provision: unless personal data is provided to the Company or consent is granted to the Company, marketing communications cannot be sent to the user.

Processing period: 5 years or until the consent is revoked.

The user may opt out of receiving commercial communications from the Company at any time by clicking on the "Unsubscribe" link in each commercial communication or by sending an email to gdpr.cz@pluxeegroup.com

4. How do we process your personal data at www.vyhledavac.pluxee.cz?

I. "I’ve had a problem with the establishment” contact form

Purpose of processing: answering queries, processing and handling requests from website visitors. Legal basis of processing: processing requests/queries based on the legitimate interest of the Company.
Types of personal data processed: name, e-mail, telephone number, or other personal data voluntarily provided by the data subject in the contact form.

Reason for data provision: The Company cannot process enquiries/requests unless it has been provided with contact personal data.

Processing period: the period of time required to complete the processing of any enquiry/request plus another 3 months from its completion for the purposes of recording and evaluating enquiries and for the purposes of further related communication on the matter.

II. "Request for change of establishment data” contact form

Types of personal data processed: e-mail, or other personal data voluntarily provided by the data subject in the contact form. Reason for data provision: The Company cannot process enquiries/requests unless it has been provided with contact personal data.

5. How do we process your personal data at www.pluxee.cz?

I. “Complaint” contact form

Purpose of processing: processing requests and handling complaints.
Legal basis of processing: processing requests/complaints based on the legitimate interest of the Company.

Types of personal data processed: name, e-mail, or other personal data voluntarily provided by the data subject in the contact form for the claim.

Reason for data provision: The Company cannot process enquiries/complaints unless it has been provided with contact personal data.

Processing period: for the time required to complete the processing of any enquiry/complaint plus another 3 months from the completion for the purposes of recording and evaluating enquiries and for the purposes of further related communication on the matter.

II. "Tip for partner” contact form

Purpose of processing: answering queries, processing and handling messages from website visitors. Legal basis of processing: processing messages/queries based on the legitimate interest of the Company.

Types of personal data processed: e-mail, or other personal data voluntarily provided by the data subject in the contact form. Reason for data provision: The Company cannot process enquiries/messages unless it has been provided with the listed personal data.

III. Career form

Purpose of processing: responding to job inquiries/applications and engaging in communication with a view to initiating and conducting the selection process. Legal basis of processing: processing requests/queries and communicating with applicants based on the legitimate interest of the Company.

Types of personal data processed: name, e-mail, telephone number, or other personal data contained in the attached CV or cover letter.

Reason for data provision: The Company cannot process job inquiries/applications and contact applicants with an invitation to the selection process unless it has been provided with contact personal data.

Processing period: during the selection process involving the applicant.

7. How do we process your personal data at www.ucet.pluxee.cz?

I. System login

Purpose of processing: provision of services, i.e., the relevant benefits under the contract referred to below and administration of your account on the www.ucet.pluxee.cz web portal.

Types of personal data processed: name, e-mail.

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided. Processing period: for the duration of the user's registration on the web portal.

II. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data is provided to the Company or consent is granted to the Company, marketing communications cannot be sent to the user.

Processing period: 5 years, or until the consent is revoked.

The user may opt out of receiving the Company’s commercial communications at any time by clicking on the "Unsubscribe" link in each commercial communication or by sending an email to gdpr.cz@pluxeegroup.com

8. How do we process your personal data at www.proplatit.pluxee.cz?

I. Request

Purpose of processing: processing requests for reimbursements of financial amounts.

Legal basis of processing: processing is necessary for the performance of the contract. Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data are provided to the Company, the amount will not be reimbursed.

Processing period: for the time necessary to discharge the contract plus another 3 years from the end of the contract for the purpose of any claims arising under the contract.

9. How do we process your personal data at www.poukazky.klient.pluxee.cz

I. Orders

Purpose of processing: order processing and deliveries of ordered products.

Legal basis of processing: the processing is necessary for the conclusion and performance of contracts, including delivery of ordered products. Types of personal data processed: name, telephone number, address, e-mail.

Reason for data provision: unless personal data is provided to the Company, the order cannot be fulfilled on the basis of the contract.

Processing period: for the duration of the contract plus another 3 years from the end of the contract for the purpose of any claims arising under the contract.

II. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data is provided to the Company or consent is granted to the Company, marketing communications cannot be sent to the user.

Processing period: 5 years, or until the consent is revoked.

II. Our clients

The Company offers a wide range of benefits to company employees. It is our clients who further motivate their employees and provide them with our benefits. See how we process our clients' personal data:

1. How do we process your personal data at www.mojebenefity.cz?

I. Login to the administrator account

Purpose of processing: provision of services.

Legal basis of processing: performance of a contract – the processing is necessary in connection with the provision of a service on the basis of a concluded contract. Types of personal data processed: name, e-mail, telephone, address, date of birth, gender, personal number, position.

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided.

Processing period: the duration of the contract, and an additional 3 years from the end of the contract for the purpose of resolving any disputes arising from the contract.

II. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data is provided to the Company or consent is granted to the Company, marketing communications cannot be sent to the user.

Processing period: 5 years, or until the consent is revoked.

2. How do we process your personal data at www.pluxee.cz

I. Complaint form (employer)

Purpose of processing: answering queries, processing and handling complaints from website visitors. Legal basis of processing: handling complaints/queries based on legitimate interests of the Company.

Types of personal data processed: name, e-mail, or other personal data voluntarily provided by the data subject in the contact form. Reason for data provision: The Company cannot process enquiries/requests unless it has been provided with the respective contact personal data.

II. Contact form

Purpose of processing: answering queries, processing and handling requests from website visitors. Legal basis of processing: processing requests/queries based on legitimate interest of the Company.

Types of personal data processed: name and (i) e-mail if you choose to be contacted by e-mail, (ii) telephone number if you choose to be contacted over the phone and, where applicable, other personal data voluntarily provided by the data subject in the contact form.

Reason for data provision: The Company cannot process enquiries/requests unless it has been provided with the respective contact personal data.

3. How do we process your personal data at order.pluxee.cz

I. Client account

Purpose of processing: providing services, i.e., the relevant benefits, to your employees and others to whom you provide our benefits, including the administration of your personal account.

Legal basis of processing: performance of contract – the processing is necessary in connection with the provision of the services and administration of the account on the basis of the concluded contract.

Types of personal data processed: name, e-mail.

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided.

Processing period: duration of the client's registration on the web portal or the duration of the contract between you and the Company.

4. How do we process your personal data at partner.pluxee.cz

I. Client portal

Purpose of processing: providing services, i.e., the relevant benefits, to your employees and others to whom you provide our benefits, including the administration of your personal account.

Reason for data provision: if personal data is not provided to the Company, the service cannot be properly provided.

Processing period: duration of the client's registration on the web portal or the duration of the contract between you and the Company.

III. Our partners

The Company works with a large number of partners such as restaurants, businesses, sports venues, etc. See how we process our partners’ personal data:

1. How do we process your personal data at www.vyhledavac.pluxee.cz?

I. "Request for change of establishment data” contact form

Purpose of processing: processing and handling requests from website visitors.

Legal basis of processing: processing requests based on legitimate interests of the Company.

Types of personal data processed: name, e-mail, telephone number, or other personal data voluntarily provided by the data subject in the contact form.

Reason for data provision: The Company cannot process the request unless it is provided with personal data.

2. How do we process your personal data at www.pluxee.cz?

I. Complaint form (Partner)

Purpose of processing: answering questions, processing and handling complaints from website visitors. Legal basis of processing: handling complaints/queries based on legitimate interests of the Company.

Types of personal data processed: name, e-mail, or other personal data voluntarily provided by the data subject in the contact form. Reason for data provision: The Company cannot process complaints/queries unless it is provided with contact personal data.

II. Contact form

Purpose of processing: answering queries, processing and handling requests from website visitors. Legal basis of processing: processing requests/queries based on legitimate interest of the Company.

Reason for data provision: The Company cannot process enquiries/requests unless it has been provided with the respective contact personal data.

3. How do we process your personal data at www.partner.pluxee.cz?

I. Partner account

Purpose of processing: conclusion and performance of contract or administration of partner account.

Reason for data provision: unless the data are provided to the Company, the service cannot be provided in a proper manner or the contract cannot be concluded and performed.

II. Partner portal

Purpose of processing: conclusion and performance of a contract or partner account administration.

Legal basis of processing: the processing is necessary in connection with the provision of services under the concluded contract. Types of personal data processed: name, address, company, e-mail, telephone number.

Reason for data provision: unless the data are provided to the Company, the service cannot be provided in a proper manner or the contract cannot be concluded and performed.

Processing period: while the partner is registered on the web portal or the duration of the contract concluded between you and the Company.

III. Marketing communications

Purpose of processing: sending the Company’s or its business partners’ marketing communications. Legal basis of processing: consent.

Types of personal data processed: name, e-mail.

Reason for data provision: unless personal data is provided to or consent is granted to the Company, marketing communications cannot be sent to clients.

Processing period: 5 years, or until the consent is revoked.

The partner may opt out of receiving the Company’s commercial communications at any time by clicking on the "Unsubscribe" link in each commercial communication or by sending an email to gdpr.cz@pluxeegroup.com.

C. What rights do you have in relation to the processing of your personal data?

Right of access and rectification	You can request access to your personal data. You may also demand that any inaccurate personal data be rectified and any incomplete data supplemented. You can request any available information as to the source of your personal data, and you may also request a copy of your personal data being processed by the Company. In accordance with the GDPR, the Company reserves the right to charge a fee for the exercise of these rights. The Company may charge a fair and reasonable fee taking into account the Company's administrative costs if the request is manifestly unfounded or unreasonable. The Company will inform the data subject of the fees before processing the request.
Right to erasure	Your right to erasure allows you to request the erasure of your personal data where: the data is no longer necessary in relation to the purposes of its collection or processing; you choose to withdraw your consent; you object to processing by automated means using technical specifications; your personal data has been processed unlawfully; a legal obligation exist to erase your personal data; the erasure is required to ensure compliance with applicable laws.
Right to restriction of processing	You may request restriction of processing where: you contest the accuracy of the personal data; the Company no longer needs the personal data for the relevant purposes of the processing; you have objected to the processing on legitimate grounds.
Right to data portability	Where applicable, you can request data portability for the personal data you have provided to the Company so that it is available in a structured, commonly used and machine-readable format. You can also demand that your personal data be transmitted to a third party of your choice (where technically feasible).
Right to object	You may object (the right to “opt-out”) to the processing of your personal data (namely for profiling or marketing communications). If we process your personal data on the basis of your consent, you can withdraw your consent at any time.
Right not to be subjected to automated decisions	You have the right not to be subjected to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

D. How can you exercise the above rights?

These rights can be exercised by filling in the Complaint Request Form, electronically at the following e-mail address , over the phone at 233 113 435 or in writing at the Company's registered office address above. You also have the right to lodge a complaint with the Office for Personal Data Protection or another competent supervisory authority in the context of the processing of your personal data.

E. Who are the recipients of your personal data and other subjects?

1. Personal data recipients

For purposes of providing Company services, third parties are involved in the processes that are crucial for ensuring the provision of our services at the highest standard. The main reasons for providing personal data to third parties include administration of services, promotion of services, or communication with our users, partners or clients. The Company does not sell or lend personal data in exchange for payment.

The Company shares personal data with the following parties:

Operators and administrators of websites and cloud storages: in certain cases, third parties may have access to personal data that is stored under user accounts on the Company’s website. Furthermore, personal data may be shared with third parties that provide the Company with services related to cloud storage.
Partners providing info-line services: for the purpose of providing our users, clients and partners with quality customer service, the Company may share personal data with third parties that provide call centre services for the Company.
Suppliers of services related to the provision of benefits: In certain cases, the Company may transfer your personal data to third parties that prepare and manufacture personalised benefits for the Company (i.e. namely personalised vouchers or cards). The Company may also provide certain personal data to a third party that processes payments with Gastro Pluxee. At the same time, the Company shares personal data with companies that provide supply services for users, clients or partners.
Public Authorities: The Company complies with applicable laws and thus, in certain cases, shares personal data with state authorities, if required so by law. The Company may make personal data available to other parties in order to secure and protect their rights and assets or the rights and assets of their business partners.
Other companies within Pluxee Group: in order to improve the services provided by the Company, personal data may be shared within Pluxee Group.
In this respect, Pluxee Groupensures the maximum level of protection and confidentiality when transferring your personal data.
Partners providing marketing and PR services: To a limited extent, the Company shares personal data with third parties that help the Company improve and promote its services. These third parties prepare business or marketing communications for our users, clients, or partners and/or provide services regarding online forms and web applications. For purposes of considerable determination, the Company shall provide data subjects with the highest possible rights and protection of personal data, in which case the Company shall list third parties with which it shares your information for purposes mentioned above:
1. KINDRED GROUP s.r.o., with its registered office at Drtinova 557/10, Smíchov, 150 00 Prague 5, Company Reg. No. 06024491, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 274199;
2. Boomerang Communication s.r.o., with its registered office at Nad Kazankou 708/37, Trója, 171 00 Prague 7, Company Reg. No. 26447657, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 82867;
3. AMI Communications, spol. s r.o., with its registered office at Týn 641/4, Old Town, 110 00 Prague 1, Company Reg. No. 63077370, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 36493;
4. E-mail: Machine s.r.o., with its registered office at Londýnské náměstí 881/6, Štýřice, 639 00 Brno, Company Reg. No. 03568831, registered in the Commercial Register maintained by the Regional Court in Brno under File No. C 85521;
5. Re-Hab / creative boutique s.r.o., with its registered office at Bajkalská 672/14, Vršovice, 100 00 Prague 10, Company Reg. No. 02896991, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 225186;
6. ART living s.r.o., with its registered office at Koněvova 2499/246, 130 00 Prague 3, Company Reg. No. 45787875, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 17303;
7. DATOR3 Services, a.s., with its registered office at Stýblova 253/13, Chodov, 149 00 Prague 4, Company Reg. No. 25788612, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. B 6067;
8. IPSOS s.r.o., with its registered office at Topolská 1591, Černošice, 252 28 Praha-západ district, Company Reg. No. 26738902, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 90694.

2. Other subjects

Independent controllers of personal data

In addition to the above, the Company holds the position of an independent controller of personal data along with Company’s clients, i.e., the companies to whose employees the Company provides a wide range of employee benefits.

With these clients, the Company holds the position of independent controllers, as each of them is capable of determining the purpose and means of processing of the personal data processed and stored under their control in accordance with their privacy policy.

The Company enters into agreements with these clients between personal data controllers that set a framework for sharing personal data between the controllers and defines the policies and procedures that the controllers comply with and the mutual responsibilities between the controllers.

F. Joint controllers

In order to be able to provide our services to a high standard, we must in some cases establish cooperation with other entities with whom we jointly determine the purpose and means of processing your personal data. In such case, we become joint controllers of your personal data. In accordance with Article 26 of the GDPR, we will always enter into a joint controllership with such entities, through which we will define between us the responsibilities for the fulfilment of the obligations under the GDPR.

You can exercise your rights under the GDPR in accordance with Article 26(3) of the GDPR both with us and with the other joint controller of your personal data.

We are currently in the position of joint controllers with the following entities:

E Corp innovations s.r.o., with its registered office at: Klatovská 638, 340 22 Nýrsko, ID No.: 077 12 014, registered in the Commercial Register maintained by the Regional Court in Plzeň, File No. C 37222 (hereinafter referred to as “E Corp innovations”). Together with this company, we operate and ensure the functioning of the Active Pass card.

E Corp innovations has the following obligations towards you:

provide you with information in accordance with Article 13 of the GDPR where your personal data has been obtained directly from you;
provide you with information in accordance with Article 14 of the GDPR where your personal data has not been obtained directly from you;
seek your consent for themselves and for our Company to processing your personal data covering all purposes for processing such personal data as collectively defined by us and E Corp innovations where consent is required under the GDPR for such data processing, and to keep proper records of such consent for as long as it remains valid;
inform you of any essential elements of the contract when providing information pursuant to Article 13 or Article 14 of the GDPR;
put in place appropriate technical and organisational measures within the meaning of the GDPR to ensure and be able to demonstrate that the processing of personal data is carried out in accordance with the GDPR, and review and update those measures;
and act as a common point of contact for both controllers;
maintain and, from time to time, review and update records on data processing within the meaning of the GDPR;
implement appropriate technical and organisational measures within the meaning of the GDPR to ensure and be able to demonstrate that the data processing is carried out in accordance with the GDPR, as well as review and update these measures;
report, properly and in a timely manner, any possible data security breaches to the supervisory authority and cooperate with the authority to the necessary extent;
and notify you of any data security breaches in a proper and timely manner.

G. Definitions

Applicable data protection legislation denotes all applicable laws and regulations relating to the protection and processing of personal data, including Regulation (EU) 2016/79 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and other legislation adopted in the Czech Republic and the European Union.

Complaint denotes a complaint lodged by the data subject with the supervisory authority if the data subject believes their rights under the applicable data protection laws have been infringed.

Company denotes Pluxee Česká republika a.s., with its registered office at Spaces SmíchOff, Plzeňská 3350/18, Praha 5 - Smíchov, Postcode 150 00, ID No.: 61860476, listed in the Commercial Register maintained by the Municipal Court in Prague, under File No. B 2947.

Data subject’s rights denote the rights granted to data subjects by the applicable data protection laws, such as the right of access, right to rectification, right to erasure, right to restriction of Processing, right to data portability or the right to object.

General Data Protection Regulation or GDPR denotes Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Request refers to one of the mechanisms provided by the GDPR to data subjects to allow them to exercise their rights (such as the right of access, to rectification, erasure, etc.). A data subject may lodge a request against any person which processes their personal data, the controller or the processor, if relevant.

This Statement comes into force on 2 December 2019. This Statement shall be reviewed and updated periodically after the lapse of 12 months from the date on which it came into force or from the last review and update, or more frequently if the need for review and update arises. The current version of the Statement is always available on the Internet at https://pluxee.cz/zasady-ochrany-osobnich-udaju/

Annex 1 Complaint Request Form
Annex 2 Pluxee Cookie Policy