I. Rights and Obligations of the Data Subject
The data subject has the right to be informed about the processing of his or her personal data. This includes, in particular, information regarding the purpose of the processing, the identity of the controller, the controller’s legitimate interests, and the recipients of the personal data. To this end, by signing the travel contract—which includes the General Terms and Conditions—the customer confirms that he or she has duly familiarized himself or herself with “Customer Information on Rights Regarding the Protection of Personal Data and Its Processing by CK PURA VIDA TRAVEL” (available at www.go2prague).com.
For the purposes of this document, a “customer” is defined as a person who has entered into a contractual relationship for the provision of a product by CK PURA VIDA TRAVEL (hereinafter referred to as the “company”), such as a travel contract.
By signing the travel contract, the customer, as the data subject, also undertakes and accepts the obligation to inform and familiarize the fellow travelers listed on the same travel contract regarding the data subject’s rights in connection with the protection of the data subject’s personal data and to properly instruct them on this matter.
Other rights of the data subject, which are based on the data subject’s actions, include the right of access to personal data, the right to rectification or supplementation, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and the right not to be subject to automated individual decision-making. By signing below, the customer acknowledges
The deletion of personal data refers to the deletion of those data for which the customer has given explicit consent by agreeing to and signing the document “Consent to the Processing of Personal Data.” Under no circumstances does this affect the fulfillment of the contractual obligation, i.e., the organization of the trip and the customer’s participation in the trip.
Likewise, under no circumstances does the deletion prevent CK PURA VIDA TRAVEL s. r. o. from continuing to process all necessary data (see definition in point “2”) for the purposes specified in paragraph (1) and (2) of point “2,” i.e., for example, for the purpose of organizing the trip.
The data subject also has the right to contact the supervisory authority (the Office for Personal Data Protection) in the event of a suspicion that their personal data is being processed unlawfully, or that a request to remedy a situation that violates legal regulations has been denied.
The data subject may report this to the controller in writing at the controller’s address or via email at hello@go2prague.com Any doubts, reservations, or complaints regarding the controller’s handling and processing of personal data must be addressed to the controller, who is obligated to respond within 1 month (30 days).
2. Handling of the Company’s Customers’ Personal Data
The customer is considered a data subject. The company, or rather its employees, process the data of the customer—i.e., the data subject—in accordance with all applicable legal regulations, including the Regulation. “Processing” refers to all operations involving data, including their proper recording, storage, security, protection, disposal, and other necessary actions, exclusively for the purposes specified below.
The company’s processing of personal data is carried out exclusively in accordance with the provisions of Article 6 of the Regulation, which stipulates that data may be processed only on the following legal grounds:
- The data subject (customer) gives consent to the processing of personal data;
- Processing that is necessary for the performance of a contract;
- Processing that is necessary to comply with a legal obligation to which the controller is subject;
- Processing that is necessary for the purposes of the controller’s legitimate interests.
The customer’s personal data is processed and used by the company, or rather by its employees, solely for the following purposes:
- organizing the trip and fulfilling statutory archiving obligations;
- sending general marketing communications to customers;
- enrolling customers in loyalty and discount programs, sending catalogs, and other types of product offers to a suitable sample of clients
1. The processing of personal data for the purpose of organizing a trip is not subject to the customer’s consent, as this purpose of processing constitutes a lawful basis for data processing. For this purpose, only the necessary data may be processed. Depending on the specific product—particularly the destination and type of trip—the set of necessary data varies. In all cases, the data necessary for the trip to take place—i.e., to fulfill the contractual agreement between the company and the customer—includes the first name, last name, date of birth, and contact information (for the purpose of providing detailed trip instructions, the ability to contact the customer in an emergency, etc., hereinafter referred to as “contact information”), i.e., residential address, phone number, and email address. In cases where additional data beyond the scope of the above is required, a company employee is obligated to inform the customer of the purpose of processing such data, and it is always the case that this purpose is, once again, the necessity of such data for the execution of the trip. For some air travel packages, this may involve, for example, a travel document number; when arranging entry permits and visas, it may also involve a copy of the travel document, etc. In accordance with applicable legal regulations, the company ensures compliance with statutory archiving obligations. This point corresponds to point b) of Article 6 of the Regulation.
2. The company processes personal data—specifically, customers’ first names, last names, dates of birth, and contact information—for the purpose of creating internal contact databases, to send general marketing communications to customers or in cases where a trip is booked for a third party. The processing of data for the purposes specified in this section is also not subject to the customer’s consent, as it constitutes a lawful basis for data processing pursuant to point d) of Article 6, of the Regulation.
3. The processing of personal data for the purpose of enrolling the customer in a loyalty program and optimizing marketing offers to minimize the negative impact on the customer in terms of sending (for a given customer) unnecessary general marketing communications, to enable the company to offer the customer loyalty discounts, and, from the company’s perspective, to target a suitable sample of customers (for example, based on preferred destinations, products, etc.). The processing of personal data for the purpose specified in this section is subject to the customer’s explicit consent to the processing of personal data for this purpose, and if the customer is interested in having their data processed for this purpose, they may do so upon signing the travel contract by signing an additional document titled “Consent to the Processing of Personal Data,” which is also available in electronic form at www.go2prague.com. This document is in no way part of the travel contract, and consent to it is therefore not required for the trip to take place or for the customer to participate in the trip. If the customer grants consent to the processing of data for the purposes specified in this section, the customer has the right to revoke such consent at any time, and the company will promptly delete such data or will not process the data (which, for example, would coincide with data that the company is required to retain for another lawful purpose—such as the organization of a trip) for the purposes specified in this section.
The company and its employees properly store and maintain records of the above-mentioned data.
The company and its employees then use the data from these databases exclusively for the purposes specified in paragraphs (1) and (2) of section “IV” above and, if the customer has given consent, also for the purposes specified in paragraph (3) of section “IV.” For the same purposes and based on the same criteria, the company and its employees handle all physical documents on which the data is recorded. These physical documents (printed travel contracts, lists of customers for a given product, seating arrangements during transportation, customer assignments for accommodations, lists of customers using travel insurance arranged by the company, etc.) are securely stored in lockable spaces (cabinets, drawers, etc.) and, just like data stored electronically, are used only to the extent necessary for the purposes listed above, and the company and its employees use them solely for specific tasks that enable the fulfillment of the given purpose (for example, the data is used to create a list of clients with contact information in case of emergencies during a trip, etc.) and immediately thereafter ensures that the data is made inaccessible again, i.e., stored back in a locked facility, and in the case of an electronic database, the person handling this data has properly logged out of the system, thereby preventing potential access to the data by an unauthorized person. Furthermore, the premises where the data is stored in physical form are secured by continuous video surveillance.
After the expiration of the period necessary for data processing—which is determined primarily by the legal obligation to archive data for the period specified by law— and subsequently for the period necessary for the purposes that constitute the legal grounds for data processing (i.e., the cases listed in paragraphs (1) and (2) of point “2”). If the customer grants consent to the processing of data for the purpose specified in paragraph (3), item “2,” this period is 5 years, and this period may be shortened at any time at the customer’s request, or the processing of data for this purpose may be terminated immediately upon request. This request for the erasure of data for this processing purpose—i.e., for the purpose specified in paragraph (3), point “2”—may be submitted in writing to the company’s address or via email to hello@go2prague.com. All personal data is then shredded or disposed of in a similar manner in accordance with applicable legal regulations on the proper disposal of personal data, and a record of this disposal is made.
The company and its employees then—solely for the purpose of organizing the trip —disclose the customer’s personal data, to the extent necessary, to external third parties (both individuals and legal entities) bound by contract. In particular, this includes an insurance company providing coverage to clients whose product includes travel insurance coverage or for whom customers themselves request the arrangement of travel insurance (the specific company and its contact information for a specific period, typically corresponding to the given calendar year—for example, in 2023, this is Česká podnikatelská pojišťovna, an insurance company headquartered in the EU. The company has entered into a contract with this insurance company regarding the processing and protection of personal data in accordance with applicable legal regulations, including the Regulation. For the aforementioned purpose of organizing the trip, the company’s employees provide the necessary information (a specific list of which is defined above) to external personnel, namely in particular to tour guides and tour leaders, etc. The company has entered into a contract with these third parties regarding the handling and protection of personal data in accordance with applicable laws, including the Regulation, through a Confidentiality Agreement , the protection of information, and the prohibition of its misuse, in which the third party explicitly undertakes to process personal data solely for the purpose of organizing the trip, to properly protect the data against misuse, and to prohibit the transfer of data to any other third party unless explicitly authorized to do so by the company.
This authorization again stems from the necessity of fulfilling the purpose, i.e., the organization of the trip, and, in addition to the above, is ensured by the fact that the third party (in this case, for example, an agency at the destination, a hotel, etc.; in the case of CK PURA VIDA TRAVEL s. r. o., this is generally a foreign third party; hereinafter collectively referred to as “partner”), which is the recipient of the data, complies with the legal safeguards for the protection of personal data and similar information.
In practice, this means that in cases the parties are not a) from countries that are EU member states and/or b) from countries that have ratified the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS 108/1981, and/ or c) from countries to which personal data may be transferred pursuant to a decision by EU authorities, we require our partners to include a data protection clause in the contract in accordance with the Commission Decision of February 5, February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries pursuant to Directive 95/46/EC (C 2010/593). This measure, to the extent prescribed by law, ensures an adequate level of protection for customer data.
In the context of so-called agency sales, where the company is the tour organizer and a partner travel agency acts as the seller of the company’s products, the customer’s personal data is also transferred. From this perspective, the company is the data controller and the selling agency or travel agency is the data processor. The company and its employees shall ensure that the company has an agreement with each institution, which, under the Regulation, acts as a personal data processor in relation to the company (i.e., specifically including agencies and travel agencies as defined in this paragraph), a contractual obligation to properly handle customers’ personal data in accordance with applicable laws, including the Regulation.
In the event that it is necessary to disclose information to third parties other than those mentioned above for the purpose of organizing the trip, the company and its employees will ensure the appropriate protection of customers’ personal data through an appropriate contractual obligation with the third party in question, in accordance with applicable legislation, including the Regulation.
In order to ensure the highest level of security in the handling of personal data and in accordance with legal regulations, including the Regulation, all employees are properly and thoroughly familiarized with the of handling personal data, which they confirm by signing a document certifying completion of training on the handling of customer personal data, as well as an agreement on confidentiality and the non-misuse of data in connection with the handling of the customer’s personal data. In the absence of this signature, the company employee does not have access to any customer personal data.
In the event that, despite all the measures described above, a breach of the security of data subjects’ personal data occurs in any form, the company will immediately proceed in accordance with applicable legal regulations, including the Regulation, i.e., it will report this fact to the supervisory authority (the Office for Personal Data Protection) and to the data subject within 72 hours of becoming aware of the breach. The same legal obligation applies to all third parties who process the data subjects’ data for the reasons stated above and in compliance with the conditions set forth above. Given the scope of the data being processed, its nature, and in particular its transfer to third parties in third countries—and, in cases where the customer has given explicit consent, also for marketing purposes based on the profiling of the targeted customer group (see paragraph (3), point “2”), the company appoints a Data Protection Officer.
The Data Protection Officer oversees compliance with all the aforementioned procedures for the handling and processing of personal data. He or she reviews the procedures of the company and its employees, points out deficiencies in the personal data processing process, serves as the point of contact for communication with the supervisory authority, is fully independent within the company in the performance of their duties, and the company is obligated to ensure they have sufficient access to the information necessary for them to fulfill their duties.
The Data Protection Officer is also the contact person to whom customers may turn in matters concerning the processing of personal data, to file complaints with him, to request the deletion of personal data (in accordance with the aspects mentioned above), request all information regarding the company’s handling of the customer’s personal data, and contact the DPO in all other situations related to the processing and protection of personal data which the company processes.Full responsibility for the proper handling of the personal data of customers, employees, and other data subjects always rests with the data controller (CK PURA VIDA TRAVEL s. r. o.) in accordance with legal regulations. Under no circumstances does the data protection officer have this responsibility, bear this liability, or assume it in any way.
Data Protection Officer
JUDr. Michal Srp
Email: hello@go2prague.com
In addition to email, requests, complaints, and inquiries may also be submitted to the following address of the controller, for the attention of the Data protection officer:
CK PURA VIDA TRAVEL s. r. o.
GDPR Data Protection Officer
Nám. Interbrigády 815/6
Prague 6 Bubeneč
160 00
Prepared in Prague on June 11, 2023
CK PURA VIDA TRAVEL s. r. o.
JUDr. Michal Srp, company executive
