Informational memorandum - conditions of personal data protection in Hnutí DUHA

Part 1 - General information and a letter of your rights

Organization information (personal data provider):

Hnutí DUHA – Friends of the Earth Czech Republic

Údolní 33

602 00 Brno

IČO: 15547779

E-mail: osobni.udaje@hnutiduha.cz

(further referred to as “provider” or “organization” or “Hnutí DUHA”).

Our organization follows the legal needs of personal data protection, namely in accordance with regulation of the European Parliament and Board (EU) no. 2016/679 from 27.4.2016, general data protection regulation (GDPR). We have set up suitable technical and organizational measures to sufficiently protect personal data. Our goal is to keep your privacy to the fullest extent, which is why we always properly evaluate whether a certain data processing is at all necessary and whether it excessively interferes with your rights and freedoms. This document summarizes everything that deals with not only sharing with third parties but also other data protection requirements within Hnutí DUHA.

Personal data sharing

Personal data which we process is not accessible to any unauthorized subjects and we do not pass it on to other subjects without informing you. General information about data sharing is described below. The concrete information within the particular subject categories with which we are allowed to share the data may be found in the next chapter. Before sharing your personal data, we always carefully assess all conditions, so that their protection may reach the appropriate level. 

Sharing within the organization

Personal data can be shared with our branch associations or they can share the data with us in regard to fulfilling the purpose for which it is being processed. 

Petition

Data which you have disclosed in our petition may be offered to  third parties so that the purpose of the petition can be fulfilled in accordance with law. 

Marketing

We process personal data for direct marketing purposes, meaning addressing a service offer via e-mail, mail or phone. You may raise an objection to this at any time and your data will no longer be processed. In each of our e-mails, you may find an option to unsubscribe from receiving e-mail messages or you can turn to us directly using osobni.udaje@hnutiduha.cz. More detailed information regarding which data we process for direct marketing purposes can be found in relevant chapters. 

Right to information

Your right is to request information from our organization regarding which personal data we process, to what extent and to what purpose, and if there exist any other recipients or categories of recipients of this personal data. This information can be provided by us for free in the 30-day period, in exceptional circumstances, no later than 90 days, about which you will be informed. 

Should you ask for the information which we have filed about you, we will first need to authenticate that you are truly the person to which this information belongs. Therefore, state in your request a sufficient identification of your person from which it will be evident as to who is requesting the information. 

Our right then is to decline those requests for information that is causeless or excessively repetitive, or acquiring it takes an inadequate amount of effort or it is hard to acquire (usually from stand-by systems, archival documents etc.). 

Data updates, right to correction

Since the personal data can change overtime (change of surname, address, etc.), we will be delighted if you would inform us about any changes. With that also comes your right to correct personal information that we file. If you find out that the information is no longer up to date, you have a right to demand their correction. It may happen that we will ask you for updates ourselves. 

Objections

If you believe that your personal information is not being processed in accordance with the law, you have the right to raise an objection and we will check the legitimacy of your request. You also have the right to turn in your objection to the competent supervising Office for Personal Data Protection at the address: 

Úřad pro ochranu osobních údajů

Pplk. Sochora 27

170 00 Praha 7

http://www.uoou.cz/ (odkaz je externí)

Right to deletion

If you have given us your consent to the processing of your personal data, you have the right to revoke this consent at any time and we will delete the information which we process exclusively based on your consent. The right to deletion does not apply to data processed in terms of fulfilling the contract terms, legal reasons or justified interests of our organization. Even in this case, though, we will continue to process your personal data to the smallest necessary extent. 

Other rights

According to the relevant legislation, you have other rights which are indeed valid even if they are not stated in this document. We have been focused on those rights that we find the most relevant to our activities. For a more detailed study of your rights, we recommend a guide called It is your data - have them under control, which has been put together by the European commission. 

Part 2 - Individual subject categories whose personal data we process

Our organization processes personal data from several subject categories. The following paragraphs describe the involved extent, intention, legal basis for processing, overview of recipients of this data and time during which we process this data. 

Members of the organization

Personal information of members of the organization is processed to the extent of basic personal and contact details stated in the member application. The intention of this process is to inform the members of the organization about its activities, filing of the member base and organization of our activities for the fulfillment of our mission. The legal basis for such processing is a valid interest of the organization to fulfill its function in cooperation with its members. Information is always shared to the necessary extent with processors - to subsuppliers of the communication services to, for example, send out electronic or written messages; to administrators of the information systems of the organization to maintain its proper functioning and development. Some information may be provided to the administrators of grants and other similar systems for the fulfillment of their terms. Some contact information of the members can be, upon agreement, made public on the internet or in other communication materials of the organization, its branch associations or in projects organized by the organization, if that is implied by the specific function of the member within the organization. The member has an opportunity to decline the sending of e-mail or other messages and the publishing of personal information on websites or other communication materials. Personal information will be deleted after the person ceases to be a member of the organization. 

Employees of the organization and job candidates

We process personal data of our employees to the extent that is required by law. The intent of such a process is fulfilling the work contract, fulfilling law responsibilities that relate to the employee and wages agenda, promotion of the organization and fulfilling responsibilities that result from the requirements of grants and other similar programmes. The legal basis for this processing is the fulfillment of the contract and the law obligation; law obligations also define circles of persons with access to which the personal information is handed to, meaning authorities and institutions. Some contact information of the employees may be, upon agreement, made public on the internet or in other communication materials of the organization, its branch associations or in projects organized by the organization, if that is implied from the specific function of the employee within the organization. Personal information of employees will be deleted, more accurately archived, in accordance to relevant deadlines and to a relevant extent in accordance with our legislation. 

We process personal information of job candidates on the regular CV extent with the intent of preparation and organization of staff selection procedure. The first basis for its processing is the consent which is given to us by the job candidate. Personal information of these candidates is not accessible to anyone and we store it for the minimum period of one year from the moment of its provision with the intent of eventual informing the candidate, should the organization offer another staff selection procedure for a similar position to the one in which the candidate has shown interest. The consent with personal data processing can be revoked at any time by sending an e-mail to osobni.udaje@hnutiduha.cz; the candidate will be discarded from said selection procedure if the revoking of said consent happens before the end of the selection procedure.

Donors

Donors’ personal information is processed to the extent of basic personal and contact information, especially in accordance with a relevant donation contract. If the donor provides us with consent, we also process phone call recordings. The intent for the data processing of donor’s information is fulfillment in accordance with a donation contract, including fulfillment of sending awards from the public collection (e-shop), communication with donors about using their donations and about the functioning of the organization and further relationship development with the donor. Direct marketing can also serve as an intent. The law basis for donors’ personal data processing is fulfillment in accordance with a donation contract or a consent to personal data processing, which is presented on a donation form, letter, e-mail or other form of communication, including e-shop or read out loud before engaging in a phone call. Donors’ personal information is accessible only to processors - to subsuppliers of the communication services to, for example, send out electronic or written messages; to administrators of the information systems of the organization to maintain its proper functioning and development. Donors’ personal data will be deleted after a period of 5 years (at the end of the calendar year) from the last financial transaction of the donor. If the donor up to this point does not show interest in being sent informational notifications, they will be moved into a relevant category, or rather, after the revoking of eventual consent. Phone call recordings are deleted within the period of 3 months after the call has taken place.

Hnutí DUHA volunteers and event participants

Personal data of volunteers and event participants are being processed to such an extent, to which they have been granted to us by the persons at the registration using the volunteer form, registration or other similar forms or means of communication. The intent of the process is organizing the workload of volunteers, their recording and informing about possible volunteer work for Hnutí DUHA, organizing events held by Hnutí DUHA, informing about other activities of Hnutí DUHA and fundraising communication in order to gain donors. Direct marketing can also serve as an intent.

The legal basis for data processing is fulfillment of a volunteer contract, fulfillment of obligations imposed by law, for example, obligations to the registry and announcement to the authorities or administrators of grants and other similar programmes, content to process from the volunteer’s or event participant’s side, or rather a situation when the processing is necessary for the legitimate interests of the administrator. 

Legitimate interests of Hnutí DUHA are to give volunteers and event participants information about its activities and the offer of its services with a possibility to financially support the organization, to organize volunteer activities and to organize events connected to Hnutí DUHA activities, including ensuring the safety of the participants of these activities. Upon demanding to be discarded from the e-mail list, the person is discarded from information sent via mailing list. 

Personal data are handed over to recipients (administrators) based on law binding obligations of the administrator, recipients - administrators of grants and similar programmes, where the rules of these programmes demand it, and to physical and legal entities - events and activities organizers to which volunteers may sign up through administrator. Personal data will also be accessible to processors - to subsuppliers of the communication services to, for example, send out electronic or written messages; to administrators of the information systems of the organization to maintain its proper functioning and development. 

Personal information about volunteering will be deleted in the period of 5 years (by the end of the calendar year) after the person has ceased to volunteer in the organization, or at any time on account of the volunteer’s request. Personal information about event participants will be deleted in the period of 5 years (by the end of the calendar year) since the last event participation, eventually after the period of time which was listed in the written consent, or based on the revoking of the consent with data processing, should this have been done based on the consent. 

Informational announcements and e-mail newsletters subscribers, Seventh generation subscribers

Personal information of persons who receive informational announcements via e-mail and newsletters is processed to the extent of name, e-mail, address and, eventually, a phone number, if you provide us with it. If the subscriber gives their consent, we also process phone call recordings. In such cases, the consent is always read out loud before the phone call recording begins. We process information with the intent of sending informational and advertising announcements regarding the organization’s activities, including event invitations and fundraising communication, in order to gain donors, with the intent of sending informational announcements regarding general events in fields that are connected to the organization’s activities, and the recipients of these announcements have shown interest in such information in the past. Fulfilling the subscription contract also serves as an intent, just as direct marketing, including showing advertisements based on automated personal data processing through advertising systems.

The legal basis of the process is mostly consent to processing and contract fulfillment. In certain cases, the data processing is also necessary as a fulfillment of legitimate interests of the organization. The legitimate interest is to provide persons who have shown interest in information regarding activities and services in the past with such information and offers which are relevant to them in the form of sending informational e-mails, SMS, packages, showing advertisements or making phone calls. Upon demanding to be discarded from receiving e-mails, the person is discarded from information sent via mailing list and data processing is terminated. To be discarded from the show of advertisement in advertising systems based on your e-mail address, you may contact osobni.udaje@hnutiduha.cz and you will be discarded from such displaying.  

Personal information is accessible only to the processors - to subsuppliers of the communication services to, for example, send out electronic or written messages; to administrators of the information systems of the organization to maintain its proper functioning and development and to advertisement system operators with the intent of showing targeted ads and informational announcements.  

Personal information is being processed until the revoking of consent, eventually until the end of the calendar year after the ending of the concrete purpose of sending, for example for a campaign or a project, if Hnutí DUHA won’t be continuing on another project which would be similarly focused as the original purpose. Processing will also end after the termination of the subscription contract. Phone call records are deleted for the period of 3 months after the call has taken place. 

Farmers’ databaze

Farmers’ personal data in regards to Farmers’ catalog are processed to the extent of basic personal and contact information based on the consent of each individual person. The intent of personal data processing is the creation of Farmers’ catalog for better accessibility of local foods. Farmers’ personal data is published on internet sites. Personal data will be deleted on the basis of revoking the consent or, eventually, to the period of 4 years after the last contact with the farmer.  

Part 3 - Information regarding internet privacy

Websites

If you enter and browse our website, we process protocol files (logs) and we store them on our servers. Information that we store includes: 

• your IP address

• open website of our web

• http answer code

• identification of your browser

This information is processed automatically within the framework of internet server operation with the intent of an unproblematic running of the server. 

Hnutí DUHA website means any content that is gained from the content available on domains owned by Hnutí DUHA - Friends of the Earth Czech Republic. 

Cookies

We use technologies meant for collecting and storing information using cookie files on your device the moment you visit our website. Cookies are small text files without which we are not able to maintain the full-value functionality of the site. 

Our website can also contain codes from third parties, such as Google, Facebook and other companies’ codes which can in turn use other cookies that monitor your activity on the internet. Cookies of third parties follow different rules of personal data protection than this site. These “monitoring” cookies can be blocked in your browser’s settings. You may change the settings in Privacy settings.