Thanks to you we won’t drown in the new personal data processing regulation. Thanks!

---

What is it actually about?

The GDPR (General Data Protection Regulation) is a new general regulation from the European Union on the protection of personal data whose aim is to markedly increase the protection of citizens’ personal data.

Put simply, you could say that we need your consent to process personal data such as your e-mail address. We will then be able to continue to send you the newsletter or invitations to events. Basically, thanks to this consent you will remain on the same (wild) wavelength as us. Your personal data, the same as operating data, will be wrapped in cotton wool here and we will carefully monitor who has access to them and, in particular, why.

Who is who?

Data Subject - an identified or identifiable natural person whose personal data are processed.

Data Controller - a natural person or legal entity, public power body, agency or other subject that, itself or together with others, determines the purposes and means for processing personal data (in this case us, GMF Aquapark Prague – the operator of the Aquapalace Praha complex).

Data Processor - a natural person or legal entity, public power body, agency or another entity that processes personal data for the controller.

Supervisory Office - Office for Personal Data Protection of the Czech Republic (www.uoou.cz)

Information about Personal Data Processing

Who will be the Controller of your personal data?

GMF AQUAPARK PRAGUE, a.s., registered office: Prague 1, Masarykovo nábř. 235/28, post code: 110 00, registered number: 276 42 127 (hereinafter the “Controller”) processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation (hereinafter the “GDPR”), and other legal regulations.

You can contact the Controller in matters concerning the processing of your personal data using the following contact details:

• tel.: 271 104 111
• e-mail: gdpr@aquapalace.cz
• website: www.aquapalace.cz/gdpr

Your personal data will be processed by the Controller manually and automatically directly by employees authorized and trained to do so. The Controller can use external processors for processing personal data (for more details see Chapter Who can your personal data be handed over to?).

For what purposes will your personal data be processed?

With regard to the services you use and the relevant purpose, we process the personal data we obtain from you to no more than the following extent.

For the purpose of registration and maintaining records of membership, season tickets, reservations, services, training sessions and courses, and purchases of services and goods using our e-shop, in accordance with a contract on provision of services we process the following personal data: contact details (first name, surname, post code of residence, address of residence, e-mail address, telephone number), other details for the records (date of birth, identification photo). The aforementioned personal data are processed based on the performance of a contract on provision of services, for no more than the period of performance of the contract plus 3.5 years for the time-barring of all obligations due to the performance of the contract.

For the purpose of maintaining a database of registered users and personal online accounts for clients, we process the following personal data: contact details (first name, surname, post code of residence, address of residence, e-mail address, telephone number). The aforementioned personal data are processed based on a legitimate interest, for no more than five years from the last log-on to the client’s online account.

For the purpose of protection of health, security and the assets of the Controller and its clients, we process the following personal data: digital video recording of public space (recording of people’s faces and figures, vehicle number plates). The aforementioned personal data is processed based on a legitimate interest, for no more than 15 days (in the event express consent is granted by the Data Subject, a recording can be stored for up to five years primarily for security and legal reasons).

For the purpose of internal marketing research, we process the following personal data: contact details (first name, surname, post code of residence, e-mail address, telephone number), additional details for records (date of birth, gender, age). The aforementioned personal data are processed based on a consent, for no more than the period of performance of the contract plus 3.5 years for the time-barring of all obligations due to the performance of the contract.

For the purpose of sending business communications to clients, we process the following personal data: contact details (first name, surname, post code of residence, e-mail address, telephone number), additional details for records (date of birth, gender, age). The aforementioned personal data are processed based on a consent, for no more than five years.

For the purpose of completing a satisfaction questionnaire, we process the following personal data: contact details (e-mail address), additional details for records (gender, age). The aforementioned personal data are processed based on a consent, for no more than five years.

For the purpose of identifying you at the website and e-shop www.aquapalace.cz, remembering your log-on details/consents/settings during a repeat visit, ensuring security, monitoring website traffic and creating internal marketing research, we process the following personal data: contact details (first name, surname, country, e-mail address, telephone number), additional data for records (date of birth, age, IP address). The aforementioned personal data are processed based on a consent to storing cookies, in accordance with the type of cookies for no more than two years.

For the purpose of providing a discount on the entry price, we process the following personal data: contact details (first name, surname), additional details for records (number of card justifying sale of ticket with discount – e.g. disability card, ISIC student card, etc.). The aforementioned personal data are processed based on a legitimate interest, for no more than one year.

For the purpose of holding consumer competitions, we process the following personal data: contact details (first name, surname, permanent residence, e-mail address, telephone number), additional details for records (date of birth, gender, age), photo/video recordings. The aforementioned personal data are processed based on a consent, for no more than one year after the end of the competition.

For the purpose of entry consultation before a SPA & wellness treatment, with a focus on recommending the most appropriate subsequent treatment we process the following personal data: contact details (first name, surname, e-mail address, telephone number), additional details for records (current medical condition). The aforementioned personal data are processed based on an express consent, for no more than five years.

For the purpose of ensuring the safe provision of swimming courses, due to the elimination of the negative consequences for the health of a course participant caused by the non-adaptation of teaching to medical condition, we process the following personal data: contact details (first name, surname, address of residence, e-mail address, telephone number), additional data for records (date of birth, medical problems in relation to swimming lessons). The aforementioned personal data are processed based on an express consent, for no more than five years.

For the purpose of a bio-impedance analysis of the human body – InBody measurement and assessment of circulatory system and stress resistance, we process the following personal data: contact details (first name, surname, e-mail address, telephone number), additional data for records (date of birth, gender, age), monitoring of history of InBody measurements (progress/regression, height, weight, proportions of body composition – muscles, fats, minerals, base metabolism, obesity), monitoring of history of Max Pulse measurements (photoplethysmography examinations of blood vessels and examinations of autonomous balance and state of stress). The aforementioned personal data are processed based on an express consent, for no more than three years.

For the purpose of ensuring safety and protection of health and assets of the Controller and its clients, we process the following personal data: contact details (first name, surname, address of residence, e-mail address, telephone number, ID card number). The aforementioned personal data are processed based on a legitimate interest, for no more than two years.

For the purpose of compliance with statutory duties (accounting, tax and other laws related to the Controller’s activities), we process the necessary personal data stipulated by the law. The personal data are processed based on a legitimate interest, for no more than the period of performance of the contract plus 10 years for the time-barring of all obligations due to the performance of the contract.

Who can your personal data be handed over to?

In order to properly comply with the aforementioned purposes of processing, we hand your personal data over to some other entities (recipients). However, we always ensure that your personal data is handed over only to the necessary extent and only to entities that provide sufficient guarantees about the security of personal data and processing of your data in accordance with the relevant legal regulations.

You can find a list of recipients to which your personal data can be disclosed at the website: www.aquapalace.cz/gdpr or you can request the list from the Controller’s office: AQUAPALACE Praha, Pražská 138, Čestlice, 251 01 Prague-East.

What rights can you exercise in relation to your personal data?

Right to Access Personal Data

As a part of your right to access personal data, you can request, specifically:

1. Information about whether we process your personal data; and
2. The provision of copies of some personal data (selected by you) or all your personal data processed.

Right to Rectification of Personal Data

You are entitled to request the rectification of inaccurate or out-of-date personal data. You can also input a supplementation of any incomplete personal data.

Right to Erasure of Personal Data

You have the right to request the erasure of some or all of your personal data, in the event that:

1. The personal data are no longer needed for the purposes for which they were gathered or otherwise processed;
2. Their processing is unlawful, this occurs in cases where there are no legal grounds for processing or they have ceased to apply (e.g. after the rescinding of consent to processing or the successful making of an objection to processing, see below), or the personal data are being processed unlawfully for another reason;
3. Legal regulations impose on the Controller a duty to erase your personal data;
4. The personal data were gathered in connection with an offer of information society services from a child under 16 years of age.

Your personal data will be erased if there are no statutory grounds for continuing to process them despite your request. These grounds are, in particular, further processing for the purpose of compliance with our legal duties or for the purpose of determining, performing or defending our legal claims. If, however, there is no reason for further processing, we will comply with your request promptly.

Right to Restrict Processing

You have the right to request the restriction of processing of your personal data. In such case, your personal data are only stored and no other processing operations are performed with them, with the statutory exceptions. You can request a restriction to processing in the following cases:

1. You deny the precision of your personal data, for the period necessary to verify their precision;
2. Processing is unlawful, but you refuse the erasure of your personal data and, instead of this, request a restriction on their processing;
3. We no longer need your personal data for the purposes of processing, but you need them for the determination, performance or defending of legal claims;
4. You objected to processing, for the period necessary for verification of whether our legitimate reasons predominate over your legitimate reasons (see below).

Right to Object to Processing

In the event we process your personal data based on a legitimate interest and you believe that our legitimate grounds for processing do not predominate over your interests or rights and freedoms, you have the right to object to processing of your personal data. We will check your request and, if we find that our interest in further processing does not predominate over your interests, we will end the processing of your personal data.

If you object to the processing of your personal data as a part of direct marketing, we will end processing promptly.

Right to Portability

In the event we process your personal data

1. automatically (using computer equipment) and also
2. based on your consent or a contract,

you can request the provision of such personal data in XML format. At your request, we can hand over structured personal data directly to another controller of your choosing.

Right to Rescind Consent

If we process your personal data based on your consent, you can rescind this consent at any time. If you rescind your consent, we will promptly stop processing your personal data for the purpose that is related to such consent. Rescinding a consent does not have an influence on further processing of personal data processed based on other legal grounds, e.g. performance of a legal duty of the Controller.

Right to Make Complaint to Supervisory Authority

In cases where you believe that your rights resulting from legal regulations were breached or infringed, you can make a complaint to any supervisory body in any European Union member state, in particular in the member state of your usual residence, the place of your employment or the place the alleged breach took place. In the Czech Republic, the supervisory body is the Office for Personal Data Protection, registered office: Pplk. Sochora 27, 170 00 Prague 7, see www.uoou.cz.

In what way can you exercise your rights regarding the Controller?

You can exercise your rights using a form that is available at our website: www.aquapalace.cz/gdpr or in the place of the Controller’s branch at the addres: AQUAPALACE Praha, Pražská 138, Čestlice, 251 01 Prague-East.

You can send us the form in one of the following ways:

1. personal on-line account: secure web form in a personal account at the Controller’s website www.aquapalace.cz available after the input of your log-in details;
2. data message: you send the attached completed form from a data box in your name to the address of the Controller’s data box: a4beahw;
3. e-mail: you send the form to the address gdpr@aquapalace.cz and mark it with your guaranteed electronic signature;
4. letter: you send the printed form to the address of the Controller’s branch: AQUAPALACE Praha, Pražská 138, Čestlice, 251 01 Prague-East. Title the letter “GDPR” and sign the form with a notarized signature;
5. in person: you can submit the printed form at the place of the Controller’s branch: AQUAPALACE Praha, Pražská 138, Čestlice, 251 01 Prague-East. Depending on the right exercised, you can be asked to submit an identity document issued by a state administration body.

Your request for the exercise of your rights in relation to your personal data will be dealt with by the Controller free of charge and without undue delay, no later than within one month. In exceptional cases, this period can be extended by no more than two months, where you must be informed of such exceptional extension and it must be properly justified to you by the Controller.

Use of Cookies at Website www.aquapalace.cz

In order to increase your comfort when browsing our website and using it, we process your preferences using cookies. Cookies are small files that a website stores in your internet browser and that enable the website to record your pre-selections, habits and information about your visits (for example the language version of the website you chose, pre-completion of the log-on form from your last visit, it remembers the contents of your shopping basket, etc.).

We divided cookies by validity into:

1. temporary cookies (they remain stored on your internet browser until you close the browser)
2. permanent cookies (they remain stored over the long term on your computer, until the set period expires or you remove them manually)

We divided cookies by purpose into three basic categories:

• functional cookies (they are necessary for basic individualized use of a website – they enable, for example, the creation of a shopping basket, the playing of videos, they help security and compliance with legal regulations, etc.)
• optimization cookies (monitoring of website visitors’ behaviour for the purpose of optimizing and increasing functionality – they enable, for example, the remembering of your selections for individual pages, click trends, etc.)
• advertising cookies (they ensure the offering of relevant content and advertising corresponding to your needs, they also serve to limit the displaying of advertising, measure the effectiveness of a campaign, personalisation, etc.; these cookies can pass on information about visitors’ behaviour on the Internet to advertising and social networks, see the chapter Who Can Your Personal Data Be Handed Over To?)

If you want to refuse or remove cookies from your device, you can do this directly in your internet browser. For the correct functioning and an increase in the user comfort of browsing our website, however, we warmly recommend permitting storage of cookies.