Privacy Policy
effective from: [Sep 2, 2025]
version: [v1.0]
These Principles explain how ZO ČSOP Polabí, ID No.: 708 43 473, with its registered office at Na Zálesí 1473, 290 01 Poděbrady, website www.nahusliku.cz, email info@ekocentrumhuslik.cz, (“controller”, “we”) processes the personal data of individuals.
1) Who is the controller and how to contact us
The controller is Jakub Vaněk. Contact email for personal data protection: info@ekocentrumhuslik.cz.
2) What data we process and from which sources
We primarily process:
- Donors and supporters: identification and contact details, payment/variable symbols, donation history;
- Volunteers and job applicants: identification and contact details, CV/motivation data, and communication;
- Website and social media visitors: technical data (IP, logs), cookies, and similar identifiers (see below);
- Event participants and center visitors: identification and contact details, or photos/videos from public events;
- Suppliers and partners: identification, contact, and billing details.
We obtain data directly from you, or from public registers, event partners (participant lists), or through provided services (payment gateway, accounting).
3) Purposes, legal bases, and retention periods
We always link processing to a specific purpose and legal basis (Art. 6 GDPR); typically:
Purpose: Receipt and administration of donations, issuance of confirmations
Legal basis: performance of a contract / legal obligation (accounting, tax)
Retention period: for the duration of the contractual relationship and subsequently in accordance with statutory deadlines (typically 5–10 years)
Purpose: Bookkeeping and tax agenda
Legal basis: legal obligation
Retention period: in accordance with the Accounting Act and tax regulations (typically 5–10 years)
Purpose: Communication and support (answering inquiries)
Legal basis: legitimate interest / performance of a contract
Retention period: for the duration of the resolution + 3 years
Purpose: Fundraising, PR, direct marketing (newsletter)
Legal basis: consent; for existing supporters under the conditions of Act 480/2004 Coll.
Retention period: until consent is withdrawn / an objection is raised
Purpose: Event organization, volunteer records
Legal basis: performance of a contract / legitimate interest
Retention period: for the duration of the cooperation + 3 years
Purpose: Site security (if we operate a camera system)
Legal basis: legitimate interest; according to the Office for Personal Data Protection methodology
Retention period: for a justified period, usually a matter of days/weeks
Note: Statutory retention periods for accounting and tax documents in the Czech Republic are typically between 5–10 years (accounting and VAT). Please specify the exact periods in your internal policy.
4) Direct marketing (newsletters)
We only send commercial email communications:
- based on consent, or
- under Section 7(3) of Act No. 480/2004 Coll. to existing customers/supporters and always with an easy option to unsubscribe in every email.
5) Cookies and online identifiers
On our website, we only use essential cookies without consent; all other cookies (analytical, marketing) are stored and read only with your consent in accordance with Section 89(3) of the Electronic Communications Act. A detailed overview can be found in our separate Cookie policy and in the cookie banner settings, where you can change or withdraw your consent at any time.
6) Recipients and processors
Data may be processed by our contractual processors (hosting/web, e-mailing, payment gateway, accounting/tax advisor, IT, marketing and analytical tools), always strictly according to our instructions and with appropriate safeguards.
7) Transfers to third countries
If we use providers outside the EEA (typically for cloud/emailing/analytics), we ensure appropriate safeguards are in place:
- EU–US Data Privacy Framework (DPF) – transfers to organizations certified under the DPF (Commission Decision 2023/1795), or
- Standard Contractual Clauses (SCC) 2021/914.
Please include an up-to-date list of specific recipients in the table in the "Recipients" section.
8) Data subject rights
You have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and to object to processing based on legitimate interest or direct marketing (Art. 21). We respond to requests without undue delay, no later than within 1 month (which may be extended by 2 months for complex requests).
How to exercise your rights: email info@ekocentrunhuslik.cz or write to us at Na Zálesí 1473, 290 01 Poděbrady. In justified cases, we may request reasonable verification of your identity.
Complaint: You have the right to contact the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
9) Processing of children's data
For information society services in the Czech Republic, consent from a child is required from the age of 15; younger children require the consent of a legal guardian.
10) Camera systems
We use cameras on the premises in accordance with the Office for Personal Data Protection (ÚOOÚ) methodology (2024): we provide clear information, set appropriate camera angles, justify retention periods, and implement technical/organizational measures. Details (purposes, legal basis, retention periods, and contact information) are available upon request.
11) Security and confidentiality
We implement appropriate technical and organizational measures (access control, encryption, processor agreements, training). In the event of a security breach, we follow GDPR procedures (notifying the supervisory authority/data subjects if required).
12) Policy changes
We may update these policies (e.g., due to changes in technology or legislation). We will always provide a new effective date and communicate significant changes in an appropriate manner.
