Privacy
Policy

The controller of your personal data is:

The controller has not appointed a Data Protection Officer. Please send any questions or requests concerning personal data protection directly to the contact details above.

Depending on the nature of our cooperation or your inquiry, we process in particular the following categories of personal data:

• Identification data — first and last name, company name, company ID, VAT ID
• Contact data — e-mail address, telephone number, correspondence address
• Business and contractual data — content of orders, contracts, quotations, correspondence and inquiries
• Invoicing and payment data — bank details, document numbers, payment history
• Operational and technical data — information about delivered equipment, service interventions and the technical parameters of the installation
• Communication records — e-mail correspondence, records of telephone calls (where technically provided for and where consent or another legal basis exists)
• Photographic documentation — only where the photograph contains an identifiable natural person; photographs of equipment, installations or products alone are usually not personal data and are processed separately

The controller does not process special categories of personal data (sensitive data) and does not knowingly process personal data of persons under 16 years of age.

We always process personal data on the basis of a statutory legal title. Below is an overview of the main purposes and the corresponding legal bases:

We keep personal data only for as long as necessary to achieve the purpose of processing, or for the period prescribed by law:

We pass personal data to third parties only to the extent necessary to perform contractual or statutory obligations. Recipients may include:

• Accounting and tax advisers, auditors
• Transport and logistics companies ensuring deliveries
• Service partners and subcontractors involved in installation or service
• Providers of IT infrastructure and cloud services
• Legal representatives and collection agencies (for debt recovery)
• Public administration authorities and bodies active in criminal proceedings (on the basis of a legal obligation)

We do not sell personal data or provide it to third parties for their own marketing purposes. When entrusting processors, we require contractual guarantees of data protection (a data processing agreement). Personal data is not transferred to third countries outside the European Economic Area unless a specific situation requires it; in such a case we will ensure appropriate safeguards (EU standard contractual clauses).

Commercial communications

We send commercial communications relating to our own products and services:

• To existing customers — on the basis of our legitimate interest, in accordance with Section 7(3) of Act No. 480/2004 Coll., always only about our own similar products and services.
• To other persons — exclusively on the basis of consent given to the processing of personal data for marketing purposes.

References

To present completed projects and installations, we use the customer's business name and, where applicable, photographic documentation of the installation. The following applies:

• The business name of a legal entity is generally not personal data within the meaning of the GDPR. Publishing it in references therefore does not require consent.
• Photographs of an installation or equipment without an identifiable natural person are not personal data and are used on the basis of a legitimate business interest.
• If a reference were to contain personal data of a natural person or a sole trader (a name, a photograph of a person, etc.), we process such data only on the basis of consent or another statutory legal title.
• A customer may request the modification or removal of a reference at any time; please address such requests to info@eskogenerator.cz.

A CCTV system is operated at the premises of ESKO Generator s.r.o. for the purpose of protection of property and the safety of persons.

• Processing is carried out on the basis of the controller's legitimate interest (Article 6(1)(f) GDPR).
• Access to recordings is restricted exclusively to authorised persons of the controller.
• The standard retention period for recordings is 30 days.
• If a specific security incident or damage event is being dealt with, recordings may be retained for as long as necessary to resolve the situation.
• Entry to monitored areas is marked with an information sign in accordance with GDPR requirements.

Under the GDPR, as a data subject you have the following rights:

We respond to your requests without undue delay, and in any case within 30 days of receiving them.

Please address all requests, questions or objections concerning the processing of personal data to:

You may also lodge a complaint about the processing of personal data with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.