ALVAO s.r.o. is committed to protecting confidential information, trade secrets, and personal data. The protection of information of our customers, suppliers, employees, or job applicants is covered in our contracts as well as enforced by laws or regulations of the Czech Republic and the EU. Collectively, we refer to this information as proprietary information. Accordingly, every employee is obligated to protect this information and to do everything they can to prevent information leaks. The Company’s management undertakes that the Company will comply with the ISO/IEC 27001:2022 standard, and in accordance with the organization’s intentions, the level of risk and the importance of assets to:
- set information security objectives
- meet applicable requirements in the field of information security
- continuously improve the information security management system
Who this declaration applies to:
This Declaration applies to the processing of personal data we collect if:
- you use our services and products, in particular:
- ALVAO Service Desk
- ALVAO Asset Management
- Materials on the web (e-books, …)
- you visit our website,
- you visit our offices,
- you receive information from us,
- you use the opportunity to register for our events and webinars, participate in our events and webinars,
- you apply for a job with our Company,
- you are our business partner,
- if you are filing a report under the Whistleblower Protection Act,
- if you are reporting the presence of illegal content under the Digital Services Act.
Data Controller of your data
ALVAO s.r.o., with its registered office at Hlohová 1455/10, 591 01 Žďár nad Sázavou, Company ID: 25561561, Tax ID: CZ25561561, registered in the Commercial Register maintained by the Regional Court in Brno, file no. C 33290 (hereinafter as “ALVAO”), as the Controller, hereby informs you about the processing of your personal data and about your rights in accordance with the GDPR.
Your rights
We process your data transparently, appropriately, in accordance with GDPR and generally binding legal regulations. We do not use personal data for automated decision-making.
You have the right to obtain confirmation as to whether or not your personal data is being processed, and if processing is taking place, you have the right to obtain access to such personal data and other information under the GDPR, in particular as to the purpose of their processing, the categories of personal data concerned, the categories of recipients to whom they have been or will be disclosed, and the planned period for which they will be stored. You also have the right to request the rectification of inaccurate personal data about you.
You have the right to request the erasure of personal data about you subject to one of the reasons listed in Art. 17 GDPR. For example, if the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if you withdraw your consent to its processing as described below.
You have the right to request that ALVAO restricts the processing of your personal data if one of the cases specified in Art. 18 GDPR, in particular if you contest the accuracy of the personal data being processed.
If the processing of your personal data is in ALVAO’s legitimate interest, you have the right to object to such processing.
You also have the right to obtain your personal data processed by ALVAO in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller.
If you believe that the processing of your personal data violates the GDPR, you have the right to file a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection with its registered office at Pplk. Sochora 27, 170 00 Prague 7.
How you can exercise your rights
If you need to exercise any of your rights under the GDPR or the provision of information regarding the processing of personal data, please contact us by e-mail gdpr@alvao.com or in writing at the address given in the contacts section. You can submit the request in paper or electronic form, or in person. Verification of your identity is essential for the processing of your request. Always provide your current contact details for us to handle your request. The legitimacy of any request will be assessed within one month of its receipt. Given the complexity and number of requests, ALVAO is entitled to extend this deadline by another two months. You will be informed of any extension of the deadline immediately, but no later than one month after receiving the request, together with the reasons for such postponement.
Consent to the processing of personal data and its withdrawal
If your personal data is processed on the basis of your consent, you are entitled to withdraw this consent at any time, electronically to e-mail gdpr@alvao.com or in writing to the address of the ALVAO registered office listed in the Contacts section. Consent can also be withdrawn via a link in the newsletter. If you withdraw your consent and there is no other legal reason for processing your data, ALVAO will delete your personal data or anonymize it.
Recipients of your data
If ALVAO does not process personal data itself, personal data processing may only be carried out for ALVAO by processors based on a data processing agreement entered into with ALVAO in accordance with the GDPR (e.g. Microsoft Corporation, and other providers of cloud services or other software). If you visit social networks (Facebook, LinkedIn) or YouTube via our website, your personal data will be automatically sent to the respective operator by activating the button of the respective social network or internet server. The scope of the personal data transferred is determined by the respective operator, who is also responsible for the protection of the personal data you provide.
ALVAO will not transfer personal data to countries outside the European Union or to international organizations. However, this is with the exception of possible storage of data within cloud storage on servers in countries outside the European Union, which cannot be ruled out with regard to the conditions of the cloud storage operator. In such a case, the security of personal data will be ensured on the basis of the relevant adequacy decision of the European Commission, or by the use of standard contractual clauses issued by the European Commission in Decision 2021/914 of 4 June 2021, or according to the relevant subsequent implementing decision of the European Commission. Personal data may also be disclosed to the following third parties (recipients):
- providers of professional services, such as lawyers and tax advisors, bound by a statutory or contractual obligation of confidentiality,
- persons who have a legal reason for accessing personal data (e.g. tax authorities, law enforcement authorities or other supervisory authorities with legal authorization to access information), or
- other persons if it is necessary to protect ALVAO’s rights.
The nature, purpose and timescale of data we process
1. If you are our customer, supplier or other business partner
If you are a legal entity, this information applies to the processing of personal data if you transfer personal data of natural persons to ALVAO. Please refer to the section “Personal data of third parties”.
ALVAO, as a personal data controller, will process the personal data specified in the contract made between you and ALVAO, or in other documents prepared by the parties in connection with this contract, as well as personal data that ALVAO may obtain in connection with the performance of the contract or its conclusion. In particular, the following personal data will be processed:
- identification and contact data such as name and surname, date of birth, ID and VAT number, e-mail address, telephone number, billing information, account number;
- or such other data as necessary for the conclusion and performance of the contract.
ALVAO will process personal data for the following purposes:
a) For entering into a contract, i.e. for the implementation of measures prior to concluding a contract, within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed until the Contract is entered into or until there is absolutely no doubt that the Contract will not be entered into.
b) For the performance of the rights and obligations of the Controller arising from the Contract within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed for the duration of the contractual obligations.
c) For the purposes of the legitimate interest of the Controller within the meaning of Art. 6 para. 1 (f) of the GDPR to protect ALVAO’s rights related to the contract, its conclusion and performance, in particular to be able to demonstrate, if necessary, how and to what extent the contract was performed. For this purpose, personal data may be processed for the duration of the obligations arising from the contract and further for the period corresponding to the relevant limitation periods, usually for a maximum period of another 11 years from the termination of the obligations under the contract. This period is suspended if you exercise any right related to the contract with ALVAO or a public authority, until the substantive decision of the competent public authority on the exercise comes into force. You can object to the processing of personal data for this purpose in accordance with Art. 21 GDPR.
You are not legally obligated to provide ALVAO with personal data for the purposes listed above. However, if the personal data are not provided, it will not be possible to enter into and properly perform the contract and the related obligations and rights of the Controller.
Personal data of third parties
Thereto, ALVAO asks you to ensure that if you transfer personal data of a third natural person to ALVAO, such as your employee, who is to be the contact person for the purpose of performing the contract, that the personal data is transferred to ALVAO in accordance with the GDPR. In particular, it is necessary to ensure that this third party is informed in accordance with the GDPR that their personal data will be transferred to ALVAO and for what purpose.
The Controller will process these personal data for the purpose for which they were transferred to him, for example, for the purpose of communicating with you in the case of personal data of a contact person, for the necessary period of time to achieve the purpose of processing.
2. If you are a visitor to a website with a web address of https://www.alvao.com
Our website uses cookies. Information on how we process cookies can be found here: Cookies and similar technologies
3. If you are a subscriber to information from us
Newsletter:
By subscribing to the newsletter on our website, you give us your consent to use the following personal data for the purpose of sending commercial and marketing communications regarding our products and services:
- Name and Surname
- Email
- Telephone number
- Company
- (number of PCs)
The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to the processing of personal data and its withdrawal).
E-books, demos and webinars:
If you request an e-book, demo or webinar on our website, we will process the following personal data:
- Name and Surname
- Work email
- Telephone contact
- Other personal data that you may provide to us as the content of the message you send
We will process this personal data to fulfil ALVAO’s rights and obligations arising from the contract within the meaning of Art. 6 para. 1 (b) GDPR. For this purpose, personal data will be processed for the duration of the obligations under the contract (i.e. until the delivery of the requested e-book, demo or webinar).
Thereto, you give us your consent to use the personal data provided for the purpose of sending commercial and marketing communications related to our products and services. The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to the processing of personal data and its withdrawal).
Contact form:
If you contact ALVAO via the contact form on our website, you give us your consent to process the following personal data for the purpose of handling your request, inquiry or other information provided via the contact form:
- Name and Surname
- Work email
- Telephone contact
- Other personal data that you may provide to us as the content of the message you send
Thereto, you give us your consent to use the personal data provided for the purpose of sending commercial and marketing communications related to our products and services. The aforementioned processing of personal data is not time-limited and ends with the withdrawal of consent to processing (see Consent to the processing of personal data and its withdrawal).
4. If you seek employment
If you apply for a job in ALVAO, we will process the following personal data:
- Identification and contact data, in particular name and surname, e-mail address, telephone;
- qualification requirements (education, knowledge and skills, previous work experience, etc.);
- or other personal data that you provide to us in connection with your job application, e.g. in your cover letter.
The provision of this personal data is voluntary. In this case, the legal basis for the processing of your data for the duration of the application procedure is the pre-contractual measures within the meaning of Art. 6 para. 1 (b) GDPR. We will process personal data for this purpose for the duration of the selection procedure.
However, we process your personal data for a period of three years from the end of the selection procedure so that we can invite you to participate in the selection procedure for another suitable job position. By participating in the selection procedure, you give us your consent to this, but you can withdraw it at any time (see Consent to the processing of personal data and its withdrawal).
5. If you are reporting under the Whistleblower Protection Act
If you use the option to file a report under the Whistleblower Protection Act, ALVAO will process your personal data to the extent specified in your report (usually your name, surname, e-mail address and telephone contact). These personal data will be processed only for the purpose of handling your report and for the period necessary to fulfil this purpose and further for the period stipulated by the Whistleblower Protection Act for the archiving of such data. Access to your personal data will only be given to a competent person within the meaning of the Personal Data Protection Act, unless otherwise provided by law.
6. Reporting the Presence of Illegal Content under the Digital Services Act
If you choose to report the presence of illegal content under the Digital Services Act, ALVAO will process your personal data to the extent provided in your report (typically your name, surname, and email address). This personal data will be processed for the purpose of fulfilling a legal obligation applicable to ALVAO, in accordance with Art. 6 para. 1 (c) GDPR, specifically to address your report. The data will be retained only for the time necessary to fulfil this purpose. Access to your personal data will be restricted to ALVAO employees authorized to handle reports of illegal content.