Information on personal data processing
Here you can find out how we handle your data, what we need them for, and that they are safe with us.
This information on personal data processing (hereinafter the „Information“), Česká Regionální Energetika a.s., registered office Labský Palouk 495, Polabiny, 530 09, Pardubice, company ID No: 04549295, registered in the Commercial Register kept by the Regional Court in Hradec Králové, file No B 3507 (hereinafter the „Company” or “we/us”) enables us to inform you about the principles and rules of the processing of your personal data carried out by the Company in the course of its activities, including the manner, scope and other circumstances of the processing, as well as how the protection of the personal data processed is ensured. You can also find information about your rights in relation to the processing of your personal data in this document below.
By using our services and providing your personal data, you confirm that you have been informed about our processing of your personal data as set out in this Information.
1. General provisions
The purpose of this Information issued under Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the „GDPR“) is to provide information on what personal data we, as data controller, collect, store and process about natural persons in the position of our customers and business partners, including potential future customers and business partners, and their representatives, including members of their statutory and other bodies, and/or visitors to our website (hereinafter „you“), for what purposes and for how long we process these personal data in accordance with applicable law, to whom we may transfer them and for what reason, and to inform you of your rights as a natural person in relation to the processing of your personal data.
This Information relates to the processing of your personal data that we have obtained directly from you, through our website or from third parties, always to the extent of the personal data corresponding to their position vis-à-vis the Company.
This Information is effective from 25 May 2018 and is issued in accordance with the GDPR to ensure compliance with our information obligation as data controller under Article 13 of the GDPR.
2. Controller of the personal data
The controller of your personal data is Česká Regionální Energetika a.s., registered office Labský Palouk 495, Polabiny, 530 09, Pardubice, company ID No: 04549295, registered in the Commercial Register kept by the Regional Court in Hradec Králové, file No B 3507, with current contact details available at https://www.cr-energetika.eu/en-kontakt/.
3. Data privacy officer
The controller has appointed a data protection officer. Contact information for the data protection officer:
Name of the data protection officer: JUDr. Lukáš Slanina
data box ID: dc5997f
e-mail address: slanina@arws.cz
mailing address: Klicperova 1266/1, 500 03 Hradec Králové
The appointed data protection officer may change in the future. You can always find the current data protection officer in the Information, the current version of which is available on the Company’s website at the following link https://www.cr-energetika.eu/en-informace-o-zpracovani-osobnich-udaju/.
4. Categories of personal data processed
Personal data are any information that relates to a natural person and using which the Company is able to identify such natural person. The Company processes personal data of customers and business partners, including potential future customers and business partners, and their representatives, including members of statutory and other bodies, and of visitors to our website.
We process only such of your personal data as is necessary for us to provide our services according to your interests, and potentially personal data of the individuals concerned necessary for our mutual business communication and cooperation. In addition, we process your personal data to comply with our legal obligations and to ensure the protection of our legitimate interests in connection with our relationship.
The Company may therefore process the following categories of personal data:
4.1. Basic identification and contact details
This includes such data that are necessary primarily for the conclusion and performance of a contract, and in particular the following personal data:
· academic title;
· name and surname;
· date of birth, or company ID number/tax ID number;
· permanent address/registered office address;
· handwritten signature/electronic signature;
· e-mail address:
· telephone number;
· and the delivery or other contact address.
4.2. Data related to the service provided
These are the following personal data related to the service provided or the manner of business cooperation:
· payment information and bank details;
· supply point address;
· EAN code/EIC code;
· data on electricity and/or gas consumption based on meter readings and supply type diagrams;
· details of how the electricity and/or gas is used;
· customer number, client ID;
· IP address;
· telephone call recordings, i.e. data associated with the recording of the customer’s voice when communicating with an employee of the Company;
· cookies;
· and other data necessary for the performance of a contract resulting from legal regulations.
4.3. Data about our communication with you
If you are negotiating a contract with us for the provision of our services or are interested in our services, we will obtain from you your basic and identification data, and potentially certain other data necessary for us to make an appropriate offer of services or to conclude the relevant contract.
If you are our business partner or a possible future business partner, and if you are negotiating with us in the context of this cooperation or to establish cooperation, we will obtain your basic and identification data, and potentially certain other data necessary for us to implement the cooperation or to evaluate the offer of possible future cooperation.
If you are an employee of our business partner, your personal data necessary for the implementation of the business cooperation in accordance with the agreed contract are transferred to us by our business partner (your employer) which, as the controller of your personal data, is obliged to provide you with basic information on the processing of personal data.
Also, when communicating with you, we collect your personal data related to the provision of services by the Company. We obtain these personal data when we communicate with you in writing or electronically, by telephone (including records of telephone calls), by data box or during a personal visit.
5. Purpose, duration and legal basis for the processing of personal data
5.1. Processing for the performance of a contract, compliance with legal obligations, for legitimate interests and based on consent to processing
The Company processes your personal data based on the following legal grounds:
5.1.1. The performance of contractual obligations
The Company collects and processes your personal data for the purpose of compliance with its contractual obligations, in particular for the purpose of concluding, amending and terminating a contract (including granting power of attorney to terminate a contract with an existing supplier, concluding a connection contract, concluding a distribution contract for a supply point, registering a supply point with the Market Operator) and providing our services (or the consumption of your products or services), including their configuration and changes, providing information about them, addressing queries, requests and complaints in writing or electronic form or by telephone, where the legal title for the processing is the performance of a contract. The Company may also collect and process your personal data for the purpose of preparing a contract prior to its conclusion at your request. If you are a business partner of the Company, the Company processes your personal data in a similar manner to satisfy your business interests and needs.
For these purposes, personal data are processed in the scope of basic identification and contact data and data related to the service provided.
These personal data are processed by the Company only for the duration of the contractual relationship, and after its termination only if required by law or if necessary for the purposes of the Company’s legitimate interests.
5.1.2. Compliance with legal obligations
When providing services, the Company is obliged to comply with the legal obligations arising in particular from the following legal regulations, namely Act No 563/1991, on accounting (hereinafter the „AoA“); Act No 586/1992, on income taxes (hereinafter the AoIT“) and Act No 235/2004, on value added tax (hereinafter the „AoVAT“), Act No 458/2000, the Energy Act (hereinafter the „AoE“).
Some personal data may be included in accounting documents (i.e. invoices and other documents). The AoA, AoIT and AoVAT require the Company to keep these documents for up to 10 years. Therefore, if the Company is legally obliged to archive these documents, your personal data indicated in the relevant tax document will be stored with them.
For the purpose of compliance with its legal obligations, in addition to processors the Company also provides your personal data to other recipients of personal data, mainly state authorities, in particular for the purpose of (i) providing personal data at the request of law enforcement authorities in criminal, misdemeanour or administrative proceedings, (ii) compliance with legal information obligations towards the Energy Regulatory Office, the Office for Personal Data Protection, the Office for the Protection of Competition, the Czech Trade Inspection Authority, the European Commission, the Czech National Bank, the Czech Telecommunications Office, Czech Television or Czech Radio, (iii) providing information to the Market Operator regarding the evaluation of energy supplies, (iv) fulfilling statutory information obligations under the AoE, (v) supplying electricity and/or gas under the supplier-of-last-resort regime under the AoE, (vi) and to other entities for other purposes defined by law. The Company processes such personal data to the extent and for the period as provided for by generally binding legal regulations, but for no longer than 10 years after the termination of the last contractual relationship with the Company.
5.3.1. Legitimate interest:
The Company also processes your personal data in cases where its legitimate interests as controller override your legitimate interests as data subject. When doing so, the Company takes into account the weight of the legitimate interest itself, your reasonable expectations regarding the processing of your personal data, and the relationship between you and the Company. The Company processes your personal data based on legitimate interest without the need for your consent to such processing, in particular for the following purposes:
• 5.1.3.1. Protection of the fundamental rights and legitimate interests the Company
For the purpose of protecting its fundamental rights and legitimate interests that the Company derives from generally binding legal regulations and contracts to which the Company is a party, the Company may process your personal data in the context of disputes, inspections, investigations, proceedings and in relation to business partners and third parties (including state authorities) for the period specified by generally binding legal regulations, but for no longer than 10 years after the termination of the last contractual relationship with the Company.
• 5.1.3.2. Telephone records
The Company records telephone calls with you to improve the quality of the services offered and to protect the Company’s rights. These records are stored only electronically and for a maximum of three days, or for the duration of an investigation into a particular telephone record in situations where there is a suspicion that damage has been caused, an offence or crime has been committed, or for another legitimate reason.
• 5.1.3.3. Direct marketing
If you are a customer of the Company, the Company, as controller of your personal data, and for reason of the existence of the customer relationship, has a legitimate interest in exercising direct marketing, i.e. in particular offering goods and services relating to energy supply and related products and services, for the duration of the customer’s contractual relationship with the Company.
• 5.1.3.4. Recovery of obligations
In the event it is necessary to recover outstanding obligations arising from the Company’s relationships with its customers or business partners, including where the Company has suffered damage or other harm, the Company may also process your personal data for this purpose based on its legitimate interest, namely the recovery of its receivables and/or the establishment, protection and enforcement of the Company’s legal claims. Personal data processed for this purpose may be retained by the Company for the duration of limitation periods under generally binding legal regulations.
5.1.4. Consent to the processing of personal data (marketing communication and others)
If you grant us your consent to the processing of your personal data, we will use your personal data for the purpose of sending you news about our products and services, marketing offers and other commercial communications related to our products and services, for the purpose of analysing and sorting your personal data to enable, in particular, direct mailing to specific or certain groups of customers, and for the purpose of holding, organising and evaluating various types of competitions, surveys and other events. In such a case, your personal data is processed to the extent of your consent, in particular in the scope of basic identification and contact data: title, name and surname, e-mail address and telephone number. If you grant us your consent to marketing contact via electronic means, we process, with your consent, the contacts you make available to us for the purpose of marketing contact with offers of products and services of the Company. The personal data provided in this way will be kept until the termination of the last contractual relationship with the Company and thereafter for a period of five years from the date of its termination, in the event that a contract for combined electricity and/or gas supply services is concluded between you and the Company no later than three months after the granting of this consent, or for a period of five years from the date of granting of this consent, in the event that a contract for the combined supply of electricity and/or gas services is not concluded between you and the Company within three months after the granting of this consent, and for a period of five years from the date of granting of this consent in the case of a person not in a contractual relationship with the Company. You can however withdraw your consent at any time (see Article 9.7 Information for more details). Withdrawal of consent only has a future effect and therefore does not affect the lawfulness of previous processing based on such consent.
5.1.5. Cookies
When you use our website, your personal data may be processed through the use of cookies, for example, to analyse traffic to our website or to provide social media features. We process these personal data based on your consent (via the cookie settings in your browser).
For more information on how we use cookies, please visit https://www.cr-energetika.eu/en-cookies/
6. Personal data sources
The Company primarily obtains your personal data directly from you, in the context of the negotiations on the conclusion of a contract and in the course of its performance, or from third parties who mediate the negotiations on the conclusion of a contract.
Whenever we obtain your data in this way, we will inform you whether the provision of personal data is necessary for the provision of a specific service or whether the provision of personal data is only voluntary, and where failure to provide personal data will not prevent the provision of a specific service but provision will significantly facilitate our communication and make the provision of our services more efficient.
The Company may also obtain your personal data from state administration authorities or based on special legal regulations, or from publicly available records and registers (e.g. from the land register, trade register, insolvency register, central register of executions, etc.), especially if necessary for the purposes of the Company’s legitimate interest.
The Company also generates customer personal data directly related to the supply of electricity and/or gas by the Company to the customer (e.g. electricity and/or gas consumption data).
To improve the quality of the services offered and to protect its rights, the Company may monitor and record telephone communications, in which case it will always inform you in advance and you will have the opportunity to refuse.
7. Processing and transferring personal data to third parties
The Company processes your personal data manually and automatically, but there is no automated decision-making that could affect your rights.
The Company takes a responsible approach to the protection of your personal data and has therefore adopted organisational and technical measures that comply with the requirements of the relevant legislation to ensure the protection of your personal data.
The Company processes your personal data primarily using its own employees. Where the processing of your personal data is based on your consent or on legitimate interests and purposes as set out above, your personal data may be processed by third parties used by the Company as suppliers of expert and specialised services. Where these persons process personal data transferred by the Company, they will process it only within the framework of the Company’s defined guidelines and purposes of processing, and will not use such personal data for other purposes. At the same time, they provide guarantees for the technical and organisational protection of the personal data transmitted by us based on a data processing contract. Your consent is not required for such processing, as such processing is directly permitted by legal regulations.
In accordance with the above, the Company may, as its legitimate interest, disclose your personal data to the following categories of processors:
· distribution (including local)/transmission system operators;
· business partners offering the Company’s products and services and providing customer care;
· IT service providers and software suppliers;
· archiving service providers;
· providers of postal or courier services;
· electronic communications service providers;
· marketing agencies;
· external legal representatives;
· and auditing companies.
We have concluded data processing contracts with data processors that guarantee at least the same level of protection for your personal data as in this Information.
The Company may also transfer your personal data to third parties to comply with a legal obligation where they exercise their legal right to require the transfer of such personal data. These are in particular the following categories of recipients:
· The Energy Regulatory Office;
· Law enforcement authorities (especially courts, public prosecutor’s offices, the Police of the Czech Republic);
· Other government bodies.
However, we only provide your personal data to these entities where required to do so by law.
8. Personal data security
The Company has put in place and maintains the necessary reasonable technical and organisational measures, internal controls and information security processes in accordance with providing you with the best possible care and your rights, appropriate to the potential risk to you as data subject. At the same time, the Company takes into account the state of technological development with the goal of protecting personal data from accidental loss, destruction, alteration, unauthorized disclosure or access. These measures may include, but are not limited to, taking reasonable steps to ensure the accountability of employees with access to personal data, employee training, regular backups, data recovery and incident management procedures, software protection for the devices on which personal data are stored, and more.
9. Vaše práva k osobním údajům
If you exercise any of your rights under this Article 9 of the Information or under applicable legal regulations, the Company will notify any recipient to whom such data has been disclosed under Article 7 of this Information of the actions taken or the erasure of your personal data or a restriction of processing in accordance with your request, provided that such notification is feasible and/or does not require disproportionate effort.
If you wish to exercise these rights and/or obtain relevant information, you may contact us by e-mail at slanina@arws.cz or in writing at the Company’s registered office.
If you exercise your rights as indicated below, the Company may require you to provide certain identifying information that you have already provided to us for authentication purposes. The provision of such data is necessary to verify that the relevant request was actually sent by you. We will respond within one month of receiving your request, but we reserve the right to extend this period by two months.
9.1. Right of access to personal data
Under Article 15 of the GDPR, you have the right to access your personal data, including the right to obtain from us:
· confirmation as to whether we process your personal data or not,
· information about the purposes of the processing, the categories of personal data concerned, the recipients to which the personal data have been or will be disclosed, the intended duration of the processing, the existence of the right to request from us the rectification or erasure of personal data relating to your personal data or the restriction of their processing and to object to such processing, the right to lodge a complaint with a supervisory authority, the right to receive all available information about the sources of the personal data if not obtained from the data subject, the fact that automated decision-making, including profiling, takes place, about appropriate safeguards in the event of transfer of data outside the EU, and to receive a copy of the personal data where the rights and freedoms of others will not be adversely affected.
In the event of a repeated request, we are entitled to charge a reasonable fee for a copy of personal data.
9.2. The right to rectification of personal data
Under Article 16 of the GDPR, you have the right to have inaccurate personal data we process about you rectified. However, you are also obliged to notify us of changes to your personal data and to provide evidence that such changes have occurred. You are also obliged to cooperate with us if it is found that personal data we process about you is not accurate. We will carry out such rectification without undue delay, but always taking into account the technical possibilities.
9.3. The right to the erasure of personal data.
Under Article 17 of the GDPR, you have the right to erasure of personal data relating to you if we do not demonstrate legitimate grounds for processing such personal data. We have mechanisms in place to ensure the automatic anonymisation or erasure of personal data when it is no longer needed for the purpose for which it was processed.
9.4. Right to restriction of processing
Under Article 18 of the GDPR, a data subject has the right to the restriction of processing until their complaint is resolved where they contest the accuracy of the personal data, the reasons for processing or where they object to processing.
9.5. Right to data portability
Under Article 20 of the GDPR, you have the right to the portability of data concerning you that you have provided to us, and in a structured, commonly used and machine-readable format. You also have the right to ask us to transfer such data to another controller.
Where the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be granted.
9.6. Right to object to the processing of personal data
Under Article 21 of the GDPR, you have the right to object to the processing of your personal data by the Company.
Where we do not demonstrate that there is a legitimate reason for processing that outweighs the interests or rights or freedoms of the data subject, processing will be terminated based such objection without undue delay.
9.7. Right to withdraw consent to personal data processing
Where you grant us your consent to process your personal data, you can withdraw it at any time. Such withdrawal must be made through an express, clear and specific expression of intent, in writing to our contact address, via e-mail to slanina@arws.cz, or by calling our customer service line at 840 770 770.
Consent to marketing contact given for a specific electronic contact can be withdrawn at any time by calling the customer service line at 840 770 770 or in the manner specified in the sent commercial communication.
Where you withdraw your consent to the processing of personal data, this does not affect the processing of your personal data by the Company for purposes other than those for which consent was given or based on other legal titles, in accordance with this Information.
9.8. Right to make a complaint to the Office for Personal Data Protection
You have the right to file a complaint regarding our processing of your personal data with the Office for Personal Data Protection, registered office Pplk. Sochora 27, 170 00 Prague 7. Website of the Office: www.uoou.cz.
10. Update of the Information
Please note that we may modify and update this Information. Any changes to this Information will become effective when posted on https://www.cr-energetika.eu/en-informace-o-zpracovani-osobnich-udaju/.
Write to us
E-mail address: trading@cr-energetika.cz
We will respond within two business days.
Quick links
