Privacy Policy of ZONER a.s.

Introductory Provisions

ZONER a.s., ID: 494 37 381, with registered office at Brno, Nové sady 583/18, ZIP code 602 00, registered in the Commercial Register at the Regional Court in Brno, Section B, Insert No. 5824, contact email address: admin@zoner.cz (hereinafter referred to as "the company"), provides its services in accordance with applicable legislation and handles its customers' personal data in accordance with applicable legal regulations. The company is the administrator.

This document provides customers with information about the processing of their personal data and their related rights and obligations. This document may be revised and updated as needed.

We declare that all internal processes regarding the processing of personal data are conducted in accordance with Act No. 101/2000 Coll. on the Protection of Personal Data and on the Amendment of Certain Acts, as amended, and after May 25, 2018, also in accordance with the REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (EU) No. 2016/679 of April 27, 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), also known as GDPR.

When processing personal data, we comply with the principles of legality, correctness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality of personal data.

The company processes personal data manually and automatically. The company maintains a record of all activities, both manual and automated, in which personal data is processed.

Since at the time of publication of this policy, there are no binding criteria for the accreditation of entities authorized to issue certificates of good practice in the protection of personal data, nor criteria for issuing this certificate that would allow certification of compliance of our procedures with the abovementioned legal regulations, we declare that all internal processes taking place in our company are in accordance with the above-mentioned regulations. The legal regulations do not require, and at the time of publication of this policy, do not allow for certification; in the event of subsequent existence of accreditation mechanisms, if they are not binding, we reserve the right not to obtain certification (or seals, marks) from an accredited entity.

What data do we process and why?

We are committed to not requiring more extensive data from you than is strictly necessary to achieve each of the purposes listed below.

If you decide to use the services offered by ZONER a.s., a prerequisite for ordering them, which means concluding a contract with the company, is that you provide us with the following personal data when creating a customer account: name, date of birth, residential address, email address, phone number, login name, and password. We must process this personal data for the purposes of your identification, authorization, and operation of your customer account, without which it is not possible to use our services. Processing of personal data necessary for operating the customer account will continue even after the termination of provided services, to allow for the ordering of additional services without the need to create a new customer account, as this is in our company’s interest.

For the purposes of ordering services, providing them, and your identification, we also process your personal data: name, date of birth, residential address, email address, phone (all these data may collectively be referred to as "basic identification data") and any additional personal data (e.g., from mutual email or telephone communication) that we obtain from you in connection with the provided service, the processing of which is necessary for the provision of the specific service. We must process this personal data for the purpose of providing the services you ordered, and without such processing, it is not possible to provide these services to you.

Here is a list of other personal data we process in connection with individual services (if a particular service is not mentioned, no additional personal data than the aforementioned is processed):

• Domain name registration and hosting (CZECHIA.COM, RegZone): Access IP address, we may require additional personal data (such as ID card number) according to the requirements of the domain registry
• Cloud services (Zonercloud): Access IP address
• CMS system (Zoner InPage): Access IP address
• Photo Editing (Zoner Photo Studio): Access IP address
• Photo Storage (Zonerama): Photos containing personal data
• Shop Rental (Zoner inShop): Access IP address
• Zoner Press: Access IP address
• Antivirus (Zoner AntiVirus): Access IP address
• Trusted SSL/TLS certificates (SSLmarket): Access IP address
• Hosting services provided free of charge (according to 3.3.1 Terms and Conditions): Access IP address

The processing of the above-mentioned personal data is necessary for concluding and/or fulfilling the contract and therefore does not require your consent. The legal basis for this processing is necessity for the performance of the contract. You do not have to provide us with this personal data; however, if you do not provide us with this data or do not consent to their processing for the stated purposes, we will have to refuse to conclude the contract with you.

Web hosting and cloud services include Z-mail email services. Email messages received on our servers and directed to our customers are checked for the presence of malware, which is suspended if found. For this purpose of processing, we apply the legal basis of legitimate interest in intervening to ensure network security. We prevent the dissemination of malware into our company’s network, foreign networks, and especially the devices of our customers.

In connection with the services provided, we also process your personal data relating to the services provided, especially data about the type of services provided, their extent and price, and information about payment discipline. In customer contact areas of our company, camera recordings, which are also personal data, are stored for the purpose of damage prevention. All the data mentioned in this paragraph are obtained in connection with the provision of services, and in combination with the basic identification data, we process them for the purpose of improving the services provided and/or for the possible protection of our company’s interests (including the enforcement of our legitimate claims or the protection of our company’s rights in court or other proceedings). Since this processing is necessary for the purposes of our company’s legitimate interests, your consent is not required. The legal basis for this processing is necessity for the purposes of the legitimate interests of our company.

We also process our customers' personal data for the fulfillment of legal obligations. Due to requirements arising from accounting and other legal regulations, especially in the field of taxes, we retain documents (in electronic or paper form) containing personal data, especially invoices and documents indicating the legal reason for issuing invoices) containing name and address of customers for the legally specified period. Personal data consisting of operational, localization data, and records (so-called logs), which are created or processed while ensuring public communication networks and while providing publicly available electronic communication services, along with associated IP addresses, are required to be stored under § 97 paragraph 3 of Act No. 127/2005 Coll., on Electronic Communications and on the Amendment of Certain Related Acts (Electronic Communications Act). After the legally imposed deadline has passed (see below), we will no longer process these personal data for this purpose. The legal basis for this processing is the fulfillment of legal obligations. Since we are required to request these data from you in relation to the services provided, or we must obtain them from other sources, as necessary for the fulfillment of legal obligations, refusal to provide them or objection to their processing would mean that we would not be able to conclude the contract with you and provide you with services.

We also use customers’ personal data for marketing and promotion of our products. We never provide personal data for marketing purposes to third parties without the explicit consent of our customers. The personal data of an email address is processed for the purpose of sending electronic marketing messages regarding our company’s products, without your consent in accordance with legal regulations, as this is in the legitimate interest of our company. A condition for sending these marketing messages is that the customer has a clear and obvious option to decline consent to such use of their email address easily, free of charge, or at the cost of our company, even when sending each individual message, unless they have previously refused this use of their email address. If you inform us that you do not agree to receive these marketing messages, we will cease processing your personal data for this purpose. The legal basis for this processing is necessity for the purpose of the legitimate interests of our company.

By visiting our company's websites, you also provide us with personal data about your IP address, location, browser, system, or screen resolution. This personal data is obtained through Google web analytics and is used solely for our purposes for the analysis and improvement of our services. Since this data is obtained and processed for the purposes of our legitimate interests, no consent is required for this processing. The legal basis for this processing is necessity for the purposes of the legitimate interests of our company. More about Google's privacy protection can be found in the relevant policies.

If you consent to the storage of cookies when visiting our company’s website on your terminal device, we process behavior records from cookies placed on our company’s website for better operation of these websites. The legal basis for this processing is your consent.

How long is your personal data processed?

We process your personal data only for as long as the reasons for processing personal data exist.

Personal data necessary for managing the customer account will be processed for the duration of service provision. If a customer does not cancel their customer account even after the conclusion of service provision, we will continue to process their personal data necessary to manage the customer account for a period of 3 years.

Operational and localization records that we are required by law to process are kept for a period of 6 months based on the legal reason of fulfilling legal obligations imposed on us by § 97 paragraph 3 of Act No. 127/2005 Coll., on Electronic Communications and on the Amendment of Certain Related Acts (Electronic Communications Act).

After the conclusion of the ordered service and after the expiration of all related obligations from the concluded contract (including any guarantees), we will stop processing your personal data for this purpose and delete them unless these personal data or some of them are processed for another purpose.

If we process personal data for the purpose of fulfilling legal obligations, we will cease processing for this purpose after the specified period has expired.

Are personal data provided to third parties?

If we provide ordered services or part of them through other persons (e.g., photo book manufacturers, delivery service providers, certification authorities), or the provision of ordered services necessarily requires the transfer of personal data to another person (e.g., a person performing domain name registration in the central registry), we will provide your personal data to these third parties, but only to the extent strictly necessary to provide the ordered service. We are authorized to handle personal data in this way without your consent, as otherwise we would not be able to fulfill the contract and provide you with the requested service. However, we are always obliged to ensure that these third parties comply with all obligations related to personal data protection and do not use your personal data for any other purpose without your consent. If the specification of the third party to whom personal data will be provided is not stated in this policy, it will be communicated to you when ordering the service.

The transfer of personal data to third parties occurs with these services and to this extent:

• Provision of commercial certificates (SSLmarket.cz): personal data is provided to the certification authority DigiCert (DigiCert Ireland, ltd) for verification, namely name and surname, address, email address, phone number of the individual
• Domain name registration (CZECHIA.COM): personal data is provided to other administrators - registrars, or directly to central registries of individual domain names for necessary domain name registration, namely name and surname, address, email address, phone number, and possibly additional personal data as required by the registry of that domain name.
• Photo Editing (Zoner Photo Studio): when ordering photo items, personal data is provided to the manufacturer and deliverer, namely name and surname, address, phone number.
• Zoner Press: personal data is provided to the deliverer, namely name and surname, address, phone number.

Who has access to personal data?

Access to your personal data in our company is granted only to those individuals who necessarily require it to achieve the purpose for which the personal data is processed. For this purpose, regular audits take place in our company.

Customer support staff have access only to those personal data that they need for authorizing requests and identifying customers. This access is necessary for the proper functioning of customer service.

Employees having access to personal data are properly trained in their protection and are obliged to maintain confidentiality.

What additional rights do you have regarding the protection of your personal data?

In relation to the protection of personal data, you have the right

1. to obtain confirmation from us as to whether or not personal data concerning you is being processed,
2. to obtain from us information about the purposes of processing, categories of personal data concerned, recipients to whom the personal data has been or will be disclosed, the planned duration of processing or the criteria for determining it, about the existence of the right to request from us the rectification or erasure of your personal data or restriction of processing or to object to such processing, the right to lodge a complaint with a supervisory authority, about all available information regarding the source of personal data if not obtained from you, the fact that automated decision-making occurs, including profiling, about appropriate safeguards in the event of data transfer outside the EU,
3. to obtain from us copies of your personal data being processed, if this does not adversely affect the rights and freedoms of others,
4. to rectify inaccurate personal data concerning you that we will process,
5. to have personal data concerning you erased if we cannot demonstrate legitimate reasons for further processing of such personal data,
6. to request the restriction of processing of your personal data until the issue is resolved, if you dispute the accuracy of personal data, the reasons for their processing or if you object to their processing,
7. to receive notification from our company in the event of rectification, erasure or restriction of processing of your personal data; if personal data is rectified or erased, we will inform the respective recipients unless this proves impossible or requires disproportionate effort; upon request, we can provide information about these recipients,
8. to data portability concerning you, i.e., the right to obtain from us personal data concerning you in a structured, commonly used, and machine-readable format, and the right to request our company to transfer these data to another administrator; this is only applicable if the processing is carried out automatically and our company has obtained these data based on your consent or for the purposes of fulfilling the contract, and if the transfer is technically feasible,
9. to object to the processing of your personal data based on our company’s legitimate interest or against the dissemination of marketing messages,
10. to refuse the processing of your personal data for sending marketing messages,
11. to withdraw consent to the processing of your personal data at any time if our company processes them based on your consent; however, this withdrawal of consent will not affect the lawfulness of processing based on your consent before its withdrawal.

If you have any doubts about the compliance of the processing of your personal data with legal regulations, you have the option to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (see www.uoou.cz).

This policy is effective from May 25, 2018

Last updated: May 11, 2018