GOPAY (the ‚Data Controller‘) means the company GOPAY s. r. o., with its registered office at Planá 67, 370 01 České Budějovice, company registration number: 260 467 68, registered in the Commercial Register maintained by the Regional Court in České Budějovice, Section C, Insert 11030. GOPAY is an electronic money institution which issues electronic money within the meaning of Section 4 of Czech Act No. 370/2017 Coll., on payments, and operates the GoPay Payment System.

This notice defines how we approach the processing of personal data and secure its protection before a business relationship is established. In doing so we follow Czech Act No. 101/2000 Coll., on the protection of personal data and amending certain acts, as amended (the ‚PDPA‘), and, with effect from 25 May 2018, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the ‚GDPR‘).

When processing personal data we take care to ensure that no harm is caused to the rights of natural persons in connection with the processing of personal data. At the same time we are obliged to comply with the provisions of the relevant legislation and to apply proportionate measures to protect the legal order and the legitimate interests of our company, as set out below.

For the purposes of this consent, processing means the preparation of a commercial offer of the products or services supplied by the Data Controller. The processing includes operations or a set of operations on personal data or sets of personal data on the basis of which, in particular, the financial terms of a potential future contract with you are specified.

Within the meaning of the PDPA and, with effect from 25 May 2018, within the meaning of the GDPR, we are entitled to process your personal data to the following extent:

The purpose of processing the personal data to the extent set out above is:

The personal data is processed for 12 months from the date the offer is processed. You are aware that, as the data subject, you cannot withdraw this consent.

Consent to the processing of personal data is given solely to the Data Controller.

As the data subject you acknowledge the above and also acknowledge the following notice about your rights.

If a data subject requests information about the processing of their personal data, the data controller is obliged under Section 12 of the PDPA to provide this information without undue delay. The information always includes a statement about the purpose of processing the personal data, the personal data or categories of personal data being processed, including all available information about its source; the nature of automated processing in connection with its use for decision-making, where acts or decisions are made on the basis of such processing whose content is an interference with the rights and legitimate interests of the data subject; and the recipients or categories of recipients. The data controller has the right to require reasonable payment for providing the information, not exceeding the costs necessary to provide it. The data controller's obligation to provide information to the data subject under Section 12 of the PDPA may be fulfilled on the controller's behalf by a processor.

Any data subject who finds or believes that the data controller or a processor is processing their personal data in a way that conflicts with the protection of the data subject's private and personal life or conflicts with the law, in particular where the personal data is inaccurate with regard to the purpose of its processing, may, under Section 21 of the PDPA, a) ask the data controller or processor for an explanation, b) require the data controller or processor to remedy the situation that has arisen; this may in particular involve blocking, correcting, supplementing or destroying the personal data. If the data subject's request under the previous sentence is found justified, the data controller or processor will remedy the defective situation without delay. If harm other than material harm has arisen as a result of the processing of the data subject's personal data, the data subject's claim is pursued under a special act. If, in processing personal data, obligations imposed by law have been breached by the data controller or by a processor, they are jointly and severally liable for them.

You acknowledge that, in addition to the rights set out above under the PDPA, further rights arise for you from the date the GDPR takes effect under Articles 15 to 23 of the GDPR, namely the right to request access from the data controller to the personal data concerning you (including confirmation as to whether personal data concerning you is being processed), the right to request its correction or erasure, or restriction of processing, and the right to object to processing, as well as the right to data portability. You further acknowledge that you have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7.

The contact details of the data controller's data protection officer are:

You acknowledge that this notice contains all the information provided to the data subject under Article 13 of the GDPR.

By requesting a commercial offer for the provision of GoPay Payment System services you express your free, specific, informed and unambiguous indication of will that you understand the processing of your personal data under this notice and that you have been duly informed and instructed about the processing of your personal data.