Personal Data Processing Policy and Information on the Protection of a Whistleblower’s Personal Data
ALVA TOUR s.r.o., Company ID No. 49684167, with its registered office at Sokolovská 146/70, Karlín, 186 00 Prague 8, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 23315 (the “Controller”), treats all processed personal data as strictly confidential and handles it in accordance with the applicable personal data protection laws.
This Policy primarily concerns the processing of personal data within the Controller’s internal reporting system, which has been introduced to detect potential unlawful conduct within the meaning of Act No. 171/2023 Coll., on the Protection of Whistleblowers.
The purpose of this system is to support whistleblowers in raising serious concerns about unlawful or unethical conduct related to the Controller’s activities, without suffering harm or retaliation as a result of making such a report.
This Policy provides, in particular, information on the categories of personal data processed, the purpose and manner of processing, any recipients of such data, the retention period, and your rights in relation to personal data protection.
For the purposes of Regulation (EU) 2016/679 of the European Parliament and of the Council and Act No. 110/2019 Coll., as amended, the Controller acts as the controller of your personal data. In order to ensure the proper investigation of each report and to protect the whistleblower, the Controller has appointed a designated competent person to receive reports, assess their merits and handle them, namely Mgr. Alice Baumruková Kotylová (the “Competent Person”), email: schrankaduvery@alvatour.cz, phone: +420 724 122 845. Detailed rules governing the operation of the Controller’s internal reporting system are set out in the Controller’s internal regulation – the Whistleblower Protection Directive.
1. Categories of Data Subjects
1) employees of the Company, trainees or interns who perform or have performed work or similar activities for the Company,
2) self-employed persons,
3) persons exercising rights associated with participation in a legal entity or serving as members of a legal entity’s governing body,
4) persons who perform or have performed tasks within the Company’s activities, in its interest, in its name or on its behalf,
5) persons who carry out or have carried out volunteer activities,
6) persons who perform or have performed rights and obligations arising from a contract for the supply of goods, services, construction works or other similar performance,
7) other persons concerned by the report.
2. Purposes and Legal Basis for Processing Personal Data
Personal data may be processed by the Controller for the purpose of investigating cases of potential unlawful conduct within the meaning of Act No. 171/2023 Coll., on the Protection of Whistleblowers.
The processing is carried out on the basis of legitimate interest in line with European standards for reporting unlawful conduct.
3. Processed Personal Data and Retention Period
For the purpose of investigating a report, the following data will be processed:
• the received report,
• the date the report was received,
• the whistleblower’s first name and surname, if the report is not made anonymously,
• the whistleblower’s date of birth, if the report is not made anonymously,
• the whistleblower’s contact address, if the report is not made anonymously,
• all information necessary to investigate the specific case,
• recordings or written records from the investigation,
• identification of the person concerned by the report, if their identity is known,
• the date of the assessment of merits,
• any other relevant supporting documents at the discretion of the Competent Person,
• the outcome of the investigation.
These data will be retained for the duration of the investigation and for a further period of 2 years from the date the report is received, or longer if required in connection with a specific case.
For the purpose of keeping records of reports, the following data will be processed:
• the date the report was received,
• the whistleblower’s first name, surname, date of birth and contact address, or other data from which the whistleblower’s identity may be inferred, if known to the Competent Person,
• a summary of the report and identification of the person against whom the report is directed, if known to the Competent Person,
• the date on which the Competent Person completed the assessment of merits and the result of that assessment.
These data will be retained for 5 years from the date the report is received.
4. Recipients of Personal Data
Access to the data will be granted only to the designated Competent Person. Some data, excluding the whistleblower’s identity, may also be disclosed to the Controller’s staff at the discretion of the Competent Person.
In cases laid down by law, the Controller is entitled or obliged to disclose certain personal data pursuant to applicable and effective legal regulations, for example to law enforcement authorities or other public authorities.
5. Rights of Data Subjects
As a data subject, you have the rights listed below under the applicable legislation, which you may exercise at any time subject to the conditions set out in personal data protection laws.
These rights include:
• Right of access to personal data:
If you wish to know whether the Controller processes your personal data, you have the right to obtain information on whether your personal data are being processed and, if so, to access those personal data.
• Right to rectification of inaccurate personal data or completion of incomplete personal data:
If you believe that the Controller processes inaccurate, untrue, outdated or incomplete personal data relating to you, you have the right to request that they be corrected or completed. The Controller will make such correction or completion without undue delay, taking technical possibilities into account.
• Right to erasure (the “right to be forgotten”):
If you request erasure, the Controller will erase your personal data if (i) they are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) the Controller is not required by law to continue the processing.
• Right to restriction of processing:
If you do not wish your personal data to be erased but only want their processing to be temporarily restricted, you may request restriction of processing from the Controller.
• Right to data portability?
If you want the Controller to transfer your personal data processed on the basis of your consent or a contract to a third party, you may exercise your right to data portability. If exercising this right could adversely affect the rights and freedoms of third parties, the Controller may be unable to comply with your request.
• Right to object:
You have the right to object to the processing of personal data carried out for the purposes of the Controller’s legitimate interests. Unless the Controller demonstrates compelling legitimate grounds for the processing that override your interests or rights and freedoms, it will cease the processing without undue delay following your objection.
You also have the right to lodge a complaint with the Office for Personal Data Protection, with which you may file any complaint you may have.
Please note that some of your rights may be restricted in connection with the necessary protection of the whistleblower.
In the case of repeated or manifestly unfounded requests to exercise the above rights, we are entitled to charge a reasonable fee for handling such a request or to refuse to act on it. We will inform you of any such procedure.
When exercising your rights, please contact us by post at the Controller’s registered office or by e-mail at: schrankaduvery@alvatour.cz. The Controller reserves the right to verify the identity of the person exercising the above rights by appropriate means.
