Information on Personal Data Processing

This statement is intended to explain our personal data processing practices that we collect from you or about you through our site or application, based on written or verbal communication with us, when you visit our restaurants.

Personal Data Controller

The personal data controller Nadji club CZ s.r.o, with its registered office in Czech Republic, Prague 7, Jankovcova 1639/16c, postal code: 170 00, company ID: 07834675, registered in the Commercial Register, maintained by the Municipal Court in Prague, Case C 308392 ('SaSaZu').

Category of Personal Data Processed by SaSaZu

Personal information is any information relating to a natural person SaSaZu is able to identify. The following categories of personal data may be processed by SaSaZu in connection with the provision of services and the sale of goods.

1. Name and surname;
2. Identification number;
3. Tax identification number;
4. Delivery address;
5. Billing address;
6. E-mail address;
7. Telephone number;
8. For group bookings of more than 9 persons, credit card information;

We do not knowingly collect personal information from persons under 18 years of age. As parents or guardians, please do not allow children to provide personal information without your permission.

Purposes, Legal Reasons and Periods of Personal Data Processing

We use your personal information in many ways, for example, to provide and customize the services you receive or expect from SaSaZu to offer the expected level of hospitality. SaSaZu processes personal data without the clients' consent in order to fulfill the legal obligation, negotiate the contract and fulfill the contract and for the legitimate interest of the data administrator (direct marketing of own products, sending commercial messages). Personal data are processed electronically by means of computer technology or in paper form. If required by law, we require your consent before processing personal data.

We must record some information, including first and last name, e-mail address, telephone number, payment information (for group bookings of more than 9 people) as part of your booking processing. If you do not provide this information, you will not be able to book.

We may use your personal information to provide or offer you newsletters about our own products and services, customized event information, customized special events, and other marketing communications in accordance with your communications settings. We can do this through email, online advertising, social media advertising.

Personal data for these partial purposes are processed to the extent necessary for the fulfillment of these purposes and for the time necessary to achieve them or for a period directly determined by legal regulations. The personal data are then deleted or anonymized.

Basic deadlines for processing personal data:

• For clients who booked a table at SaSaZu, SaSaZu is entitled to process the personal information provided for a period of 3 months from the date on which the reservation was made, except as provided below.
• For clients who have made a group reservation at SaSaZu, SaSaZu is entitled to process the personal information provided for 4 years from the date on which the reservation was made, including credit card details.
• Invoices issued by SaSaZu or in the case of issuance of an advance payment receipt (online confirmation) are archived for a period of 10 years from their issue in accordance with § 35 of Act No. 235/2004 Coll., On Value Added Tax.
• Due to the necessity to prove the legal reason for issuing invoices, other supporting documents for these payments are archived for a period of 10 years from the date of termination of the contract.

Processing with Data Subject Consent

With the consent for business purposes, SaSaZu processes the client's personal data primarily to create a suitable offer of SaSaZu products or services or third parties in the form of electronic communication through contact details. Providing consent for business purposes is voluntary and the client can withdraw it at any time. This consent shall remain in effect until the Client withdraws it. If the client withdraws his consent for business purposes, this does not affect the processing of his personal data by SaSaZu for other purposes and under other legal titles, in accordance with these principles.

For clients who have given their consent to marketing by electronic contact, SaSaZu, with their consent, processes, for the period specified in this policy, the contacts that the client makes available for marketing purposes with the offer of SaSaZu services and products. If such consent is given through a website operated by SaSaZu, data from SaSaZu cookies that are placed on websites where such consent has been granted are processed together with these contacts only if the subject has cookies in a web browser enabled.

If the Client has cookies enabled in our web browser, we process behavior records from cookies placed on websites operated by SaSaZu for the purpose of ensuring better operation of the SaSaZu website and for the purpose of SaSaZu internet advertising.

What Sources of SaSaZu Personal Data Obtains

We process the data you provided us in connection with making a reservation for the delivery of goods or services.

How Do We Protect Personal Data

Personal data is under constant physical, electronic and procedural control, and SaSaZu has control, technical and security mechanisms to ensure maximum protection of processed data from unauthorized access or transmission, loss or destruction as well as other possible misuse.

All persons who come into contact with clients' personal data as part of their work or contractual obligations are bound by a confidentiality obligation.

Category of Other Personal Data Recipients

SaSaZu uses professional and specialized services of other entities in fulfilling its obligations and contractual obligations. If these suppliers process personal data transmitted from SaSaZu, they have the status of personal data processors and process personal data only within SaSaZu instructions and must not use them otherwise. These include the recovery of outstanding debts, the activities of experts, lawyers, auditors, IT systems administration, Internet advertising. SaSaZu carefully selects and concludes a contract on the processing of personal data with each processor, in which the processor has strict obligations for the protection and security of personal data.

Processors are entities established both in the Czech Republic and in a member state of the European Union or so-called safe states. No personal data is transferred or processed in countries outside the European Union.

Method of Personal Data Processing

SaSaZu processes personal data manually and automatically. SaSaZu keeps records of all activities, both manual and automated, in which personal data is processed.

Information About the Rights of Data Subjects to Personal Data Processing

Each client has the following rights if SaSaZu is an identifiable individual and proves his / her identity. These rights must be exercised in a manner intended for the application of a specific right. Applications made in violation of these principles will not be considered. Such rights may also be exercised only in respect of personal data which are beyond doubt that they belong to the applicant.

1. Right of access to personal data

Pursuant to Article 15 of the Regulation, the Client has the right to access personal data, which includes the following rights: - (i) to obtain confirmation that he / she is processing personal data; - (ii) to obtain information about the purposes of processing, categories of personal data concerned; shall be made available, at the scheduled time of processing, of the existence of the right to require the controller to rectify, delete or object to the personal data concerning the data subject or to limit processing, the right to file a complaint with the supervisory authority; - (iii) obtain a copy of personal data, provided that the rights and freedoms of others are not adversely affected.

In the event of a repeated application, SaSaZu will be entitled to charge a reasonable fee for a copy of the personal data. In the event that the exercise of the right to copy personal data could, in relation to certain categories of personal data, adversely affect the rights and freedoms of third parties, applications within the scope of these categories of data cannot be granted in accordance with the Data Protection Authority's opinion No 6/2013. SaSaZu also does not provide documents, such as contracts or invoices, that have been demonstrably received from SaSaZu as part of requests for a copy of the data.

2. Right to correct inaccurate data

Pursuant to Article 16 of the Regulation, the client has the right to correct inaccurate personal data that SaSaZu will process about him. SaSaZu will carry out the repair without undue delay, but always with regard to the given technical possibilities. The request for the correction of personal data can be made at the seat of SaSaZu or electronically via the contact email of SaSaZu.

3. Right of erasure

Pursuant to Article 17 of the Regulation, the client has the right to delete personal data concerning him, unless SaSaZu proves justified reasons for processing such personal data. SaSaZu has mechanisms in place to ensure automatic anonymization or deletion of personal data when it is no longer needed for the purpose for which it was processed. If the Client nevertheless believes that his / her personal data have not been deleted, he / she may file a request for deletion via SaSaZu contact email and provided that the request is justified.

4. Right to limit processing

Pursuant to Article 18 of the Regulation, the data subject has the right to limit processing until the complaint is resolved if he or she contests the accuracy of the personal data, the reasons for processing it or objects to their processing by sending a written request to SaSaZu registered office or electronically.

5. Right to be notified of repair, deletion or restriction of processing

According to Article 19 of the Regulation, the data subject has the right to be notified by SaSaZu in case of correction, deletion or restriction of the processing of personal data. If personal data is corrected or deleted, SaSaZu will inform individual recipients, unless this proves impossible or requires undue effort.

6. Right to portability of personal data

Pursuant to Article 20 of the Regulation, the data subject has the right to request from SaSaZu personal data relating to him which has been provided to SaSaZu and which are processed automatically in a structured, commonly used and machine-readable format, and to request the transfer of such data to another trustee, provided that the person acting on behalf of the respective trustee is duly identified and can be authorized.

In the event that the exercise of this right could adversely affect the rights and freedoms of third parties, the application cannot be accepted.

7. Right to object to the processing of personal data

Pursuant to Article 21 of the Regulation, the data subject has the right to object to the processing of his personal data on the grounds of the legitimate interest of SaSaZu. If SaSaZu does not prove that there is a valid legitimate reason for the processing that outweighs the interests or rights and freedoms of the data subject, SaSaZu will terminate the opposition processing without undue delay. The objection can be sent in writing to the address of SaSaZu.

8. Right to withdraw consent to the processing of personal data

Consent to the processing of personal data for business purposes can be revoked at any time after its effectiveness. The appeal must be made express, comprehensible and expressive of will, either electronically via e-mail or via the web interface. Consent to a marketing address given to a specific electronic contact can be withdrawn at any time in the manner specified in the sent commercial communication. The processing of cookies data can be prevented by setting up a web browser.

9. Automated individual decision-making including profiling

The data subject shall have the right not to be the subject of any decision based solely on automated processing, including profiling, which would have legal effects or would be significantly affected by it in a similar way. SaSaZu states that it does not make automated decision-making without the impact of human judgment with legal effects for data subjects.

10. Right to contact the Office for Personal Data Protection

The data subject has the right to contact the Office for Personal Data Protection (www.uoou.cz).