Information for suppliers according to Articles 13 and 14 of the GDPR
In accordance with Art. 13 and 14 of the GDPR and on the basis of the relevant provisions of the Personal Data Processing and Privacy Policy (https://www.aspena.com/personal‑data‑protection/), Aspena, s.r.o., company ID No.: 607 51 185, with its registered office in Brno, Veveří, Gorkého 64/15, Postal Code 602 00, registered in the Commercial Register under Insert No. C 19243, kept by the Regional Court in Brno, as the personal data controller (hereinafter referred to as the “Company”), informs suppliers who offer or provide the Company with goods and services (hereinafter referred to as “Suppliers”) about the processing of personal data:
1. Company name and contact details
Aspena, s.r.o., company ID No.: 607 51 185, with registered office in Brno, Veveří, Gorkého 64/15, Postal Code 602 00, e‑mail: gdpr@aspena.cz.
2. Data Protection Officer
The Company is not obliged to appoint a Data Protection Officer.
3. Purposes and legal grounds for personal data processing
- The Company obtains personal data from the Supplier via e‑mail or the form on the Company's website.
- The Company processes the collected personal data of the Supplier both automatically and manually.
- A Supplier whose personal data are processed by the Company in accordance with the GDPR may refer to a natural person:
a) offering or providing translation and interpreting services to the Company (hereinafter referred to as the “Contractor”),
b) another natural person operating a business (hereinafter referred to as the “Other Supplier”), or
c) a natural person authorised to act on behalf of the legal entity of the Supplier under a) or under b) (hereinafter referred to as the “Other Supplier”).
3.1 Contractor ‑ purposes and legal grounds for processing
The Company processes the Contractor's personal data in accordance with the GDPR for the following purposes, proceeding on the basis of and within the framework of the legal grounds for processing personal data listed below:
- performance of the contract to which the Contractor is a party ‑ in particular the Contractor’s identification and contact data, conditions of performance of the contract, information necessary to change the content of the contract, rights and obligations from liability for defects (legal grounds under Art. 6(1)(b) of the GDPR),
- fulfilment of the legal obligations applicable to the Company, which is an accounting entity and a tax entity, and for this reason keeps documents and accounting documents that may contain the Contractor’s personal data; as well as the fulfilment of the Company's legal obligations from liability for defects (Art. 6(c) of the GDPR),
- fulfilment of the Company's legitimate interests ‑ in particular judicial or extrajudicial recovery of claims against the Contractor, sending newsletters to the Contractor, evaluation of the services provided by the Contractor, follow‑up demand for the Contractor's services (Art. 6(f) of the GDPR).
3.2 Other Supplier ‑ purposes and legal grounds for processing
The Company processes the Other Supplier's personal data in accordance with the GDPR for the following purposes, proceeding on the basis of and within the framework of the legal grounds for processing personal data listed below:
- performance of the contract to which the Other Supplier is a party ‑ in particular the Other Supplier’s identification and contact data, conditions of performance of the contract, information necessary to change the content of the contract, rights and obligations from liability for defects (legal grounds under Art. 6(1)(b) of the GDPR),
- fulfilment of the legal obligations applicable to the Company, which is an accounting entity and a tax entity, and for this reason keeps documents and accounting documents that may contain the Other Supplier’s personal data; (Art. 6(c) of the GDPR),
- fulfilment of the Company's legitimate interests ‑ in particular judicial or extrajudicial recovery of claims against the Other Supplier, evaluation of the services provided by the Other Supplier, follow‑up demand for the Other Supplier's services (Art. 6(f) of the GDPR).
4. Legitimate interests of the Company
In particular, the Company uses the following legitimate interests in the processing of personal data:
- education ‑ sending newsletters to the Contractor for information and educational purposes,
- debt recovery ‑ judicial or nonjudicial recovery of any claims against the Supplier,
- evaluation of the Supplier’s services ‑ appropriate prioritisation of the Contractor, evaluation of the Supplier to protect the Company's assets,
- follow‑up demand for the Supplier's services.
5. Recipients of personal data
The Company reserves the right to disclose the Supplier's personal data to the Company's employees, if necessary for the performance of their work duties, as well as to processors with whom the Company has concluded a contract for the processing of personal data (e.g. for accounting, IT and marketing services), and possibly to other persons and institutions in accordance with legal regulations, in particular to state authorities and other public authorities on the basis of a legal obligation to provide personal data.
6. Transfer of personal data to a third country or international organisation
The Company does not intend to transfer personal data to a third country outside the EU or an international organisation.
7. Period of storing personal data
The Supplier's personal data will be retained by the Company for the duration of the contract with the Supplier or for 10 years from the entry of the Supplier's personal data into the Company's IS. After the termination of the contract with the Supplier, the Supplier's personal data will continue to be stored to meet legal obligations under the relevant laws (in particular in the field of accounting and tax) and at the same time for a period of 10 years after the termination of the contract for the purpose of implementing the above‑mentioned legitimate interests of the Company.
8. Supplier's rights to processed personal data
The Supplier may exercise the following rights in relation to their personal data with the Company by sending an e‑mail to gdpr@aspena.cz:
- right of access to personal data,
- right to rectification,
- right to erasure,
- right to restrict processing for a certain period of time,
- right to portability,
- right to object to processing on the grounds of legitimate interest.
9. Right to withdraw consent
If the processing of personal data is based on consent, the Supplier may withdraw this consent at any time by e‑mail at gdpr@aspena.cz.
10. Right to file a complaint
The Supplier has the right to file a complaint with the Office for Personal Data Protection if they believe that the processing of their personal data has violated the GDPR.
11. Legal/contractual requirement to provide personal data
The provision of the Supplier's personal data is primarily a contractual requirement. The consequence of the Supplier's failure to provide personal data is the failure to conclude the contract.
12. Automated decision‑making including profiling
The Supplier's personal data are not subject to automated decision‑making or profiling.