Principles of Personal Data Processing for Doc-Air Distribution s.r.o.

The purpose of this document is to familiarise the subject with the processing of their personal data in connection to the operation of the video-on-demand portal dafilms.com / americas.dafilms.com / asia.dafilms.com / dafilms.cz / dafilms.sk / dafilms.pl (hereinafter the "Portal") of the Controller specified below.

The Subject is obliged to become familiar with the entire text of the document, and to contact the Controller if they do not understand something.

This document is effective from 12 January 2022, whereas the Controller is authorised to update the document as needed.

Definitions
1. Personal data refers to information concerning an identified or identifiable data subject. The data Subject is considered identified or identifiable if the data subject can be directly or indirectly identified particularly based on a number, code or one or more elements specific to their physical, physiological, psychic, economic, cultural or social identity; for instance, Personal Data refers to the e-mail address or mobile phone number; Personal Data may also be data about shopping preferences associated with the surname.
2. Subject is the natural person whose Personal Data are processed pursuant to this document.
3. Special category of personal data refers to data relating to racial or ethnic origin, political opinions, membership in unions, religious beliefs or philosophical convictions, medical condition, sex life or sexual orientation of the data subject. The Controller never requests data belonging to the special category of personal data. These are not processed.
4. Processing of Personal Data refers to any operation or set of operations which the Controller or processor systematically perform with Personal Data, either by automated or other means. Personal Data Processing refers in particular to collection, storage on information carriers, disclosure, modification or alteration, searching, use, handover, dissemination, publication, preservation, exchange, sorting or combining, blocking and erasure; collection of Personal Data is a systematic procedure or set of procedures, the aim of which is to obtain Personal Data for the purpose of their further storage on an information carrier for immediate or later processing; storage of Personal Data is the retention of data in such a form that allows their further processing; blocking of Personal Data is an operation or set of operation, through which the means or resources for processing Personal Data are restricted for a stipulated period, with the exception of essential interventions; erasure of Personal Data refers to the physical destruction of their carrier, their physical deletion or their permanent exclusion from further processing.
5. Controller is the entity that determines the purpose and means of processing Personal Data, performs processing and is liable for it. The Controller may authorise or assign a processor to process the Personal Data.
6. Processor is the natural person or legal entity, public authority, agency or other entity that processes the Personal Data for the Controller.
7. Purpose of processing is the reason for which the Controller processes the Personal Data.
8. Scope of processing refers to the specific Personal data which are processed, e.g. the name and surname.
9. Principles refer to this document "Principles of Personal Data Processing for Doc-Air Distribution s.r.o."
Controller
1. The Controller of Personal Data is Doc-Air Distribution s.r.o., Company ID No. 10981241, with its registered office at Ostrovní 126/30, Nové Město, 110 00 Prague 1, registered in the Commercial Register administered by the Municipality Court in Prague, Section C, File 351718.
Purposes of Personal Data processing
1. Free registration to the user account
  1. The purpose of the user account is to provide the user with information from the world of film, meaning the provision of personalised content to the user. Moreover, the Controller may provide the user with certain benefits with the user account, to which there is no claim, such as access to audio-visual works (hereinafter "AVW"). If the Subject registers for a user account, their Personal Data will be processed by the Controller for the purpose of managing the user account, including the creation of a user profile, which includes:
    1. sending of information about the Controller's products and services, as well as the products and services of the My Street Films, z.s. association, news concerning the film festivals CPH:DOX, Doclisboa, Millennium Docs Against Gravity, DOK Leipzig, FID Marseille, MFDF Ji.hlava and Visions du Réel, and other news from the world of film, including the sending of commercial messages via electronic means,
    2. provision of personalised Portal content and other benefits to the user.
  2. The legal basis for this purpose is consent.
2. AVW viewing for a fee
  1. If the Subject provides the Controller with their Personal Data for the purpose of viewing AVW for a certain fee (whether it be a one-off fee or long-term subscription), their Personal Data shall be processed by the Controller only for this purpose.
  2. The legal basis for this purpose is the fulfilment of the contract on paid access to AVW.
3. Newsletter distribution
  1. If the Subject grants the Controller consent to send newsletters, their Personal Data shall be processed at the Subject's request, respectively based on the voluntary checking of consent to direct marketing, on which basis the Subject is added to the database for direct marketing.
  2. This purpose consists of the sending of newsletters containing information about the Controller's products and services, as well as the products and services of the My Street Films, z.s. association, news concerning the film festivals CPH:DOX, Doclisboa, Millennium Docs Against Gravity, DOK Leipzig, FID Marseille, MFDF Ji.hlava and Visions du Réel, and other news from the world of film. Commercial messages are sent by all means, including electronic equipment, by the Controller.
  3. The legal basis for this purpose is consent.
  4. The Subject takes into account that when fulfilling the purpose, profiling will be conducted, respectively simple segmentation based on whether or not the registered subject is from the Czech Republic, or whether or not they are a journalist.
Scope of Personal Data processing
1. Free registration of a user account
  1. The scope for the purpose of registration of a user account is as follows: name, surname, password, e-mail, country of login.
2. AVW viewing for a fee
  1. For the purpose of viewing AVW for a fee, Personal Data are processed in the following scope: name, surname, password, e-mail, country of login.
3. Newsletter distribution
  1. For the purpose of sending newsletters, Personal Data are processed in the following scope: name, surname, e-mail, country of login, occupation (journalist - yes or no).
Term of Personal Data processing
1. Free registration of a user account
  1. Personal Data are processed for this purpose for an indefinite term, but maximally until consent is revoked by the Subject.
  2. The Subject may revoke consent at any time; the Subject has the right to object to processing for the purpose of direct marketing.
2. AVW viewing for a fee
  1. For the purpose of viewing AVW for a fee, Personal Data are processed only for the period necessary to perform the contract on paid access to the AVW and subsequently for the purpose of potential complaints, and furthermore for the period during which claims may be applied by the Subject or Controller from this contract, but maximally for three years, which is the period during which claims may be applied. After the passing of three years, only tax invoices and related documents will be stored based on the legal obligations arising from the Act on income tax.
3. Newsletter distribution
  1. Personal Data are processed for this purpose for an indefinite term, but maximally until consent is revoked by the Subject.
  2. The Subject may revoke consent at any time; the Subject has the right to object to processing for the purpose of direct marketing.
Revocation of consent, filing of objections
1. The consent which the Subject granted to the Controller may be revoked at any time via e-mail at: info@dafilms.com or at this address: Doc-Air Distribution s.r.o., Ostrovní 126/30, 110 00 Prague 1.
2. If the Subject wants to object to Personal Data processing for the purpose of direct marketing, they may do so via e-mail: info@dafilms.com or at this address: Doc-Air Distribution s.r.o., Ostrovní 126/30, 110 00 Prague 1.
3. If the Subject requires the filing of an objection to Personal Data processing based on legitimate interest, they may do so via e-mail: info@dafilms.com or at this address: Doc-Air Distribution s.r.o., Ostrovní 126/30, 110 00 Prague 1.
4. The Controller will react immediately to every request, at latest within 14 days.
Processors
1. The Subject takes into account that the Controller users Processors to perform the given purpose, who have access to the necessary scope of Personal Data to perform their activity. These are Processors in the following categories: parties performing transport; parties performing accounting, audit, legal services; parties engaged in HR and education; parties providing IT services; parties engaged in internet marketing; parties engaged in the development and implementation of corporate systems; parties engaged in the development of web and mobile applications; parties providing software licenses for online communication.
Applying complaints and requests concerning Personal Data processing
1. The Subject may apply their requests, complaints and other submission regarding the processing of their Personal Data via e-mail at: info@dafilms.com.
2. The Controller will react immediately to every request, at latest within 14 days.
3. The Subject may also lodge a complaint to the supervisory authority for Personal Data processing, that being the Office for Personal Data Protection, registered office at Pplk. Sochora 727/27, 170 00 Prague 7 - Holešovice, www.uoou.cz.
Information about rights
1. Right to access
  1. The Controller will adopt adequate measures to provide the Subject with complete information in a concise, transparent, comprehensible and easily accessible manner using clear and simple language (e.g. about the Personal Data Processor and the course of such processing) and to make all notices about processing. The Controller will provide the Subject with the information in writing or via other means (e.g. in electronic form). Assuming that identity is proven by other means, the Subject also has the right to request the provision of this information orally.
  2. The Controller will not refuse to accommodate the Subject's request while exercising their rights (in particular the right to access), unless it proves that it cannot determine the identity of the data subject to which the given data pertain.
  3. The Subject has the right to be provided by the Controller upon request with information about all the data concerning the processing pursuant to Art. 13, 14 and 15 of the General Data Protection Regulation (GDPR) and the adopted measures without undue delay, and in any case within one month from receiving the request. This deadline may be extended by an additional two months if necessary given the complexity and number of applications. The Controller will inform the Subject of any such extension within one month from receiving the request together with reasons for such delay. If the Subject submitted the request in electronic form, the information will be provided in electronic form, if possible and if they do not require other means.
  4. If the Controller does not adopt the measures the Subject requested, it will inform the Subject immediately and at latest within one month from receiving the request about the reasons for not adopting the measures and the possibility of filing a complaint with the supervisory authority and requesting court protection.
  5. The Controller informs the Subject that all this information, notices and actions are provided free of charge. If the filed requests are evaluated as obviously unjustified or unreasonable, particularly in the case of repeated requests, the Controller may either: a) impose a reasonable fee taking into account the administrative costs related to providing the required information or performing the requested tasks; or b) refuse to accommodate the request.
  6. The Controller must prove the obvious lack of justification or inadequacy of the request.
  7. If the Controller has justified doubts about the identity of the natural person submitting the request, it may ask for the provision of additional information required to confirm the identity of the Subject.
  8. The information which is to be provided to the Subject may be supplemented with standardised icons with the aim of providing an easily visible, comprehensible and clear overview of the intended processing. If the icons are presented in electronic format, they must be machine-legible.
2. Right to rectification
  1. The Subject has the right to have the Controller correct inaccurate Personal Data concerning their person without undue delay. With regard to the purposes of processing, the Subject also has the right to the completion of incomplete Personal Data by providing an additional declaration.
3. Right to erasure ("right to be forgotten")
  1. The Subject has the right to have the Personal Data concerning their person deleted without undue delay by the Controller, and the Controller is obliged to erase the Personal Data without undue delay, if one of the following reasons exists:
4. Right to restriction of Processing
  1. The Subject has the right to have the Controller restrict Processing in any of these cases:
    a) If the Subject denies the accuracy of the Personal Data, for the time needed for the Controller to verify the accuracy of the Personal Data;
    
    b) Processing is unlawful and the Subject rejects the erasure of Personal Data and instead requests the restriction of their use;
    
    c) The Controller no longer needs the Personal Data for the purposes of processing, but the Subject requires them to determine, exercise or defend their legal claims;
    
    d) If the Subject has raised an objection against Processing, until it is verified whether the Controller's legitimate reasons outweigh their legitimate reasons.
  2. If Processing was restricted pursuant to the aforementioned "Right to restriction of processing", the Personal Data (with the exception of storage) may be processed only with the Subject's consent or in order to determine, exercise and defend legal claims, for reasons of protection of the rights of other natural persons or legal entities, or for reasons of important public interest of the Union or a member state.
  3. If the Subject attained the restriction of Processing, they will be notified in advance by the Controller that the restriction of Processing will be cancelled.
5. Notification obligation concerning the rectification or erasure of Personal Data or Processing restriction.
  1. The Controller informs the individual Recipients, to whom Personal Data were disclosed, of any rectifications or erasures of Personal Data, or restriction of Processing, with the exception of cases when this proves to be impossible or requires disproportionate effort. The Controller will inform the Subject about these Recipients, if requested by the Subject.
6. Right to data portability
  1. The Subject has the right to obtain the Personal Data concerning their person which they provided to the Controller in structured, regularly used and machine-legible format, and the right to provide these data to another Controller without interference from the Controller to whom these Personal Data were provided, in the case that:
    a) Processing is based on consent or a contract.
    
    b) Processing is performed automatically.
  2. When exercising the right to data portability, the Subject has the right to have the Personal data transferred directly by one Controller to another, if this is technically feasible.
  3. Exercising the aforementioned "Right to data portability" does not affect the aforementioned "Right to erasure". This right does apply to the Processing necessary for the purpose of performing tasks in public interest or when exercising public authority, with which the Controller is entrusted.
  4. The aforementioned "Right to data portability" must not have a negative impact on the rights and freedoms of other persons.
7. Right to object
  1. For reasons concerning the Subject's specific situation, the Subject has the right at any time to raise an objection to the Processing of Personal Data concerning the Subject. The Controller will no longer process the Personal Data if it does not prove its serious legitimate reasons for processing, which outweigh the Subject's interests or rights and freedoms, or for the determination, exercising or defence of legal claims.
  2. If the Personal Data are processed for the purpose of direct marketing, the Subject has the right at any time to object to the Processing of Personal Data concerning their person for such purpose, which also includes profiling as concerns direct marketing.
  3. If the Subject objects to Processing for the purpose of direct marketing, their Personal Data will no longer be processed for this purpose.
  4. In connection to the use of information society services, the Subject may apply their right to raise an objection via automated means using technical specifications.
  5. If the Personal Data are processed for the purpose of scientific or historical research or for statistical purposes, the Subject has the right to object to the processing of Personal Data concerning their person for reasons related to their specific situation, unless Processing is necessary to fulfil a task performed for reasons of public interest.
8. Automated individual decision-making including profiling
  1. The Subject has the right not to be the subject of any decision based solely on automated processing, including profiling, which has legal consequences for the subject or significantly affects them in a similar manner.
  2. The Controller does not base any of its decisions exclusively on automated processing.
  3. The profiling conducted by the Controller does not have legal effects for the Subject and does not significantly affect them.