Personal Data Protection Policy
We would like to provide you with all relevant information relating to your rights and obligations in regards to the Consent to process your personal data you provided to CEPA International s.r.o. in any form of communication. This information also applies to cases where the lawfulness of processing the personal data results from a legal title other than your consent.
We collect and process your personal data in accordance with relevant legal regulations, in particular Act no. 101/2000 Coll., on the Protection of Personal Data, as amended by later regulations, and Regulation of the European Parliament and of the Council (EU) 2016/679 (General Data Protection Regulation), or any regulations which will change or replace them in the future.
Personal data processing always takes place only to the extent of the particular service or purpose of the processing.
- Identity and contact details of the Controller
The Controller of your personal data is CEPA International s.r.o., with registered office at Heinemannova 2695/6, 160 00 Praha 6, ID no. 07326700 (hereinafter referred to as “CEPA”). If you wish to receive a copy of your personal data we are processing or in case of the exercise of your rights in the sense of the Articles below, please contact us at the e-mail address email@example.com.
- Processing purpose and legal basis for processing
The lawfulness of processing your personal data results from a contract between you and CEPA and the nature of the service provided. We process your personal data in the scope of: name, surname, photo, phone number, e-mail, passport number or identity card number or other information that you voluntarily give us. Your personal data as outlined above is processed for the following purposes:
- We provide you with air transport by our operated aircraft or by another operator’s aircraft. We process the above personal data for the purpose of admitting to transportation, booking and issuing the ticket, or other services as per your order;
- Since we have a duty to prove your consent throughout the processing, we keep your personal data for that time; the legal basis for such processing is the fulfillment of a legal obligation;
- In the event of a potential litigation in the future, we need to store the above personal data; the legal basis for such processing is legitimate interest of CEPA or a third party.
- Recipient or categories of recipients of personal data
Your personal data may be transferred by CEPA to any reliable third party providing administrative or technical support, business or other specific activity (such persons are processors of personal data). The most common are handling companies, marinas or companies providing transportation, accommodation, purchase&sale, real estate services. Your personal data are shared with the above mentioned companies only if they actively participate in your transportation or we provide a services based on contract with you. We process only those data that we necessarily need or the data that we are provided with by your consent beyond the necessary processing. As mentioned above, in some cases, we pass or transmit the personal data to third parties. In such cases, we select trusted partners that have been secured to observe at least the same level of privacy as our company. When transferring personal data, we always use the most appropriate and secure transmission options.In some cases, we need to share your personal data with state administration authorities. However, it is not only about the state administration authorities in the Czech Republic but especially about the authorities responsible for border control or security at destinations. We transfer your personal data to these authorities on the basis of a statutory obligation, otherwise you may not be admitted for carriage or allowed to enter the country. If any extraordinary situation occurs during the flight, we are obliged to report the situation to the state competent authorities in certain cases.
- Personal data storage
We will store your personal data for 10 years from the date the legal relationship between you and CEPA was terminated. After this time, we will delete all your personal data. If you withdraw or restrict your consent, we will cease to process your data to the extent appropriate for that purpose and, if we do not have any other legitimate reason to do so, we will safely delete them. In the event of a legitimate interest in a potential litigation, we keep your data for 10 years. The photos from events etc. are used for undefinite period.
- Data subject’s rights
In case of consent, you, as a data subject who has voluntarily granted your consent, have the right to withdraw or restrict this consent. If the reason for processing is the CEPA’s legitimate interest, you have the right to object this processing. Your other statutory rights include: the right to access to personal data, the right to rectification or deletion of personal data, the right to limit the data processing, the right to the portability of personal data, and the right to file a complaint with the Office for Personal Data Protection against CEPA.