Processing of personal data
1 GENERAL PROVISIONS
Protection of our customers' personal data is our priority. We have elaborated these Personal Data Protection Principles in order to inform you, our customers and/or clients of our services, of how our company ENETIQA a.s. (hereinafter referred to as "we" or the "Company") collects your personal data, stores it and processes it further in connection with the provision of our services which include but are not limited to the regular supply of heat and electricity as well as related services provided to our customers.
The processing of personal data is necessary for the due performance of our contractual obligations by which we are bound. During the provision of services related to the energy supply, we also have certain legal obligations out of which the obligation or necessity arises to process personal data and store it for a certain period of time. At all times during the provision of our services we ensure your privacy and personal data protection to the fullest extent possible.
By virtue hereof we would like to provide you with information on the manner in which we collect, process, and protect your personal data (Chapters 3 to 6 below), and also with the information on your rights and the manner in which you may exercise them (Chapter 7 below).
Personal data is any information related to an identified or identifiable natural person, including but not limited to our customers and any persons whose personal data we may process.
We recommend you to read these Personal Data Protection Principles carefully. Should you have any enquiries, feel free to contact us any time at the undermentioned contact details.
2 PERSONAL DATA CONTROLLER
Your personal data controller is ENETIQA a.s., with its registered office at Kaèírkova 982/4, Postcode: 158 00, Prague 5 – Jinonice, recorded in the Commercial Register administered by the Municipal Court in Prague, File No.: B 14942, Company ID No.: 496 85 490.
The current contact details may be found at www.enetiqa.cz/kontakty.
3 PERSONAL DATA PROCESSING DURING SERVICE PROVISION
3.1 In order to be able to provide you with our individual services (including but not limited to the energy supply), we need to know your personal data and process it further. The purpose of personal data processing by us includes but is not limited to the conclusion of a contractual relation, i.e. the legal foundation of such processing is therefore the performance under a contract (alternatively our legitimate interest, which includes but is not limited to legal entities,while we process the personal data of their contact persons). Your personal data processing is necessary for the conclusion and performance under this contractual relation.
During the provision of our services, we also have legal obligations within the scope of which the processing of personal data takes place, including but not limited to the connection with Act No. 458/2000 Sb., on business conditions and public administration in the energy sectors and on amendment to other laws (Energy Act), as amended (hereinafter referred to as the "Energy Act").
3.2 Purpose of Processing
In particular, your personal data is processed for the purpose of service provision and the administration of your customer account. Certain data available for us is processed even upon the termination of the contract. The purpose of your personal data processing includes but is not limited to:
3.2.1 Service Provision. Your personal data is processed during the provision of services to our customers based on the performance of a contractual relation (typically the energy supply contract).
For the aforementioned purposes we process your personal data based on the legal foundation of the contract performance and/or our legitimate interest (including but not limited to the case when you are an employee or another authorised person of the customer and there is no contractual relation between us).
In such a case, your personal data will be stored for the term of the contractual relation, or alternatively for a period necessary for the performance of commitments arising out of the relevant contract.
3.2.2 Energy Consumption Measurement. With respect to energy supply contracts we also have a legal obligation arising out of the Energy Act and decrees relevant thereto, in particular. Provided we are the electricity or heat supplier, we are obliged to measure the amount of consumed energy. In compliance with the Energy Act, this data concerning your energy consumption is used for the purposes that include but are not limited to invoicing.
In certain cases we or another supplier (e.g. electricity supplier) may request your consent with the transfer of data concerning your supplied energy consumption. Subsequently, we or the other supplier (in compliance with your granted consent) will use this data for the purposes of invoicing or the offer of other services or their provision.
Apart from this fact, during the service provision we also have a legal obligation to store certain data, e.g. the obligations arising out of Section 7 or Section 11 (a) of Act No. 165/2002 Sb., on supported resources, as amended, in compliance with which the obligation may arise to us to store your consumption data for a period of 5 years.
3.2.3 Smart Meters. In connection with the provision of our services and energy consumption measurement, you may also use the services of smart meters in compliance with the terms and conditions on the provision of such services. Provided you use this service, your smart meters send us information related to your consumption on a regular basis. Subsequently, we use this data for the service provision (as defined in Chapter 3.2.1 and 3.2.2 above), including the invoicing, and for other services requested by you, provided you grant us your consent.
3.2.4 Claims. If you presume that the values read on the meter do not correspond with the actual state, or that the quality of supplied energy is insufficient (e.g. voltage quality), you may require the re-testing of the meter or request a refund. Our obligation to process the customer's personal data in connection with the claim arises from the Energy Act and related decrees and it also forms parts of the contractual performance between the Company and yourself.
3.2.5 Demand notes. In the event of a failure to pay a due invoice for the provided services in a timely manner, we may keep sending you demand notes until the payment takes place.
3.2.6 Specification, execution, and defence of legal claims. Upon the provision of services we may also store some of your personal data whose processing is necessary for the protection of our rights and potential defences of legal claims, including the enforcement of unpaid invoices..
3.2.7 Accounting documents. Some personal data may also be stated on accounting documents (therefore, including but not limited to invoices). In compliance with legal regulations applicable to us (e.g. Act on Accounting or the VAT Act) we are obliged to store such documents for a period of 10 years. Therefore, in the event that a legal obligation arises to us to archive such documents, we store them along with your personal data provided on the specific tax documents.
3.3 Scope and resources of processed data.
For the aforementioned purposes we process personal data you provide us with within the scope of a contractual provision and during the usage of our services and payment for those. This includes but is not limited to the following data:
- identification data (including but not limited to the first name, surname, date of birth, address of residence, bank account number);
- contact details (your email address and telephone number);
- data concerning the meter (address at which the meter is located including the number of the flat, identification number of your meter);
- data concerning service usage (including but not limited to the amount of consumed energy, consumption history, and potentially payment history).
3.4 Personal data sources.
We process the personal data you provide us with in connection with the conclusion of a contractual or another legal relation and its course. We may also verify certain personal data and/or receive it directly from publicly accessible registers, lists, and files (e.g. the Commercial Register, Register of Trades, Land Registry or Insolvency Register, etc.).
4 OTHER SERVICES AND OPERATIONS
Furthermore, we provide you with the following services during which personal data processing also takes place for the undermentioned period of time, defined purposes, and based on the undermentioned legal grounds:
4.1 MARKETING COMMUNICATION
4.1.1 In the event that you provide us with your consent with receiving newsletters and special offers, by means of your contact details we may also send you special offers, newsletters, and information, including commercial communications that we find relevant for you (based on the information you have provided us with). This information and newsletter may contain marketing or advertising communications concerning our goods and services or the goods and services of third parties we cooperate with. Marketing communications may be sent by mail or electronically by email, SMS or other channels you have provided us with.
Commercial communications and other news may also be sent to you if you subscribe to our newsletters. For these purposes we solely use your email address.
4.1.2 Consent withdrawal. Your consent may be withdrawn any time. In such a case we will stop processing your personal data for the purposes of marketing communication and/or newsletters, and such communication will not be sent to you anymore. The consent withdrawal may solely be applied for the future; therefore, it does neither affect its lawfulness concerning the previous processing based on this consent (before its withdrawal) nor the usage and provision of our services.
4.1.3 Scope of processed data. In order to be able to send you the relevant marketing communications,
the personal data we use include but are not limited to:
- First name and surname,
- Email address or mailing address,
- Telephone number.
4.1.4 Purpose and period of processing. The purpose of personal data processing is sending news, special offers, and marketing or other commercial communications including our newsletters. The data is processed for the period you granted us by means of your consent, or alternatively until your consent is withdrawn.
4.2 COMPETITIONS
4.2.1 In the event you subscribe to the participation in our competitions, we will further process your personal data for the purposes of enabling you the participation in such competitions and their evaluation.
4.2.2 Consent withdrawal. The consent with participation in competitions organised by the Company may be withdrawn any time upon which we will stop processing your personal data. The consent withdrawal may solely be applied for the future; therefore, it does not affect its lawfulness concerning the previous processing based on this consent (before its withdrawal).
4.2.3 Scope of processed data. For the purposes of participation in competitions, we process the personal data you provide in the subscription form concerning the relevant competition, and also the personal data the processing of which is necessary for the relevant competition, including but not limited to:
- Contact and identification data
- Data concerning your participation in individual games including e.g. your guesses, provided photographs, etc.
4.2.4 Purpose and period of processing. The purpose of processing of your personal data is to enable you to participate in our organised consumer competitions in compliance with the terms and conditions of such competitions, including the contacting of the winner and prize delivery. For this purpose, the data is processed until the termination of the relevant competition and subsequently for a reasonable time typically not exceeding 1 year since the termination of the competition for the purpose of delivery of any potential prizes or solution of incentives or submissions of the competition participants or other persons.
4.2.5 The specific purpose of processing and period of processing always depends on the specific competition you participate in and may be further described in the rules of such a competition. In the event of any discrepancy between the rules of the relevant competition and this point 4.2, the rules of the relevant competition will prevail.
4.3 ORGANISED EVENTS
4.3.1 In the event you subscribe to the participation in events we organise for you (e.g. Open Doors Day), we will process your personal data provided with this respect on the application form. If you grant us your explicit consent, we may also take your photographs and use and process them further.
4.3.2 Consent withdrawal. If you grant us your consent with the photograph taking, you may withdraw this consent any time and we will stop using your photographs for these purposes. The consent withdrawal may solely be applied for the future; therefore, it does not affect its lawfulness concerning the previous processing based on this consent (before its withdrawal).
4.3.3 Scope of processed data. In order to participate in the competitions, we process your personal data you provide in the application form for the relevant event, as well as other data we receive from you within the scope of this event. This includes but is not limited to the following data:
- Contact and identification data
- Photographs from the organised event
4.3.4 Purpose and period of processing. The purpose of your personal data processing is to enable you the
participation in events organised by us. For these purposes, the data is processed for the whole duration of the event and subsequently for a reasonable period of time typically not exceeding 1 year since the termination of the event for the purpose of solution of incentives or submissions of the competition participants or arising damage. If you grant us your explicit consent, we may also use your photographs for promotional and other marketing activities of the Company for the period of time of the consent provision
(typically 3 years of the relevant event)
4.4 ANALYSIS AND REPORTING
4.4.1 The data concerning the consumption and usage of our services may also be processed for our internal purposes in order to create analyses and statistical reports and to optimize services provided by our Company. For these purposes, we may transfer this data to other companies within our ENETIQA group.
4.4.2 During the processing for this purpose, all personal data is firstly anonymised and the data concerning the consumption and service usage may no longer be assigned to you personally, with respect to the regulation on personal data protection this is no longer considered as personal data.
4.5 COOKIES
During the visits to our websites, we process your personal data by means of cookie files. The purpose of this processing is to create analyses of attendance and to gain other information concerning the usage of our websites by customers, and to adapt the website contents. Further information on cookies may be found in the legal information section at www.enetiqa.cz/pravidla-pouzivani.
5 SHARING AND TRANSFERRING OF PERSONAL DATA (recipients of personal data)
5.1 Recipients of personal data
The personal data we process in the aforementioned manner may be shared with third parties that ensure certain services related to the provision of our services, including but not limited to the administrative support, provision of software tools, etc. These persons are the processors of personal data. The parties with which we may share your personal data include but are not limited to:
- Other companies of the ENETIQA group for the purposes of administrative support during the shared provision of certain services, such as a call centre, or the processing and verification of payments;
- On rare occasions, certain personal data may be accessible by the suppliers of our IT systems and related services who are in the position of personal data processors.
- On rare occasions, certain personal data may be accessible by external auditors, tax advisers or legal representatives if necessary for the enforcement or accounting for the receivables or for the protection of our legitimate interest;
- In compliance with the legal sectoral obligations (including but not limited to the Energy Act), we also send certain data concerning the energy consumption to public authority bodies, including but not limited to the Energy Regulatory Office, Ministry of Industry and Commerce or to the market operator. At the same time, if we are contacted by the public authority bodies requesting the provision of personal data within the performance of their authorities, we will make your personal data accessible to the relevant body within the necessary scope in compliance with the obligations arising from the law or another legal act.
5.2 Processing guarantees
We have concluded contracts on the processing of personal data with the processors of personal data which guarantee at least the same level of personal data protection as these Personal Data Protection Principles.
6 DATA SECURING
We have implemented and we maintain the necessary reasonable technical and organizational measures, internal controls, and information security processes in compliance with our best business practice corresponding to any risk potentially arising for you as the data subject. We also consider the technological development status with the aim to protect your personal data from any accidental loss, destruction, modifications, unauthorised disclosure or access. Besides other things, these measures may also include but not be limited to the measures ensuring physical safety, acceptance of reasonable steps towards the liability assurance by our employees who have access to your data, employee trainings, regular backing up, processes for the data renewal and incident management, software protection of devices containing personal data, and other measures.
7 YOUR RIGHTS AS THE RIGHTS OF DATA SUBJECTS
In compliance with applicable legal regulations, you have the right to require the information on the manner of processing your personal data and the right to rectification of your data that we store from our position of the data controller. In certain cases you have the right to erasure of your personal data, furthermore, you have the right to access your personal data or to the data portability (e.g. data portability to another service provider). In certain cases you have the right to object and the right to request the restriction of personal data processing. In the event that you have provided us with the consent with the processing of personal data in the past, you may withdraw this consent any time. Individual rights and the manners of exercising them are defined below in detail.
7.1 Manner of exercising your rights
If you exercise any of your rights under this Article or in compliance with applicable legal regulations, we will notify every recipient who has been provided with this data under Chapter 5 hereof of the received measure or the erasure of personal data or on the restriction of processing in compliance with your request, provided such notification is possible and/or does not require disproportionate efforts.
Should you wish to exercise your rights and/or require the relevant information, you may do so at the following email address osobniudaje@enetiqa.cz.
Should you wish to exercise your rights, we may request the provision of certain additional personal data that you have provided us with before. The provision of such data is necessary in order to verify whether the relevant request has actually been sent by you personally. We will respond to your request within one month of the request receipt while we reserve the right to prolong this period by further two months in the event of a complex case.
7.2 Rectification of personal data
In compliance with the applicable legislation, you may request the rectification of the personal data you are sharing with us. In order to exercise the right to rectify your personal data, please contact us by means of the aforementioned contact details.
We adopt reasonable measures in order to ensure that your personal data is kept in an accurate and updated manner.
7.3 Erasure of personal data
You may request any time to erase your personal data by means of the aforementioned contact details.
If you contact us with such a request, without undue delay we will erase all your personal data that we have been storing unless we need your personal data for the performance of contractual or statutory obligations or for the protection of our legitimate interests as defined above. Furthermore, we will erase (and ensure the erasure by our authorised processors) all your personal data in the event that you withdraw your consent with data processing that you have granted to us in the past.
7.4 Consent withdrawal
The consent with processing of personal data you have granted to us in the past may be withdrawn any time without providing a reason. You may do so by means of the aforementioned contact details. In such a case, your personal data will be erased as defined in the process in point 7.3. Please acknowledge that the withdrawal of your consent does not affect the lawfulness of any processing performed based on the consent provided by you in the past before your withdrawal therefrom.
7.5 Accessibility and portability of your personal data
You may request information on whether we process your personal data and in which scope. You may also request us to make accessible to you the personal data you have provided us with as well as other personal data concerning you personally. Should you wish to verify whether we still process your personal data and/or wish to access your personal data, please contact us by means of the aforementioned contact details.
Should you wish the transfer of your personal data that we process based on a contract performance and/or based on your consent, you may request their transfer directly to a third party (another data controller) who you state in your request, provided such a requirement does not have a negative effect on the rights and freedoms of other persons and provided it is technically feasible.
7.6 Right to object
In the event that we process your personal data based on our legitimate interest (e.g. if we process your data being a contact person of our customer), you have the right to object any time against any such processing due to the reason concerning your specific situation. Should we be unable to prove our serious legal grounds concerning such processing overriding your interests or rights and freedoms, or should we be unable to prove such data to be necessary for the determination, performance, and defence of our legal claims, we will discontinue the processing of such data and erase the data without undue delay. Should you object against the processing of your personal data for the purposes of direct marketing, your personal data will no longer be processed for such purposes.
Objections against the processing may be raised by means of the aforementioned contact details.
7.7 Restriction of processing
Should you request us to restrict the processing of your personal data, e.g. should you contest the accuracy, lawfulness or our need to process your personal data, we will restrict the processing of your personal data as much as possible (storing) and we alternatively process it solely for the purposes of data protection of another individual or legal entity or due to other limited reasons predicted by the applicable legal regulations. In the event that the restriction is annulled and we will continue to process your personal data, we will inform you of this fact without undue delay.
Request to restrict the processing may be raised by means of the aforementioned contact details.
7.8 Complaint with the Office for Personal Data Protection
You have the right to submit a complaint concerning the processing of your personal data performed by us with the Office for Personal Data Protection, with its address at Pplk. Sochora 27, Postcode 170 00 Prague 7. Office website: www.uoou.cz.
8 UPDATES OF THE PERSONAL DATA PROTECTION PRINCIPLES
We may modify or update these Personal Data Protection Principles continuously. Any alterations hereto will become effective upon their publishing at the following link: www.enetiqa.cz/zpracovani-osobnich-udaju. Before the effective date, you will be informed by us on any substantial changes at the email address you have provided us with.
