I. Introduction
CSPI International, z.s. (Center for the Study of Political Islam, z.s.) with its registered office at Lidická 700/19, Veveří, 602 00 Brno, Company-ID 03570894 (hereinafter referred to as "CSPI"), as the administrator of your personal data, bears responsibility for your privacy. Your data shall be handled with due care and in line with the legal obligations. These principles are processed in accordance with the Regulation of the European Parliament and EU Council 2016/679 as of 27th April 2016 on the protection of natural persons with regard to processing of personal data and the free movement of such data, and repealing the Directive 95/46/ES (GDPR).
By means of this document, CSPI intends to inform all data subjects on the manner of their personal data processing.
II. General Principles
CSPI shall process your personal data always in the extent necessary for the given purpose. CSPI shall process the personal data without your granted consent in the following cases:
- CSPI is deemed to meet statutory obligations (e.g. the Accounting Act);
- The data is needed for performance of our mutual agreement;
- CSPI has a legitimate interest in its processing.
In other cases, CSPI shall process the data on the basis of your consent.
CSPI shall process the personal data in order to properly secure it against any unauthorized access to the data, a random loss, destruction or a damage. CSPI shall handle the personal data only for the period strictly necessary.
III. Purpose of the Personal Data Processing
What is the purpose of personal data processing by CSPI?
- Personal data of CSPI members shall be processed by CSPI particularly in order to enable performance of the rights related to the membership at CSPI as well as the possibility to review whether obligations resulting from the membership at CSPI are fulfilled or not. Thus, legal grounds for processing of the personal data is the fulfilment of legal obligations (art. 6 (1)(c) GDPR).
- CSPI shall process the personal data of its donors in order to keep internal records of donations or make confirmation of the donation (in case the donor requests it). Thus, legal grounds for processing of your personal data is fulfilment of the provisions of the agreement (art. 6 (1)(b) of the generally binding provisions regarding the personal data protection).
- CSPI shall process the personal data of the recipients of services and products (e.g. purchase of publications) as well as personal data of providers of services and products (e.g. translators) in order to conclude an agreement and consequently to provide subscription of the service/product. Thus, legal grounds for processing of your personal data is fulfilment of the provisions of the agreement (art. 6 (1)(b) of the General Data Protection Regulation).
- Personal data of the persons interested in receiving the newsletter, invitations or other non-commercial notifications is processed in order to implement this activity. Thus, legal grounds for processing of the personal data are in general the consent of the data subjects of the CSPI members as well as the legitimate interested of CSPI (art. 6 (1)(f) of GDPR). In this case, the legitimate interest dwells in the possibility to make the interested persons acquainted with the relevant information regarding the CSPI activities.
- Personal data of the persons interested in the CSPI membership is processed in order to assess the possibility to accept such a member including assessment of the consistency of the value and the personal mindset of the applicant corresponding to the values and visions of CSPI. Thus, legal grounds for processing of the personal data is the contractual performance and the legitimate interest of CSPI (art. 6 (1)(b) and (f) of the General Data Protection Regulation).
- In line with implementation of the main activities of CSPI, personal data is gathered from publically accessible resources (particularly the Internet) in some cases. This may concern, for instance, journalists or other publically active persons. Such personal data is processed on the basis of legitimate interest of CSPI (art. 6 (1)(f) of the General Data Protection Regulation).
- Furthermore, CSPI shall process the personal data of the data subjects (members as well as non-members) in order to eventually justify its own interests in any juridical, administrative or criminal proceedings. Thus, legal grounds for processing of your personal data is the legitimate interest of CSPI (art. 6 (1)(f) of the General Data Protection Regulation). Legitimate interest dwells in the possibility to protect CSPI rights.
- CSPI is obliged to process accounting documents and records containing the personal data of the data subjects in order to meet the obligations abide by the Act No. 563/1991 Coll., on Accounting. Thus, legal grounds for processing of the personal data is the fulfilment of legal obligations (art. 6 (1)(c) of the General Data Protection Regulation).
IV. Scope of Processing of the Personal Data
What personal data shall CSPI process?
- In order to enable performance of rights concerning membership at CSPI as well as a possibility to check performance of obligations resulting from the membership, CSPI shall process the following personal data: the first and the last name, e-mail, phone number, permanent address. Some contact details of the member may be disclosed with his/her consent at the website, in invitations to various events or other CSPI materials if it is a consequence of the particular activity or a function of the member within the CSPI organisation.
- In order to keep records of donations and donors, CSPI shall process the data the donor provided concerning the donation and the data on the amount of the provided monetary donation (or eventually other information identifying non-monetary donation). The donor is not obliged to provide the data on its identity if the donor wishes to stay anonymous and in this case, the donor shall not require CSPI to issue confirmation of the provided donation.
- In order to conclude the agreement and provide a service/product, CSPI shall process in general the following personal data: the first and the last name, e-mail, phone number, Company-ID, VAT-ID, delivery address, billing address, information on the payment made, information on the service/product ordered.
- In order to send the newsletter or invitations or other non-commercial notifications, CSPI shall in general process the following personal data: the first and the last name, e-mail, phone number or the correspondence address.
- In order to assess the application of the person interested in the membership at CSPI, the following personal data is in general needed: the first and the last name, e-mail, phone number, permanent address, CV (including a photography), data from freely accessible resources (e.g. social networks).
- In order to implement the main activities of CSPI, the following personal data is in general processed and received from freely accessible resources: the first and the last name, e-mail, phone number.
- In order to defend own interests in the juridical, administrative or criminal proceedings CSPI shall in general process the following personal data: the first and the last name, e-mail, phone number, Company-ID, VAT-ID, delivery address, billing address, information on the payment made, information on the service/product ordered, information on the delivery of the product/ provision of a service, information on possible complaints and the manner of their processing.
- In order to fulfill the obligations pursuant to the Act No. 563/1991 Coll., on Accounting, CSPI shall process accounting documents and accounting records.
V. Period Needed for Personal Data Processing
How long shall CSPI process your personal data for?
- In order to enable performance of rights related to the membership at CSPI as well as the possibility to review fulfilment of obligations resulting from the membership at CSPI, CSPI shall process the personal data only until the moment the membership of a person at CSPI ceases.
- In order to conclude the agreement and provide a service/product, CSPI shall process the personal data only until the moment the product is delivered/service provided.
- In order to send the newsletter, invitations or other non-commercial notifications, CSPI shall process the personal data until the moment the membership of a person at CSPI ceases or until the moment the particular person expresses his/her disagreement with the subscription of non-commercial notifications or raises an objection against this particular manner of the personal data processing.
- In order to assess suitability of the applicant as a CSPI member, the personal data shall be processed only until the moment the decision on if the applicant is accepted as the CSPI member is made.
- In order to defend interests in the juridical, administrative or criminal proceedings, CSPI shall process the personal data within not more than 4 years since the delivery of the products/ provision of a service/ cessation of the contractual relationship or the membership.
- Accounting documents and accounting records shall be processed pursuant to the Section 31 of the Act No. 563/1991 Coll., on Accounting, within 5 calendar years following the year concerned.
VI. Other Information
How shall CSPI deal with your personal data?
CSPI shall ensure protection of the personal data processing by means of security measures determined by the art. 32 of the General Data Protection Regulation. CSPI shall not provide the personal data of the data subjects to any third party outside EU (i.e. the personal data cannot be submitted to any third country or any international organisation). CSPI shall not disclose the personal data with the exception of the explicitly aforementioned cases.
In some cases, CSPI may utilize external suppliers (e.g. for book-keeping, preparation of donation confirmation, processing of tax declaration etc.). In some cases, the supplier is a local CSPI branch in the particular country (in the Czech Republic, it is "spolek CSPI Česká republika, z.s."). CSPI has concluded a personal data processing agreement with every supplier that ensures that the supplier shall deal with your personal data in lawful manner. CSPI shall not submit to the supplier more personal data than strictly necessary for the fulfilment of the designated task.
Cookies and Google Analytics
The data subject that visits the CSPI website acknowledges that cookies may be saved by the company Google LLC, Nextcloud GmbH or other companies at his/her device. Cookies are small text files without which CSPI is unable to ensure full functionality of the website. Apart from that, cookies are processed protocol log files saved at CSPI servers. The saved information includes, for instance, IP address, the webpage of the CSPI website being opened, http status code and identification of the data subject's computer. This information shall be processed automatically as part of the operation of the Internet server with the purpose of its faultless run.
Most browsers are configured to automatically accept cookies. You may deactivate that cookies are stored by your browser and erase cookies at any time. Please note that without cookies, the use and experience of our services via this website may be impeded or impossible. Via your browser settings, you can also prevent certain cookies (such as third-party-cookies) from being stored, e.g. if you want to prevent web tracking. You will find further information in your browser’s help section.
Our website uses Google Analytics, a web analytics service by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google). Google Analytics uses cookies in order to analyse your use of this website. The information about your use of this website is collected via cookies. It is usually transferred to and stored on servers of Google Inc. in the US. Prior to the transfer to the US, Google masks and thereby anonymizes your IP address within the territory of the EU or of the European Economic Area. Only in exceptional cases, the full IP address is sent to and masked by Google servers in the US. On behalf of the website provider, Google will use this information to analyse your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider. Google will not combine your IP address with any other data held by Google.
Social Media Plugins und Video Streaming
CSPI uses sharing plug-ins of Facebook and Twitter social networks and YouTube plug-in to connect with YouTube. The plug-ins have been deactivated on the web pages of CSPI as the default setting so that, during the accessing of a web page, no personal data shall be initially passed on to the providers of the plug-ins. Only by clicking on one of the symbols of the respective social networks shall you activate the plug-in. After activation has been done, the content from the plug-in shall be transmitted by the social network directly to your browser and integrated by your browser into the web site. The plug-ins can be at any time deactivated again via your browser settings (through deleting respective third-party-cookies). You will find further information in your browser’s help section.
By integrating a plug-in, data are transmitted to the respective provider in automated fashion and can be saved by this respective provider. The provider receives the notification that you have visited our web site. This is done regardless of whether you have set up a user account on the respective social network and are logged-in there or not. If you have logged in to the social network, the provider can classify these data directly to your user account. The possibility exists that the respective providers of the plug-ins will use the data for the creation of usage profiles. CSPI has no influence on the data collected by the provider and the continued processing thereof. The purpose and scope of the data collection as well as the continued processing and use of the data by the providers of the plug-ins as well as your related rights and setting options in order to protect your private sphere can be found in the respective provider’s Data Protection Declarations.
- Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA – for their privacy policy see http://de-de.facebook.com/privacy/explanation.php
- Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA – for their privacy policy see https://twitter.com/privacy
- YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066 USA – for their privacy policy see https://policies.google.com/privacy?hl=en-GB&gl=uk
VII. Data Subject' Rights and the Manner of Their Application
What rights shall the data subject have with regard to the personal data processing?
The data subject is entitled to withdraw his/her consent with the personal data processing.
The data subject is entitled to require deletion of the personal data that CSPI processes.
As the personal data administrator, CSPI is obliged to delete the personal data without undue delay if:
- the personal data is not needed anymore for the purpose it was gathered or processed;
- the data subject has withdrawn its consent on the basis hereof the personal data was processed and there is not any other lawful reason for processing;
- the data subject raised an objection against processing and there are not any prevailing lawful reasons for the administrator to process the data;
- the personal data was illegally processed;
- the personal data has to be deleted in order to fulfill statutory obligations abide by the European Union law or a law of a membership country related to the administrator.
CSPI cannot agree with personal data deletion if the data processing is necessary for meeting statutory obligations due to public interest in the area of public health or in order to determine, perform or defend legal claims.
The data subject is entitled to access the personal data that CSPI processes. On the basis of a request also in the future, CSPI shall provide the data subject (for the period CSPI is deemed to process the personal data) with the information on the following:
- the purpose for which the personal data is processed;
- the category of the respective personal data;
- any possible recipients or recipient categories that may access the personal data, in particular the recipients in the third countries or international organisations;
- planned time frame during which CSPI stores the personal data or eventually the criteria used for determination of such a time frame;
- existence of the right to require correction or deletion of the personal data or restriction of its processing or to raise an objection against such processing;
- the right to raise an objection at the supervisory authority;
- the fact that decision-making is automatized including profiling that has legal effects on the data subject or that significantly affects the data subject; in these cases, at least reasonable information regarding the method used as well as the significance and expected consequences of such processing on the data subject is needed.
The data subject is entitled for correction of the personal data that CSPI has processed. Upon a request, CSPI shall correct inaccurate personal data that has been processed.
The data subject is entitled to raise an objection against personal data processing that is necessary for fulfillment of the task performed in the public interest or when exercising public power assigned to CSPI as well as the personal data processing affecting the data subject that is necessary in order to perform legitimate interests of CSPI. In this case, CSPI shall not process the personal data concerned if there are not any serious reasons proven that prevail over the interests or rights and freedoms of CSPI or in order to determine, perform or defend legal claims of CSPI.
The data subject is entitled for restricting personal data processing by CSPI. CSPI shall restrict personal data processing if:
- the data subject denies accuracy of the personal data for the time necessary for CSPI to verify accuracy of the personal data;
- personal data processing is illegal and the data subject refuses deletion of the personal data and requests restriction of its use instead;
- CSPI does not need the personal data any more for processing but the data subject requires it for determination, performance or defense of legal claims;
- the data subject raised an objection against the personal data processing concerned which is necessary for performing the task in public interest or exercising public power CSPI is appointed to as well as the personal data processing concerned and necessary for CSPI to perform its entitled interests, including profiling based on these regulations until it is verified whether the legitimate reasons of the administrator prevail over the legitimate reasons of the data subjects.
If the personal data processing is restricted, this personal data may be processed (with exception of their saving) only with the consent of the data subject or due to determination, performance or defence of legal claims, due to protection of rights of another natural or legal person or due to essential public interest of the European Union or a membership country.
The data subject is entitled for portability of the personal data that CSPI processes. Upon a request, CSPI shall submit the personal data of the data subject to another administrator assigned by the data subject in a structured, regularly used and machine readable format. Nevertheless, performance of the right of portability cannot unfavourably affect the rights and freedoms of other persons.
The data subject may claim all aforementioned rights via an email to the e-mail address [email protected] or via a letter to the aforementioned CSPI address. The application shall be handled without undue delay at least within one month from the receipt. In exceptional cases, with regard to complexity and the amount of applications, CSPI may prolong the period by another two months (CSPI shall inform the data subject without undue delay about this matter).
What is the procedure if the data subject is not satisfied with the manner his/her personal data is processed by CSPI?
If the data subject is not satisfied with the manner the personal data is processed by CSPI, meaning if he/she considers that CSPI proceeds in an illegal way or there was a breach of some rights, it may contact the supervisory authority with his/her complaint. In the Czech Republic, this ranks among the competence of the Office for Personal Data Protection (with its registered office at Pplk. Sochora 27, 170 00 Prague 7; www: https://www.uoou.cz).
VIII. Final Provisions
All legal relations arising in line with processing of the personal data are governed by the Legal Order of the Czech Republic. The respective Czech courts are authorized to resolve any possible disputes between the data subject and CSPI.
CSPI may modify or amend wording of these GDPR principles. Furthermore, CSPI shall inform the data subject on such a modification by e-mail (or eventually by another suitable manner) at least 30 days before the modification becomes effective. If the data subject is informed later, the modifications and amendments become effective within 30 days from the moment the data subject was informed about the modification and amendments.
This version of the GDPR principles becomes effective as of 1st May 2019.