Scope of our Privacy Policy

This Privacy Policy applies to the services provided by Seznam.cz, a.s. and its subsidiaries. The policy is the cornerstone of our company’s personal data protection. While Seznam.cz acts as a data controller or processor in relation to them, the cooperating entities are mostly in the position of personal data processors. For business partners who provide their services to Seznam.cz on the basis of a contractual relationship, the terms and conditions defined in the document apply.

The Privacy Policy applies to the following situations:

• Provision of online and offline services of Seznam.cz, including installation of Seznam.cz services on the user’s end device and their (automatic) updating.
• Reporting service malfunctions or problematic and illegal content (communication with technical support if personal data is processed to identify a natural person).
• Subscribing to newsletters, etc.
• Processing of personal data obtained in the context of presentations, trade fairs, seminars and other similar events.
• Personal data collected by third parties for the benefit of Seznam.cz, if applicable.

Our processing of personal data complies with the main principles of Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR or the Regulation) and all related laws. The Regulation has been in force since 25 May 2018.

Principles of personal data protection

Your trust in our services has made Seznam.cz as successful as it is. While the Regulation brings with it some new obligations, the principles we have long applied in the area of personal data protection remain fundamentally unchanged. We strive to always work with accurate and updated data as necessary, store it only for as long as necessary and handle it in a way that ensures its proper security. Your rights in relation to the processing of personal data are specifically set out in the text below.

Data we collect

We divide the data we collect into two categories: (1) data that the user provides us directly (e.g. by registering for the service or filling in an online form), and (2) data that we obtain through your use of the individual services (e.g. information on the cookies issued or the technical devices through which you use our services).

Seznam.cz services can be used either without logging in to the service or logged into a user profile. A number of services allow for both. If you choose access without logging in, we collect and process information (which may not be personal data) as separate events. When you are logged in, data is combined under your profile header. However, it is always according to the preferences set by the specific service and fully within the scope of the powers agreed in the terms of service of the given Seznam.cz service. While in this case the data is collected in one place, our other services do not have access to the data. And they will not have access to this data until you request to share it as a profile owner on another service. Until then, the data will remain separate, albeit within the same internal system.

Data which is directly provided to us by you as the user:

Registration for Seznam.cz services:

You can use Seznam.cz services as a logged-in or non-logged-in user. Some services can only be used in logged-in mode. For these, you will need to register by filling in a registration form. After filling in a username in the form of an email address (it does not have to be an email account at Seznam.cz), entering and confirming a password, year of birth, selecting a gender and confirming the terms and conditions of service, you will get one account for everything from Seznam.cz. The user account can be used across Seznam.cz servers. However, for technical reasons, individual servers may require additional logins from a logged-in user. Similarly, users may be asked to agree to specific terms and conditions for a particular service and, in the case of disclosure of personal data, to give specific consent to its processing. We handle additional data for each service (data beyond the common registration data, e.g. the address of a property you are selling on the Sreality.cz server) in such a way that no service other than the one to which you have provided the data can access it without your additional consent. Similarly, the data controller of another service or anyone else who is not authorized to work with this data does not have access to it. The legal basis for the processing of personal data in this case is the performance of the contract between Seznam.cz and you.

Online forms:

This is a record of the data entered in forms and fields within our services, e.g. a property listing on Sreality.cz. The data is processed on the basis of the performance of the contract in order to provide the requested service to the extent and scope defined by each of them. However, always in accordance with the facts stated in the contractual conditions and in the information on the principles of processing personal data, if they are collected within the service.For a complete list of data collected, please refer to each service; here we give only a general answer. The data is processed for the purpose of fulfilment or conclusion of a service obligation to you.

Communication with the service administrator:

At Seznam.cz, we communicate openly – both internally and externally, with our business partners and individual service users. That is why, in addition to general technical support, many of our services offer a separate communication channel to address your questions and comments. If we process your personal data (whether from a completed form, sent by email or communicated in a phone call or online chat), we always base our processing on the legal basis of the performance of a contract. In this case, your personal data is processed for the purpose of processing your request and is archived after the request has been fulfilled within the specified time limits (e.g. for the continuation of the communication or to follow-up on its progress).

Personal data necessary for delivery of a service:

The processing of your personal data is necessary to ensure the functionality of the selected services. For example, if you want to plan a route with Mapy.cz and be guided to your chosen destination, this cannot be done without identifying your location via GPS coordinates, as the service cannot function without tracking your current location. It is your choice to allow us to use this information. We will process this data on the basis of the legal title of performance of the contract. The processing of the data will then take place for the fulfilment or conclusion of the resulting service obligation towards you.

Installation data of our services:

Before mobile apps came along, users would use most of our services without having to physically install anything on their end device. Nowadays, selected desktop services such as the internet browser (Seznam.cz browser) and all of the mobile services of Seznam.cz do not run without downloading the corresponding application. In this case, we work with data in the form of a unique code of the installation instance (if any), the IP address of the end device and cookies and information about how the data is used. We do this in accordance with the legal requirements in the form of the performance of a contract and in order to ensure the functionality of the service you have chosen. We do not handle specific data (content) generated by your activity within the service. We do not use the data collected beyond the fulfilment of this commitment (i.e. the processing is not carried out to achieve other purposes). The processing of the data is carried out for the fulfilment or conclusion of a service obligation to you.

Your explicit consent to our service:

Beyond the services we provide to bring you information, digital content and tools for dealing with a range of common situations (buying and selling property, cars or used goods, etc.), we have the opportunity to establish closer contact with you. This can be done by involving you directly in Seznam.cz activities, by sending our marketing and sales messages, or by personalising the content of our services and advertising messages. However, this is always on the basis of a legal requirement in the form of consent to the processing of personal data and under the conditions set out in the Regulation.

Data we collect through your activity within Seznam.cz services:

Seznam.cz (including our imedia.cz domain) does not collect, store or share end-user information, including IP addresses, unique user identifiers or personally identifiable information collected on our sites or applications, or on the sites and applications of our affiliated partners, without prior consent.

Online identifiers:

Cookies and other online identifiers are among the most discussed in relation to the Regulation. These are short text files that are created by the website you visit and stored on your device via your browser. Cookies primarily contain information about the settings related to the website you have visited (e.g., your chosen language, login information or your preferences within the website you have visited). When you return to the website, your browser will return the identifiers it has associated with the website. Through this, the page retains your settings. Cookies can only be stored if you allow it. We use different types of cookies to operate our services, which you can view and manage in your browser.

There are three basic categories of cookies: advertising, identification and technical. Each service sets these on its own. For example, WeatherLocality cookies are used to remember your location in the weather box on our homepage, sznRenderingMode cookies indicate whether the browser is able to render the entire JavaScript without errors.

Data about the devices which you use to access our service:

Whether you use a desktop, smartphone, tablet or combine devices according to your current needs, you prefer a predictable environment. At Seznam.cz, we always want to deliver a service developed for the specific type and operating system of the end device. To do this, we need to know which device the service has to deal with. In practice, this means what operating system our graphics are to be rendered for, what browser they will be displayed through, the device “privacy policy” settings, what IP address the device is accessing our service from, what language and time zone the device is in, etc. Equally important for us are reports about “system crash” events and other general activities.

Data from websites and services that use our services:

Seznam.cz operates a number of services, including the Sklik advertising system. It enables us to display advertising in search results on Seznam.cz and on the most visited websites on the Czech internet. We may also collect data from third-party websites and applications that use our advertising system. Basically, we collect data about the page you visit and how you use it. This information enables us to deliver significantly more relevant advertising messages, which thereby reduces the level of unsolicited advertising and thus noticeably improves the user experience when visiting websites. Unless you give us your explicit consent, we do not link the data we collect to specific user accounts, so it remains completely anonymized.

Data from fan pages on social networks:

We have social media buttons and tools on our services for the following platforms: Facebook, Instagram, LinkedIn, Twitter, Flickr, Youtube and Pinterest. We never process personal and other data of visitors to fan pages other than as permitted by the settings of the individual social networks or for the purposes to which the user has consented.

The individual users or the operator of the social network in question are primarily responsible for the user-generated content on Seznam fan pages (e.g. comments on articles); however, if you send us a notice of objectionable content in such posts, we will deal with it appropriately.

Within our fan pages, we only collect the data about you that is provided to us by the relevant social network or by you personally if you comment on or tag one of our articles or content or send us a message. We do not consolidate your data in any way with the data from your profiles on the network in question, except when we visit your LinkedIn profile to see if your job profile posted by you on that network matches our requirements.

Privacy policies of social network platforms

Information on how your personal data is collected and used by the respective social network operator can be found here:

• Facebook
• Instagram
• LinkedIn
• Twitter
• Youtube
• Flickr
• Pinterest

Legal basis and purposes of personal data processing

Seznam.cz services process personal data exclusively only for the purpose of achieving one of the legal titles listed below:

Legal titles for the processing of personal data

Contract fulfilment

We will use this legal title in a situation where the processing of personal data is carried out for the purpose of entering into, performance or termination of a contractual relationship between you and Seznam.cz. It applies when you, as a user, actively request a particular service. In addition to a conventional establishment of a contractual relationship in the form of a contract, this also includes other activities carried out for the benefit of using a particular service, including typing a URL into your browser in order to access a particular service. Processing under this legal title is carried out solely for the purpose of fulfilling or concluding a contractual obligation. We will not process your personal data for other purposes without your consent. Examples include the processing of data to identify you prior to the actual conclusion of the contract, data necessary for billing (if monetary payment for the provision of the service applies) or data necessary for the actual provision of the service (e.g. processing of your location data if you want to use the navigation within the Mapy.cz service).

Legitimate interest

If the conditions below are met, the Regulation gives us the possibility to base the processing of your personal data on our own, subjectively determined interest. In order for us to do so, we must inform you of your right to object to the processing carried out and the right to erasure, as well as assess the legitimacy. We must define the legitimate interest (in accordance with the law), it must be shown to be necessary to achieve the stated aim, it must pass the ‘balancing test’ (weighing our interests against your interests and risks), and it must be genuine and relevant to the time and type of processing. Activities to exercise freedom of expression, to protect services from misuse (including fraud prevention), to enforce debts and legal claims in general, direct marketing, steps to ensure the security of networks and information or processing for the purpose of reporting suspicions of criminal offences commonly meet the category of legitimate interest.

Consent to processing

By consenting, you give us permission to process your personal data. Its form is precisely defined in the Regulation. It is our responsibility to prove that consent has been given (or who, when, how and for what purpose). Simply put, we will rely on this legal title whenever you consent to the processing of personal data. We will provide you with the request for consent to the processing of personal data separately from other rules and policies (e.g. the general terms and conditions of Seznam.cz or the terms and conditions of the service in question). We will also mention your right to revoke your consent. Specific conditions are applicable to a child’s consent in connection with information society services. Currently, Seznam.cz does not provide any service that is directly intended for and targeted at children under 16. In the case of the Lidé.cz service, the terms and conditions have been changed so that users under 16 will not be able to access this service.

Statutory compliance

If the processing of your personal data is required under specific national or European legislation, we are obliged to process your personal data. In these cases, we are in a position to choose to comply or not with the authorities’ request (specified obligation). Examples include processing due to obligations imposed by the tax authority or in response to a court order regarding the collection and transfer of specific data to law enforcement authorities.

Purposes of personal data processing

We use the collected personal data to fulfil a specific, explicit and legitimate purpose. We define the purpose before the collection begins and inform you about it transparently. It is in our own interest that you always know for which purpose we process your personal data.

As part of our services, we process your personal data for the following purposes:

•  To provide a service.
•  To identify the contracting party before the conclusion of the contract.
•  To fulfil a legal obligation.
•  To personalise the services provided to give you the greatest added value.
•  To understand how you use our services in order to give you the best user experience.
•  To develop new services based on usage patterns and user behaviour.
•  To improve and enhance our services.
•  To measure traffic to our websites.
•  To keep our services secure and safe and to protect against abuse.
•  For direct marketing of our services.
•  To collect arrears and pursue claims for damages.
•  To communicate with you.
•  To evaluate the satisfaction of our users.

More information about the specific purposes of data processing can be found for each specific service in the menu on the left, with a description of how the service processes data.

Storing personal data

Our approach to the personal data we collect is simple: if we cannot avoid collecting personal data, we do not keep it for longer than is necessary to achieve the purposes for which it was collected. In addition, where possible, we proceed to anonymise or pseudonymise the data. This approach is consistent with the principle of storage limitation, which requires us to delete or anonymise personal data when we no longer need it to fulfil the purpose for which it was collected. By actively anonymising, we comply with the principles of purpose limitation (not to process personal data for purposes other than those for which it was collected) and processing minimisation (to process only the data necessary to achieve the stated purpose). This is of course performed with exceptions in the form of obligations determined by the legislation of the Czech Republic.

We are also straightforward in the case of a procedural setup of access to stored personal data: only the service which collected the data (in the case of a service, if the conditions for further data processing defined by the Regulation are met) and a Seznam.cz employee who is authorized to handle personal data, with a full audit trail and under a signed NDA, have access to the data.

The period of storage of personal data varies, subject to the above and depending on the chosen legal title. Specific information on storage periods can be found directly under the description of the processing of personal data for each service here.

Restrictions on the processing of personal data

In addition to the fact that we must keep personal data only for the time necessary to achieve the purpose of its processing, the Regulation gives you the right to restrict its processing in predefined situations:

• If you believe that the information we have is not accurate.
• If you consider the processing to be unlawful (but do not insist on erasure of the data).
• If you require the data to establish, exercise or defend your own legal claims.
• If you object to the processing of your personal data.

Apart from the storage of your personal data and subject to the exceptions to processing set out in the Regulation (including for the establishment, exercise or defence of legal claims or for reasons of important public interest of the Union), we will not process your personal data further.

Notification of changes

It is in our own interest to keep you informed of changes that occur within each service that may affect the form, scope or purpose of the processing of your personal data. We approach the notification of changes to our Privacy Policy based on an assessment of the practical impact. However, we always do so in a transparent and user-friendly manner. While for minor changes we choose to invite you to reconfirm the terms and conditions for processing personal data, for more substantial changes we proceed to a more general information campaign to explain the planned changes. In general, you may encounter the following communication channels: email; serving the information at the moment of logging in to the service (with an explanation of the changes made and the possibility to agree to them before further use); publication on the GDPR microsite or on the page of the service concerned; and in selected cases, by means of a general communication (general information campaign).

Data sharing

Given our specific position in the digital marketplace and our established ecosystem of proprietary services, we have never felt the need to share our users’ data, especially personal data, with anyone in the marketplace. Advertising systems, which we address on a separate page, are the only exception. We only provide the data and information we collect to our clients and users, at a level of detail and individually. We then allow each user to see what is happening within their own account on Seznam.cz. We use third parties to process selected agendas (e.g. for datacenter management or network connectivity), but always on the basis of clearly defined rights and obligations within a contractual relationship. We may, however, be compelled to share data upon an official, legally based request from a supervisory authority (ÚOOÚ) or other national or EU official body.

Transfers of personal data to third countries

The digital world is a global world where collaboration and the ability to use interesting services is easier than in many other industries. For our Zboží.cz platform, we decided to use the solution of the US company Mailgun for our emailing campaigns. For more information on the processing of personal data, please see the section dedicated to the Zboží.cz service here. Other Seznam.cz services do not transfer any data to third countries.

Cooperation with regulation and oversight authorities

The online domain not only opens a whole range of opportunities, but also gives room for some negative phenomena. In order to ensure a safe digital environment for our users, we communicate openly with regulators and other official bodies on a range of issues. In addition, we are obliged to act in this respect by the legislation in force. Thus, in the event of a legally substantiated request from an authority, we are obliged to store, share or display (within the scope and timeframe defined by a specific legal act) specific personal data. The Regulation also obliges us to cooperate with the regulator (ÚOOÚ) and assist it with the discharge of its duties. However, we examine each request from the authorities. We also act in favour of the security of our contractors’ data, including protecting them from unauthorised requests.

Overview of your rights

Open communication is one of our corporate values here at Seznam.cz. Personal data protection is no exception. In light of this, here are your rights in this area directly derived from the Regulation:

• The right to confirmation that we are processing your personal data and that you have the right to access it.
  • You can find out what personal data we process about you in your User Profile.
• The right to rectification of processed personal data (rectification of inaccurate personal data or the right to supplement incomplete personal data); and the right to erasure under the conditions set out in the Regulation – this includes situations where the data is not necessary for the purposes for which it was collected or otherwise processed; withdrawal of consent to processing or objection to processing.
  • o You can correct your personal data simply in your User Profile
• The right to have your user profile and all related personal data we process about you erased.
  • You can make your application to have your User Profile erased using this form.
  • If you wish to be forgotten (erasure from full-text search), please follow these guidelines in our Help section.
• The right to restrict processing in the event that your personal data is outdated or that we process it unlawfully.
• The right to be informed of all rectifications, erasures and limitations of the processing of personal data; that is, except where this is not possible or would require a disproportionate effort on the part of Seznam.cz.
• The right to the portability of the personal data that you have provided to us in the course of using our services, in a structured, commonly used and machine-readable format; you also have the right to transfer this data to another controller if the processing is based on consent or contract or if the processing is carried out by automated means; in accordance with the Regulation, we also wish to inform you that your right to the portability of your personal data must not adversely affect the rights and freedoms of other persons. In the data we provide you in this way, you will only find data from those services that record data about you. It is therefore always possible that you use a service but that service does not collect any data about you or that the data is completely anonymous. This is the case even if you consent to the use of your personal data.
  • You can make your application to claim your personal data using this form.
• The right to object to processing of personal data which is carried out in the public interest or is necessary for the purposes of the legitimate interest of the controller, including profiling based on such processing. The right to object at any time to the processing of personal data for direct marketing purposes also falls within this definition.
  • You can opt-out in any marketing communication we send you by unsubscribing via the link in the footer of the text.
• You also have the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects on you or similarly significantly affect you.
  • Seznam does not currently make any decisions based on automated processing.

Operation of Seznam.cz services

Seznam.cz operates almost 30 digital services. Some of them do not require registration, others either require it directly (it is not possible to use the service without registration at all, e.g. email.cz), or users can unlock some of the additional functionality after registration (e.g. navigation in Mapy.cz).

If a certain type of processing of personal data will result in a high risk to your rights and freedoms, we will assess the impact on the protection of your personal data before processing. This would apply in cases of the systematic and large-scale evaluation of personal data that would have legal effects in relation to you. We do not currently process your personal data to the extent and in the way that would meet the above requirement.

Managing your personal data

The most user-friendly way to manage your data is through a Profile, if the service uses one. Once logged in, you can manage, view or delete your data or your whole account, subject to legal obligations. Deleting your account will delete all stored content. In order to prevent accidental deletion of data, the account will be blocked for a period of 14 days after the request for deletion is made. After this period, the account will be completely deleted.

Termination of use of our services

It is your call as to how long you use Seznam.cz services. From the point of view of data processing and privacy, the following applies: if there is no legal reason for the further storage of your personal data, the data will be completely deleted from our servers. We will delete the data in a way that prevents its future recovery and therefore any further use by Seznam.cz (subject to the above restriction). The regulation gives you the right to the portability of the personal data you have provided to us in the course of using our services. This is in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller.

Keeping personal data secure

The data security of our partners and users is our priority here at Seznam.cz. As a data controller, we guarantee appropriate technical, procedural and organisational measures to ensure a level of security appropriate to the risk.

In particular, the following:

•  our organisational structure and internal rules are in compliance with data protection requirements;
•  we have a sophisticated system of access rights and verification of their effectiveness to prevent unauthorised access;
•  we process personal data in systems developed for the needs of our services directly at Seznam.cz;
•  we regularly back up personal data and use technology to keep it safe and secure in accordance with existing security trends;
•  we have taken procedural and technical measures against data theft;
•  we pseudonymise, encrypt or anonymise personal data according to the type and necessity of processing;
•  we also generally apply the principle of keeping the processing of personal data to the minimum;
•  we have measures in place to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; we have processes and tools to restore timely availability and access to personal data in the event of a physical or technical incident;
•  we regularly test, evaluate and assess the effectiveness of technical and organisational measures to ensure the security of processing;
•  we monitor and archive all accesses to processed personal data;
•  last but not least, we store the data in our own or own-operated data centres. We are therefore in full control of the data and use the latest technology to manage it.

We contractually require all entities that are in the position of a personal data controller or processor in relation to Seznam.cz to follow appropriate policies and give us adequate guarantees.

Notifying incidents of personal data security breaches/leaks:

If a personal data breach occurs and the nature and extent of the breach is likely to result in a high risk to the rights and freedoms of natural persons, we will notify you immediately. In the notification, we will describe the nature of the personal data breach in a clear and understandable manner and provide you with at least the following information:

• the name and contact details of the Data Protection Officer
• a description of the likely consequences of the data breach
• a description of the measures taken or proposed to address the situation

We will not take the above steps if the measures in place render the personal data compromised incomprehensible (anonymisation of personal data, encryption), if we have taken such measures that the risk to your rights and freedoms is unlikely to materialize and if this would require disproportionate effort. In such a case, we will proceed to inform you in the form of a public notice or similar measure in accordance with the Regulation.

We are here to answer your questions

We know that the new Regulation raises questions for everyone involved. Please do not hesitate to contact one of the email addresses below if you are unclear about the processing of your personal data. You can also contact our Data Protection Officer or contact your sales rep. We are committed to paying due attention to all of your enquiries.

Contact:

If you have any questions about data protection or would like to send us any suggestions in this area, please use the following email address ochranaudaju@firma.seznam.cz

Data Protection Officer: Lenka Ernestová (dpo@firma.seznam.cz)