This Privacy Policy explains how FHS Czech Republic s.r.o. processes the personal data of clients, Portal users and other individuals whose data it obtains in connection with its services and benefits. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and applicable laws of the Czech Republic.
1. Controller and contact details
1.1. The controller is FHS Czech Republic s.r.o., with its registered office at Jankovcova 1569/2c, Holešovice, 170 00 Prague 7, Czech Republic, Company ID No. 287 41 862, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 316862 (“FHS” or “we”).
1.2. Contact: info@fhs-ea.com • +420 606 933 690 • Jankovcova 1569/2c, Holešovice, 170 00 Prague 7, Czech Republic
2. Personal data we process and where it comes from
2.1. Depending on how you use our services, we may process in particular: a) identification data (including your first name, surname, user identifier, business name, company ID and VAT ID, where relevant); b) contact details (email address, telephone number, delivery or billing address); c) membership, order, benefit, contract, payment and billing data; d) communications with us, including requests, complaints and records of consent given or withdrawn; e) technical data about your use of the Portal and membership card, including your IP address, device identifiers, browser type, operational logs, and cookies or similar technologies; f) data required to deliver a membership card or notifications through Apple Wallet, Google Wallet or another supported application.
2.2. We obtain data primarily from you, through your use of the Portal and our services, and in some cases from a club, employer, partner or other organisation arranging your membership or benefit. Where another organisation provides us with data, it must have an appropriate legal basis and comply with its own transparency obligations.
3. Purposes and legal bases
3.1. Performance of a contract and steps taken before entering into a contract – creating and administering an account or membership, providing benefits, processing orders and payments, and providing customer support (Article 6(1)(b) GDPR).
3.2. Compliance with legal obligations – in particular accounting, tax, record-keeping and any applicable regulatory obligations (Article 6(1)(c) GDPR).
3.3. Legitimate interests – protecting and securing the Portal, preventing fraud, operational analytics, improving our services, and establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).
3.4. Consent – personalised marketing communications, push notifications and optional analytics or marketing cookies (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Recipients of personal data
4.1. We disclose data only to the extent necessary. Recipients may include: a) FHS partners, clubs or other organisations where necessary to provide a particular benefit, product or service; b) providers of hosting, information systems, payment services, email and marketing tools, customer support and other technical services; c) operators of supported mobile wallets and related distribution platforms, in particular Apple and Google; d) professional advisers, auditors, insurers, courts, administrative authorities and other public bodies where required by law or necessary to protect our rights.
4.2. Some recipients act as processors on our instructions; others act as independent controllers. We will provide current information about categories of recipients on request.
5. Transfers outside the European Economic Area
5.1. Some technology providers may process data outside the European Economic Area. Where this occurs, we use appropriate safeguards under the GDPR, in particular a European Commission adequacy decision or Standard Contractual Clauses, together with supplementary security measures where required.
6. Retention periods
6.1. data required to perform a contract is retained for the duration of the contract and afterwards for as long as necessary to protect legal claims, normally for the applicable limitation periods;
6.2. accounting and tax records are retained for the periods required by law, normally 5 to 10 years;
6.3. data processed on the basis of consent is retained until consent is withdrawn or the period stated when consent was given expires; we review marketing consent regularly and do not rely on it for longer than 3 years without further interaction;
6.4. operational and security logs are normally retained for no longer than 12 months, unless a longer period is required to investigate a security incident or comply with a legal obligation.
6.5. At the end of the relevant period, we delete or anonymise the data unless further retention is required by law or to protect legal claims.
7. Cookies and similar technologies
7.1. We use strictly necessary cookies for the secure and proper operation of the Portal. Analytics and marketing cookies are used only with your consent. You may change your choices at any time through the cookie banner or Portal settings; further details are provided in the current cookie settings.
8. Requirement to provide data
8.1. You must provide data required to enter into or perform a contract or comply with a legal obligation if we are to provide the relevant service. Without it, we may be unable to create an account, process an order or deliver a benefit. Providing data for marketing and optional cookies is voluntary and does not affect your membership or access to benefits.
9. Automated decision-making
9.1. We do not carry out automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Offers may be personalised using your preferences or use of our services, but this does not produce such effects.
10. Your rights
10.1. Subject to the conditions in the GDPR, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You may withdraw consent at any time. You can exercise your rights at info@fhs-ea.com; we may reasonably verify your identity before responding.
11. Complaint to a supervisory authority
11.1. You have the right to lodge a complaint with the Office for Personal Data Protection of the Czech Republic, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz. We would appreciate the opportunity to address your concern first.
12. Changes to this policy
12.1. We may update this Privacy Policy from time to time. We will publish the current version on the Portal and inform you of material changes in an appropriate manner.