1. Data Controller Information

Data Controller:
VESLA s.r.o.
Průmyslová 387, 530 03 Pardubice
Company ID: 261 91 644
Tel.: +420 604 260 023
E-mail: hr@vesla.cz

The Controller has not appointed a joint controller or representative.
No Data Protection Officer has been appointed.

Personal data may be shared, to the necessary extent, with the parent company Unitron NV within the group for management, administration, and compliance with legal and contractual obligations.
 

2. Processing of Personal Data Obtained Directly from Data Subjects (Art. 13 GDPR)

Employees

Processing: Payroll Administration
Purpose: Processing of salaries, taxes, social and health insurance, enforcement orders, sick leave
Legal Basis: Compliance with legal obligations of the controller
Recipients / Categories of Recipients: State administration authorities (social security administration, health insurance companies, tax authorities, bailiffs, courts, Czech Police)

Processing: Human Resources
Purpose: HR administration, employee evaluation, records of working hours and production operations
Legal Basis: Contractual relationships; compliance with legal obligations; legitimate interests of the controller
Recipients / Categories of Recipients: Parent company; IT service providers; occupational health service providers

Processing: Operations
Purpose: Asset records and management, occupational health and safety
Legal Basis: Contractual relationships; compliance with legal obligations; legitimate interests of the controller
Recipients / Categories of Recipients: Parent company; IT service providers; service suppliers

Processing: CCTV System
Purpose: Protection of property and persons, prevention and detection of unlawful conduct
Legal Basis: Legitimate interests of the controller; compliance with employer legal obligations
Recipients / Categories of Recipients: Managing director, authorized persons of the controller; Czech Police (where lawful)

Job Applicants

Processing: Human Resources
Purpose: Recruitment and selection of employees
Legal Basis: Legitimate interests of the controller
Recipients: Parent company

Customers

Processing: Accounting
Purpose: Bookkeeping and accounting
Legal Basis: Contractual relationships; compliance with legal obligations
Recipients: Parent company

Processing: Sales and Marketing
Purpose: Offering goods and services, execution of sales
Legal Basis: Contractual relationships; legitimate interests of the controller; where applicable, consent
Recipients: Parent company

Processing: Website
Purpose: Website traffic analytics
Legal Basis: Consent of the data subject (through cookie settings on the website)
Recipients: Service providers

Suppliers

Processing: Purchasing
Purpose: Requests and purchase of goods and services
Legal Basis: Contractual relationships; legitimate interests of the controller
Recipients: None

Processing: Accounting
Purpose: Bookkeeping and accounting
Legal Basis: Contractual relationships; compliance with legal obligations
Recipients: Parent company

Processing: Operations
Purpose: Occupational health and safety, asset management
Legal Basis: Legitimate interests of the controller
Recipients: Service suppliers
 

3. Processing of Personal Data Obtained from Other Sources (Art. 14 GDPR)

Job Applicants

Processing: Human Resources
Purpose: Recruitment and selection of employees
Legal Basis: Legitimate interests of the controller
Source of Personal Data: Recruitment agencies, publicly or contractually available databases
Recipients: Parent company

Processing: Sales and Marketing
Purpose: Offering goods and services, establishing business communication
Legal Basis: Legitimate interests of the controller, consent
Source of Personal Data: Publicly available or contractually accessible sources (internet, business databases, references)
Recipients: None

Processing: Purchasing
Purpose: Purchase of goods
Legal Basis: Legitimate interests of the controller
Source of Personal Data: Publicly available or contractually accessible sources (internet, business databases, references)
Recipients: None

4. Categories of Processed Personal Data

We mainly process:
• identification data (e.g. first name, surname),
• address data,
• contact details,
• descriptive data.

Special categories of personal data (Art. 9 GDPR) are processed only within payroll administration, especially to the necessary extent related to health fitness or disability.
 

5. Retention Period of Personal Data

Personal data is retained:
• for the period required by the legal regulations of the Czech Republic,
• or for the period necessary to fulfill the purpose of processing.

Specific retention periods are governed by the company’s Filing and Retention Policy.

For the CCTV system, the standard retention period is 7 days (automatic overwrite); incident recordings are stored for the period necessary to resolve the incident.
 

6. Transfer to Third  Countries and Automated Decision-Making

The Controller does not transfer personal data to third countries or international organizations.

No automated decision-making or profiling takes place during the processing of personal data.
 

7. Rights of Data Subjects

Data subjects have the right:
• to access personal data,
• to correct inaccurate data,
• to erasure (“right to be forgotten”),
• to restriction of processing,
• to object to processing,
• to data portability,
• to lodge a complaint with the supervisory authority.

If processing is based on consent, consent may be withdrawn at any time.
 

8. Final Provisions

This information is made available to employees through the company intranet and to other data subjects through the company website or during the first communication.