GDPR

Identification of the personal data controller

MIRAKULUM s.r.o.

Nad Perchtou 1631, 511 01 Turnov, Czech Republic

Park Mirakulum, Topolová 629, Milovice 289 24, Czech Republic

How and what personal data do we collect?

We process your personal data in the following extent:

• Personnel and wage agenda
• Fulfilment of statutory obligations, calculation of wages
• Accounting services
• Keeping of economic agendas
• Operation
• (Administration, reviews, OSH, PPE)
• Records and asset management
• Ticket sales – treasures
• Without any records
• Injury records
• Fulfilment of park manager duties
• Suppliers – purchasing of services
• Ensuring the operation of the amusement park

Detailed information is available from the personal data controller specifying:

• Subjects whose personal data we keep
• Sources of personal data from which we record personal data
• What personal data we collect, particularly:
  
  • identification data
  • address data
  • descriptive data
• Areas of processing / subjects / lawfulness / recipients of personal data / retention periods

If data is provided on behalf of others, you must ensure that they first read our Privacy Policy.

We do not request data from persons under the age of 13. Please do not provide any of your personal data unless you have the consent of your parents or legal guardians. Please help us keep your information up to date – tell us if your contact details or your preferred method of contact changes.

How your data may be used

Personal data can only be used in accordance with EU data protection law and must be justified on one of the legal grounds. Information is available from the personal data controller.

Compliance with mandatory requirements regarding your data

Compliance with our legal obligations relating to law enforcement, regulators and deliveries of court documents.

As a personal data controller, we are also subject to the laws of the Czech Republic and are obliged to comply with them.

These obligations include giving your data to law enforcement authorities, regulators and courts and other litigants in connection with proceedings or investigations anywhere in the world if we are required to do so.

When permitted, we will forward all such requests directly to you or inform you before we respond to them, unless the prevention or detection of crime is affected.

The provision of personal data for the purposes of complying with mandatory requirements relating to your data is a legal requirement that depends on the particular request.

Transfer to third persons

Personal data may be transferred to third persons if there is a legal ground for the transfer.

This particularly includes governmental organisations that have access to such data by law, as well as insurance companies in the event of an accident in the park, our contractual parties at the level of processors, or other controllers.

Information is available from the personal data controller.

Protection of websites

We work diligently with our subcontractors and business partners to ensure that physical, electronic and procedural safeguards are in place to protect your data in accordance with applicable data protection requirements.

All your data are stored on secure servers of our company, our subcontractors or business partners (or on secure physical media), and access to and use of your data is governed by our security policies and standards (or the equivalent standards of our subcontractors or business partners).

How do we secure your data?

We use a variety of security measures, including encryption and authentication tools, to help protect and preserve the security, integrity and availability of your data.

While there can be no guarantee that the transmission of data over the internet or the website will not be the target of cyber-attacks, we work diligently with our subcontractors and business partners to ensure that physical, electronic and procedural safeguards are in place to protect your data in accordance with applicable data protection requirements.

We use the following measures:

• Strictly restricted personal access to your data on a need-to-know basis and only for the purposes communication
• Transmission of collected data only in encrypted form
• Storage of highly confidential data – such as credit card information – only in encrypted form
• Installation of firewalls for IT systems to prevent unauthorised access, e.g., by hackers
• Permanent monitoring of access to IT systems to detect and stop misuse of personal data

If we have provided a password (or if you have chosen a password) that allows you to access certain parts of our website or any other portal, application or service that we operate, you are responsible for maintaining the confidentiality of that password and for following any other security procedures that we tell you about. We ask that you do not share the password with anyone.

How long do we store your data?

We only store your data for as long as necessary for the purpose for which we obtained them and for any other permitted related purposes (for example, if they are needed to defend a claim against us).

If the data are used for two purposes, we will keep them until the last period has expired, but we will stop using them for the purpose for which the shorter period has expired.

Access to your data is restricted to those who need to know them for a relevant purpose.

Our retention periods are based on business need and your data that are no longer required are either irreversibly anonymised (and anonymised data may be retained) or securely destroyed.

Use for customer support and marketing purposes:

Regarding your data used for customer support and marketing purposes, we may retain your data for this purpose for a period of time until revoked after the date on which we last received consent to offer you goods or services, or the date on which you last responded to our marketing communications (other than opting out of receiving further communications).

Use for order fulfilment, contests, etc.:

Regarding your data used for the performance of contractual obligations in relation to you, we may retain this data for as long as the contract remains in force, or as required by the Accounting Act.

If claims are being settled:

Regarding any data that we reasonably consider necessary for the defence or conduct of proceedings or claims against us or a third party, we may retain this data for as long as the claim can be settled.

Contacting our company, your data protection rights and your rights to complain to the data protection authority 

If you have any questions regarding our use of your data, please contact us at the following email address: gdpr@mirakulum.cz.

You have the right to:

• request that we provide additional information about the use of your data
• access your personal data and request a copy of the data you have provided 
• obtain the personal data relating to you that you have provided in a structured, commonly used, machine-readable format and, where technically feasible, you have the right to have the data transferred to another controller, without hindrance, where the processing of your data is based on your consent or a contract and is carried out by automated means
• request that we update any inaccuracies of the data we hold
• request that we delete any data that we can no longer process for lawful reasons
• if the processing is based on your consent, and in relation to any direct marketing, to withdraw your consent with effect for the future, to cease the specific processing
• object to any processing, including profiling, on the basis of legitimate interests in your particular situation, unless our reasons for the processing outweigh the detriment to your data protection rights
• request that we restrict how we use your data, such as during the investigation of a complaint

Your exercise of these rights is subject to certain exceptions for the purposes of protecting the public interest (e.g. preventing or detecting crime), our interests (e.g. preserving legal privileges) or the rights and freedoms of others. If you exercise any of these rights, we will review your authorisation and respond without undue delay no later than within one month. In complex cases, or if we receive a large number of requests, this period may be extended by a further two months, of which we will inform you.

If you are not satisfied with our use of your data or our response to the exercise of these rights, you may lodge a complaint with your data protection authority (https://www.uoou.cz/).