INFORMATION ON PROCESSING OF PERSONAL DATA FOR ORDERING AND PROVIDING DISTRIBUTION OF HUMAN TISSUES AND CELLS

Dear clients,
let us inform you in accordance with Regulation of the European Parliament and of the Council (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and the instruction of data subjects (hereinafter referred to as “General Regulation”) how the companies CTshipper, s.r.o., ID 281 24 162, based in Kostelní 292/9, Holešovice, 170 00 Praha 7, registered in the commercial register kept at the Municipal Court in Prague, cection C, insert 69070 (hereinafter referred to as “CTshipper”), GENNET, s.r.o., ID: 27080234, based in Praha 7, Kostelní 9/292, ZIP 170 00, Czech Republic, registered in the commercial register kept at the Municipal Court in Prague, cection C, insert 94758 (hereinafter referred to as „GENNET“) and CITY FERTILITY LIMITED, ID: 07378003, based in 16 St. John Street, London, EC1M 4NT, United Kingdom of Great Britain and Northern Ireland (hereinafter referred to as „CFL“) as joint data controllers (hereinafter referred to as “controllers”) process your personal data and on the rights and obligations associated with it.

Personal information is considered to be all information about an identified or identifiable natural person (also referred to as „data subject“); an identifiable natural person is a natural person that can be identified directly or indirectly, in particular by reference to a particular identifier such as name, identification number, location data, network identifier or one or several specific physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.

1. Scope and purpose of processing personal data

The controllers process personal data to the extent in which the data was provided to them by the data subject in connection with the order for the transport and delivery of human tissues and cells (hereinafter referred to as „distribution“) in accordance with Act No. 296/2008 Coll., On Human Tissues and Cells and its implementing regulations. The controllers process personal data in accordance with the valid and generally binding legal regulations.

Your personal data is processed for the following purposes:

  • to assess which distributor will be in charge of the distribution and shall contact you (due to pre-contractual arrangements and performance of the contract with you);
  • provision to the strictly necessary extent for legal, economic and tax advisors as well as auditors for the purpose of providing advisory services to the controller.

2. Sources of personal data

The controllers process personal data obtained directly from the data subject in connection with ordering of the distribution.

3. Categories of personal data and category of data subject

The following categories of personal data are subject to processing:

  • address and identification data used for clear and unambiguous identification of the data subjects, such as name, surname, date of birth, address of permanent residence and others;
  • contact details such as contact address, phone number, e-mail address and others;
  • other details, such as the place of storage of the cells or the additional data provided by the data subject in the order;

Data subjects whose data is processed by the data controllers and to whom this information is addressed are clients or potential clients interested in distribution.

4. Method of processing and protection of personal data

Controllers operate by mutual agreement the website http://ctshipper.eu and the e-mail address info@ctshipper.eu in order to receive orders for distribution. Data that is transmitted to the controllers is evaluated by CTshipper and in clear cases forwarded directly to one of the controllers. In more complicated cases the data is evaluated jointly by CTshipper and GENNET in order to select the most appropriate method of distribution and delivery to the relevant controller.

The controller who will carry out the distribution will contact you directly after the order is received. In some situations, multiple controllers can participate in the distribution than just the one who contacted you. You will be informed about this in the course of distribution.

Once the controllers determine who is in charge of the distribution, they all process your personal data separately, for other purposes and to a greater extent than arising from this information. For more detailed information on the processing of personal data regarding distribution that is carried out by individual controllers, please refer to the following links:

The processing is carried out manually in paper form and electronic form or is automatized by computer technology. It is subject to all security policies for administration and processing of personal data. To this end, technical and organizational measures were taken by the controllers, in particular measures to ensure that unauthorized or accidental access to personal data, its alteration, destruction or loss, unauthorized transmission, unauthorized processing and other misuse of such personal data is impossible. All entities to whom personal data may be made available respect the rights to privacy of the data subjects and are required to comply with applicable data protection law.

5. Processing time of personal data

The controllers shall process the personal data for the time necessary for the given purpose, at least for the time that is necessary for the decision about the order, and in accordance with the time limits specified in the relevant generally binding legal regulations for shredding and archiving of documents.

6. Categories of recipients of personal data

Recipients of personal data of data subjects are:

  • processors on the basis of a contract with the controller within the scope of the data needed for the purpose of the processing, e.g. companies managing the information systems of the controllers, employees in charge of data storage and archiving, persons responsible for the operation of the websites and others;
  • persons providing legal advice;
  • state authorities in the course of fulfilling legal obligations laid down under relevant legislation.

7. Instructions on the rights of data subjects

You are entitled to the following from the data controllers:

  • require access to personal data processed by the controllers, which means the right to obtain a confirmation from the controllers that the personal data concerning you is processed or not, and if so, you have the right to access this personal data and other information referred to in Article 15 of the General Regulation,
  • require the correction of your personal data that is processed if it is inaccurate. Taking into account the purposes of processing, you may in some cases also require the addition of incomplete personal data,
  • require the deletion of personal data in cases covered by Article 17 of the General Regulation,
  • require restrictions on the processing of data in cases covered by Article 18 of the General Regulation,
  • obtain personal data relating to you that is processed automatically for the performance of a contract concluded with you in a structured, commonly used and machine-readable form. In addition, you have the right to request that the controllers forward that information to another controller; under the conditions and restrictions listed in Article 20 of the General Regulation and
  • you have the right to object to processing within the meaning of Article 21 of the General Regulation on grounds relating to your particular situation.

You can claim your rights from any controller. Controllers have agreed that your request will always be handled by the controller who processes the personal data to which the request relates. Therefore, if you submit a request to a controller who does not process your personal data or your request will concern the processing performed by another controller, the controllers will hand over your request. For instance, you submit a request to GENNET for personal data processing during distribution, but the distribution is performed by CFL - therefore, GENNET will forward your request to CFL and CFL shall respond to your request.

If we receive your request, we will inform you of the measures taken without undue delay and in any case within one month of receipt of the request. This deadline can be extended by another two months if necessary and in view of the complexity and number of applications. In certain cases specified in the General Regulation, controllers are not required to comply with the request in whole or in part. This will be the case in particular if the application is clearly unreasonable or inappropriate, especially because it is repeated. In such cases, we may (i) impose a reasonable fee that takes into account the administrative costs associated with the provision of the required information or communication or the performance of the requested action; or (ii) refuse to comply with the request.

If we receive the above request, but we will have reasonable doubt as to the identity of the applicant, we may ask them to provide additional information necessary to confirm their identity.

In addition, you have the right to contact the responsible supervisory authority directly if you believe that personal data is not processed in accordance with legal regulations, either in the place of your habitual residence, place of employment, or the place where the alleged violation took place. If you suffered damage other than damage to property as a result of the processing of your personal data, you shall make a claim under a special law.

We also inform you that the controllers appointed a data protection officer. Contact details of the data protection officer of CTshipper, GENNET and CFL: Ing. Anna Mityashina, Na Poříčí 1047/26, 110 00 Praha 1, e-mail: dpo@akdap.cz.