Privacy Policy

At Up Česká republika s.r.o., Company ID No. 62913671, with its registered office at Zelený pruh 1560/99, 140 00 Prague 4, Czech Republic (hereinafter referred to as “Up Benefity” or “we”), we place great importance on the protection of personal data.

This document explains what personal data we process about you, whether we process your data based on your consent or another legal basis, the purposes for which we use your personal data, with whom we may share it, and the rights you have in connection with the processing of your personal data.

A. Who determines how your personal data is processed?

At Up Benefity, we determine the purposes and means of processing your personal data. This includes, in particular, collecting, recording, organizing, and, where applicable, disclosing your personal data. We are also responsible for ensuring that your personal data is processed properly and in accordance with applicable laws.

We perform this role in our capacity as the data controller, as we communicate with you and organize or participate in various events during which we may process your personal data. We also operate the website www.upcz.cz (the “Website”), through which we offer our customers products and services in the field of employee and other benefits. In doing so, we exercise control over the processing of your personal data.

We are responsible for the processing of your personal data, and you may exercise your rights relating to such processing with us. These rights arise from your status as a data subject and are described in more detail in Section I – “What are your rights regarding the processing of your personal data?”

You may also contact us at any time with questions regarding the processing of your personal data using the contact methods described in Section J – “How can you exercise your rights?”

Other parties, including data controllers and data processors, may also be involved in the processing of your personal data. These parties are identified in Section F – “Who processes your personal data, and with whom do we share it?”

B. What personal data do we process?

It is important to us that you understand how and for what purposes we process your personal data. In the following section, we explain what types of personal data we process, along with examples.

a) Contact Information

This primarily includes your mailing address, phone number, email address, or your contact details on online platforms. We need this information to communicate with you effectively. We process these contact details when you use the contact form available on our Website.

b) Identification Information

This primarily includes your first name, last name, the name of the company you represent, and your job title or position within that company. We process this information when you use the contact form available on our Website.

c) Information About Your Activity on the Website

When you use the internet and browse our Website, your device automatically transmits its IP address. This enables us to identify the network and subnet to which your device is connected.

For security purposes, we also maintain logs that record information about your activity on our Website. These logs may include the duration of your visit, the actions you perform on the Website, how you navigate through the Website, your scrolling behavior, and information entered into web forms.

To ensure that our Website is displayed correctly, we also process information about your operating system (such as Windows, macOS, Android, or iOS), its version, and technical information about the devices you use to access the Website (for example, the type of smartphone you use).

This category also includes information collected through cookies and similar technologies used to identify your device. For more information, please refer to Section D – “Use of Cookies and Other Technologies for Processing Your Personal Data.”

d) Geolocation Information

This includes information that identifies the precise GPS coordinates or street address of a specific location. Based on the IP address of the device you use to access our Website, we determine your approximate location so that we can provide you with information about our products and services available near you.

e) Information from Online Platforms

As part of our marketing activities, we work with online platforms such as LinkedIn. For more information, please refer to Section D – “Use of Cookies and Other Technologies for Processing Your Personal Data” and Section G – “Transfer of Your Personal Data Outside the Member States of the European Economic Area.”

f) Photographs and Video Recordings

This may include photographs and video recordings of you, particularly those capturing your likeness and, where applicable, your voice.

g) Information About Our Communications

This primarily includes information such as the date (and, where applicable, the time) of our communication, the reason for the communication, and whether the communication was initiated by you or by us.

It may also include records of our communications, such as recordings of telephone calls or written records if you use our chatbot or send us an email. This applies to communications through all available channels, including telephone, chat, postal mail, and email.

h) Information You Provide Through Forms

This primarily includes the inquiries, requests, and questions you submit through our forms.

C. Sources of Personal Data

The personal data we process is obtained primarily from you. It is collected mainly through your use of our Website and through our communications with you.

We also obtain additional personal data in the course of our business activities. This primarily includes information derived from the personal data you have provided to us.

D. Why do we process your personal data, and what is our legal basis for doing so?

If you communicate with us through various channels, including email, chat tools, and online platforms, we process your personal data based on our legitimate interest (without requiring your consent) for the following purposes:

a) Internal Record-Keeping and Protection of Our Rights and Interests

We process the personal data described in Section B, items a, b, c, d, e, and g based on our legitimate interest. This processing is necessary to protect our rights and legitimate interests, including the establishment, exercise, or defense of legal claims.

Specifically, we process your personal data to maintain our internal records, including records of your requests, and to monitor the proper delivery of our products, services, and customer support.

For this purpose, we retain your personal data for no longer than the applicable statutory limitation period, including any period during which that limitation period is suspended or interrupted, but typically for no longer than five (5) years.

If judicial, administrative, or other legal proceedings are initiated, we will continue to process your personal data, to the extent necessary, for the duration of such proceedings in order to establish, exercise, or defend our legal claims.

b) Handling Your Requests and Inquiries

We process your personal data based on our legitimate interest in responding to your requests or inquiries, particularly those submitted through the contact form on our Website. In this case, we process your personal data for the time necessary to handle your request or inquiry and for one additional year to address any follow-up questions.

If your request or inquiry relates to the conclusion of a contract, we process the above personal data as part of the steps necessary to enter into that contract. In such cases, we retain your personal data only for the period required to complete those pre-contractual steps.

For these purposes, we process the categories of personal data described in Section B, items a, b, c, e, g, and h, based on our legitimate interest or, where applicable, because the processing is necessary to take steps at your request prior to entering into a contract.

Where cookies are processed for these purposes, they are retained until they expire or are deleted from your device.

c) Improving Our Services

We process the personal data described in Section B, items a, b, c, e, and g based on our legitimate interest in improving our products and services.

For this purpose, we retain your personal data for no longer than two (2) years from the date it is collected. Where cookies are processed for this purpose, they are retained until they expire or are deleted from your device.

d) Promoting Up Benefity

In selected cases, we may process the personal data described in Section B, item f for the purpose of promoting Up Benefity. This typically applies when you attend an event where photographs or video recordings of participants may be taken.

We process this personal data based on our legitimate interest in promoting our company, for example, on our Website or on online platforms, particularly LinkedIn.

We may actively use your personal data for these purposes for no longer than three (3) years following the date of the event.

E. Use of Cookies and Other Technologies for Processing Your Personal Data

• This Website Uses Cookies

If you visit our Website, we use cookies and similar technologies to store and read information from your device. These technologies allow us to collect information about your activity on the Website, including how you navigate through the Website, as well as information about the device you use to access it, such as your IP address and the approximate location derived from it, your device identifier, technical specifications (including your operating system and its version), screen resolution, and the browser and browser version you are using.

The specific purposes for which we, and in certain cases third parties, use cookies are described below.

Complete information about our use of cookies is available in our Cookie Banner, which you can access at any time by clicking the button located in the corner of the screen.

• Detailed Information About Cookies

Cookies are small text files stored on the device you use to access our Website. They may be used by websites to measure traffic, provide additional functionality, or personalize content and advertisements, including on third-party websites. The term “cookies” also includes similar technologies, such as local storage and session storage. For simplicity, all of these technologies are collectively referred to in this document as cookies.

We use different types of cookies on our Website. Some cookies are placed or used directly by our Website, while others are placed and accessed by tools provided by third-party service providers that we use. Some cookies may be used without your consent, while others require your consent before they can be used.

In accordance with applicable law, we store cookies on your device only if we have your consent or if the cookies are strictly necessary for the operation of this Website, in which case your consent is not required.

A complete list of the cookies used on our Website, including information about third-party providers and the duration of each cookie, is available in our Cookie Banner. However, for the purposes described below, we process your personal data for no longer than 12 months.

Your consent applies to the following domains: www.vyhledavac.mujup.cz, www.ebenefity.cz, www.estravenka.cz, www.upcz.cz and www.upverso.cz.

You may change or withdraw your consent at any time through the cookie settings available in the Cookie Banner.

Cookie Categories:

• Strictly Necessary

Strictly necessary cookies help make the Website functional by enabling essential features such as page navigation, access to secure areas of the Website, allowing you to contact us through online forms, and recording your cookie consent preferences. Without these cookies, the Website cannot function properly, and therefore they cannot be disabled.

We process the personal data collected through these cookies based on our legitimate interest in ensuring the proper functioning of our services and the security of your data.

• Preference

Preference cookies enable additional Website features and allow the Website to remember information that changes how it behaves or appears based on your preferences.

• Analytics

With your consent, we use analytics cookies to help us understand how visitors use our Website. The information collected is used to measure Website traffic and performance and to generate statistical reports. Based on these insights, we improve the functionality, performance, and overall user experience of our Website.

• Marketing

With your consent, we use marketing cookies for advertising purposes. The information collected about your activity on the Website through these cookies enables us to personalize the offers displayed to you.

We also share information about your activity on the Website with advertising and social media platforms so that personalized offers can be displayed to you on third-party websites and social media platforms.

In connection with our use of marketing cookies, we use the following third-party tools, whose providers also act as recipients of this information.

F. Who Processes Your Personal Data, and With Whom Do We Share It?

All of the personal data described in this Privacy Policy is processed by us in our capacity as the data controller (see Section A – “Who determines how your personal data is processed?”). This means that we determine the purposes and means of processing your personal data, including, in particular, its collection, recording, organization, and, where applicable, disclosure. We are also responsible for ensuring that your personal data is processed properly and in compliance with applicable law.

We also use the services of third-party data processors, who process personal data solely on our behalf, in accordance with our instructions and only for the purposes described in Section D – “Why do we process your personal data, and what is our legal basis for doing so?”

A list of our data processors is available on our Website in the Customer Zone section.

Our data processors include, in particular:

1. providers of cloud computing services and IT infrastructure support;
2. providers of marketing tools that help us optimize our Website and personalize content and offers for you;
3. suppliers and providers of information systems, software, software services, applications, and services supporting the secure operation of our information systems, software, and applications;
4. providers of communication and chat tools, where they process personal data for the purpose of facilitating our communications with you.

We may share photographs and video recordings taken at events with operators of online platforms.

We also use third-party tools that rely on cookies to process information about your activity on our Website. Some providers of these tools process personal data on our behalf as data processors, while others process it as independent data controllers. More detailed information about the providers of these tools is available in our Cookie Banner.

G. How Do We Protect the Security of Your Personal Data?

Ensuring the security of your personal data is one of our highest priorities. We have implemented and maintain appropriate technical and organizational measures to ensure that your personal data is processed securely and protected against unauthorized or accidental access, unauthorized viewing, creation, copying, transmission, modification, or deletion of records containing your personal data, as well as against any other unauthorized processing or misuse of your personal data.

H. Transfer of Your Personal Data Outside the European Economic Area

As part of the sharing of personal data with the data controllers and data processors identified in Section F – “Who Processes Your Personal Data, and With Whom Do We Share It?”, your personal data may also be transferred to countries outside the European Economic Area (EEA) that do not provide an adequate level of protection for personal data.

Any such transfers will be carried out only on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission, available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914, which the recipient in the third country has agreed to comply with, together with any additional safeguards required to ensure an adequate level of protection.

Your personal data may also be transferred to companies in the United States on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework. Under this decision, organizations certified under the EU–U.S. Data Privacy Framework are deemed to provide an adequate level of protection for personal data.

I. What Are Your Rights Regarding the Processing of Your Personal Data?

Just as we have certain rights and obligations when processing your personal data, you also have specific rights under applicable data protection laws. These rights include the following:

a) Withdrawal of Consent

Any consent we request from you is entirely voluntary, and you are under no obligation to provide it.

Whenever the processing of your personal data is based on your consent, you may withdraw that consent at any time by following the procedure described in Section J – “How Can You Exercise Your Rights?”

If your personal data is processed through cookies based on your consent, you can withdraw your consent at any time through the Cookie Banner, which is accessible by clicking the button located in the corner of the screen.

The withdrawal of your consent does not affect the lawfulness of any processing carried out before your consent was withdrawn.

b) Right of Access

You have the right to know what personal data we process about you, the purposes for which we process it, how long we retain it, where we obtained it, with whom we share it, who processes it on our behalf, and what other rights you have in relation to the processing of your personal data.

Most of this information is provided in this Privacy Policy. However, if you are unsure whether we process your personal data, you may request confirmation as to whether we process personal data relating to you. If we do, you have the right to access that personal data.

As part of your right of access, you may also request a copy of the personal data we process about you. The first copy will be provided free of charge. We may charge a reasonable fee for any additional copies.

c) Right to Rectification

If you believe that the personal data we process about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

d) Right to Erasure

In certain circumstances, you have the right to request that we erase your personal data. We will erase your personal data without undue delay if any of the following conditions apply:

• your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw your consent to the processing of your personal data, where consent is the legal basis for processing, and we have no other legal basis for continuing to process your personal data;
• you exercise your right to object to the processing of your personal data (see Section I(g) – “Right to Object to Processing”) where the processing is based on our legitimate interests, and we determine that we no longer have overriding legitimate grounds to continue such processing; or
• you believe that our processing of your personal data no longer complies with applicable law.

This right does not apply where the continued processing of your personal data is necessary to comply with a legal obligation to which we are subject or for the establishment, exercise, or defense of legal claims (see Section D – “Why do we process your personal data, and what is our legal basis for doing so?”).

e) Right to Restriction of Processing

In certain circumstances, you may exercise your right to restriction of processing instead of requesting the erasure of your personal data.

This right allows you to request that your personal data be marked as restricted so that it is not subject to any further processing operations. Unlike the right to erasure, however, this restriction is temporary rather than permanent.

We are required to restrict the processing of your personal data in the following circumstances:

• you contest the accuracy of your personal data, for the period necessary to verify its accuracy;
• we are processing your personal data without a sufficient legal basis (for example, processing data beyond what is legally required), but you prefer the restriction of processing rather than the erasure of your personal data (for example, because you expect to provide the same data to us again in the future);
• we no longer need your personal data for the purposes described above, but you require it for the establishment, exercise, or defense of legal claims; or
• you object to the processing of your personal data. The right to object is described in more detail in Section I(g) – “Right to Object to Processing.” While we assess whether your objection is justified, we are required to restrict the processing of your personal data.

f) Right to Data Portability

You have the right to obtain from us the personal data that you have provided to us and that we process based on your consent or because the processing is necessary for the performance of a contract (see Section D – “Why do we process your personal data, and what is our legal basis for doing so?”).

We will provide your personal data in a structured, commonly used, and machine-readable format. To enable us to fulfill your request, this right applies only to personal data that we process by automated means in our electronic databases.

g) Right to Object to Processing

You have the right to object to the processing of your personal data where the processing is based on our legitimate interests (see Section D – “Why do we process your personal data, and what is our legal basis for doing so?”).

If your objection relates to marketing activities, we will stop processing your personal data for those purposes without undue delay.

In all other cases, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.

You may object to the processing of your personal data for the following purposes: our internal record-keeping and the protection of our rights and legitimate interests, contacting prospective and existing customers, and improving our Website and services.

h) Right to Lodge a Complaint

The exercise of the rights described above does not affect your right to lodge a complaint with the competent supervisory authority.

You may exercise this right, in particular, if you believe that we are processing your personal data unlawfully or in violation of applicable data protection laws.

In the Czech Republic, you may lodge a complaint with the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

J. How Can You Exercise Your Rights?

If you have any questions or concerns regarding the processing of your personal data, wish to exercise any of your rights, file a complaint, or contact us for any other reason related to the processing of your personal data, you may contact our Data Protection Officer at data@upcz.cz.

We will respond to your request without undue delay and, in any event, within one month of receiving it.

In exceptional cases, particularly where your request is complex, we may extend this period by up to an additional two months. If an extension is necessary, we will inform you of the extension and the reasons for it within the original one-month period.

K. Learn More About the Process for Exercising Your Data Subject Rights

How Can You Submit a Request to Exercise Your Rights?

We have made every effort to simplify the process of exercising your rights. You can use the Data Subject Rights Request Forms available below.

Using these forms helps ensure that your request is processed efficiently, as they provide us with all the information we need and enable us to verify your identity. This minimizes the need for any additional information to be requested from you.

The verification requirements described below are intended to confirm that you are the individual to whom the personal data relates. This helps protect your personal data from misuse by unauthorized persons (for example, disclosure to a third party) or other harm (such as the unauthorized deletion of your personal data).

You may also exercise your rights using the following methods:

a) Submitting a Request in Person

If you wish to submit your request in person, you may visit us on business days between 9:00 a.m. and 4:00 p.m. at our registered office located at Zelený pruh 1560/99, Prague 4, 140 00, Czech Republic.

To protect your personal data from unauthorized disclosure or misuse, we must verify your identity. Please bring your national ID card or another official government-issued identification document.

b) Submitting a Request by Mail

If you wish to submit your request in writing, you may send or deliver it by mail to:

Up Česká republika s.r.o.
Zelený pruh 1560/99
140 00 Prague 4
Czech Republic

To protect your personal data from unauthorized access or misuse, we must verify your identity. Therefore, your written request must include a notarized signature.

c) Submitting a Request by Email

If you wish to submit your request by email, you may send it to data@upcz.cz.

To protect your personal data from unauthorized access or misuse, we must verify your identity. Therefore, your request must be electronically signed using a recognized, advanced, or qualified electronic signature.

Alternatively, you may have your request officially notarized and then converted into electronic form through an authorized document conversion service.

d) Submitting a Request via Data Box

If you wish to submit your request through the Czech Data Box system, you may send it to our Data Box ID: dd4hx95.

To protect your personal data from unauthorized access or misuse, we must verify your identity. Therefore, the information associated with your Data Box must match the information provided in your request.

GDPR Data Subject Rights Request Forms