Terms of processing of personal data

These Terms are part of the Agreement concluded between the Customer and RainFellows s.r.o. (the Provider). RainFellows s.r.o. (Provider) and Customer may be collectively referred to as”Parties“
or individually as”Party“.


By concluding the Agreement, the Customer confirms that he has read the Terms and Conditions, has read their contents, understands and agrees with the Terms.


If the Customer is a legal person, then the natural person acting on behalf of the Customer enters into a Contract with the Provider and expresses his consent to these Terms at the same time declares that he is entitled to conclude the Agreement and accept the Terms on behalf of the Customer.

1. DEFINITION

1.1. The meaning of capitalized words is defined in the table below, unless expressly provided otherwise in these Terms.

GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.TermsThese are RainFellows terms of personal data processing.ProviderIs a trading company RainFellows Ltd., Company ID: 28137736, with its registered office at Masarykovo Namesti 38/21, Moravská Ostrava, 702 00 Ostrava, Czech Republic, registered in the Commercial Register under the registration number. C 56878 at the Regional Court in Ostrava.Services There are training in agile methodologies (lean methodologies), practical workshops on problem solving (implementation of management styles), consulting for managers (personal development, improvement of management skills — mentoring), workshops and consulting in the field of knowledge-management, project management, leadership.Covenant It is a contract concluded between the Customer and the Provider, on the basis of which the Provider provides the Customer with the Services and the Customer pays the price to the Provider.CustomerIs the person who has entered into a Contract with the Provider.

2. INTRODUCTORY ARRANGEMENT

2.1. As part of the provision of the Services, personal data of the Customer's data subjects may be processed. The terms and conditions govern the processing of such personal data by the Provider as processor
personal data within the meaning of Art. 28 GDPR.

3. TASKS AND INSTRUCTIONS FOR DATA PROCESSING

3.1. The Parties acknowledge and agree that:

  1. The Provider is the processor of personal data of the Customer's data subjects;
  2. The Customer is the controller or processor of the personal data of the Customer's data subjects and
  3. Both Parties undertake to fulfill their obligations arising from the applicable legal regulations that apply to the processing of personal data of the Customer's data subjects.

3.2. If the Customer acts as a processor, it guarantees the Provider that the relevant controller has approved its instructions and actions in relation to the personal data of the Customer's data subjects, including the authorization of the Provider as
another processor.
3.3. The Provider will process the personal data of the Customer's data subjects only in accordance with applicable law and for the purpose of: a) providing the Services to the Customer and b) as specified in other written instructions issued by the Customer.

4. THE DURATION OF THE PROCESSING OF PERSONAL DATA

4.1. The Provider shall process the personal data of the Customer's data subjects only for the period of the provision of the Services under the Agreement or until the erasure of all personal data of the data subjects by the Provider in accordance with these Terms.

5. NATURE AND PURPOSE OF THE PROCESSING OF PERSONAL DATA

5.1. For the purposes of providing the Services to the Customer, the Provider will process the personal data of the Customer's data subjects, both in electronic and analog form.
5.2. The purpose of processing personal data is to provide Services to the Customer.

6th. TYPES OF PERSONAL DATA

6.1. The following categories of personal data will be the subject of processing under these Terms:

  1. contact details,
  2. identification data; and
  3. data relating to the relationship of trained persons to the Customer.

7. CATEGORIES OF DATA SUBJECTS

7.1. Data subjects of the Customer are the following categories of data subjects:

  1. Customer's employees;
  2. other data subjects whose personal data are processed for the purpose of providing Services by the Provider to the Customer and which the Customer has transferred to the Provider for processing for this purpose.

8. RIGHTS AND OBLIGATIONS OF THE PARTIES

8.1. The Provider declares and undertakes that:

  1. if it becomes aware of a breach or imminent breach of the security of personal data, accidental or unlawful destruction, loss, alteration or unauthorised provision or disclosure of the processed personal data, it shall immediately, but not later than 24 (twenty-four) hours, inform the Customer in writing and describe as best as possible the security risk that has arisen or threatened, informing the Customer of the appropriate measures to prevent or minimise the breach; and let us have all the necessary
    measures to minimize damage;
  2. will process personal data only within the EU or EEA;
  3. personal data will be secured in accordance with Article 9 of these Terms;
  4. will process personal data only in accordance with these Terms, or on the basis of other documented instructions of the Customer;
  5. assist the Customer in implementing and maintaining appropriate technical and organisational measures for the security of personal data, in reporting breaches of personal data security to the supervisory authority or data subject, in assessing the impact on the protection of personal data and in prior consultations with the supervisory authority;
  6. ensure the Customer, through appropriate technical and organizational measures, synergies, no later than 14 (fourteen) days after the Customer's request is made, in order to fulfill the Customer's obligation to respond to requests for the exercise of the data subject's rights;
  7. provide the Customer, upon request, without delay, but within one week at the latest, with all the cooperation necessary to demonstrate that the personal data are sufficiently organized and technically secure.

8.2. If the Provider receives any request from the data subject in relation to the personal data of the Customer's data subjects in relation to the personal data of the Customer's data subjects, the Provider shall inform the data subject to contact the Customer directly with the request. The customer is responsible for processing such a request.
8.3. The Provider undertakes not to use any other processor for the processing of personal data without the prior written permission of the Customer, except for external lecturers, and in case of involvement of these
ensure that other processors comply with the same data protection obligations as set out in the Terms.
8.4. The Provider is obliged to enable the Customer or the person authorized by him to control (including audit or inspection) compliance with these Terms, in particular the obligations for processing personal data arising from them, and shall contribute to such checks according to the customer's or controlling person's reasonable instructions.
8.5. Any request for an audit shall be sent by the Customer exclusively to the email address of the Provider napiste.nam@rainfellows.cz. Upon receipt of the request for an audit, the Provider and the Customer agree in advance on: (a) the possible date of the audit, the security measures and the method of ensuring compliance with the confidentiality obligations during the audit, and (b) the expected start, scope and duration of the audit and the security measures and the method of ensuring compliance with the confidentiality obligations during the audit.
8.6. The Provider may object in writing to any auditor entrusted by the Customer if, in the opinion of the Provider, the auditor is not sufficiently qualified, is independent, is in a competitive position with the Provider or is otherwise manifestly unsuitable. On the basis of the objection raised, the Customer is obliged to commission another auditor, or to perform the audit himself.
8.7. The Customer is responsible for fulfilling all obligations in relation to the processing of personal data of the Customer's data subjects, in particular for properly informing the data subjects about the processing of the subjects' personal data
Customer data, obtaining consent to the processing of personal data of Customer data subjects, if necessary, processing requests of data subjects regarding the realization of their rights (such as the right to information, access, correction, erasure, restriction of processing, objection, etc.). In addition, the Customer is responsible for fulfilling all reporting obligations to the supervisory authority in connection with the processing of personal data of the Customer's data subjects, in particular for reporting violations
security of personal data.
8.8. The Customer is solely responsible for familiarizing himself with these Terms and evaluating the security measures taken and obligations of the Provider with respect to the needs of the Customer, in particular in relation to the Customer's security obligations under generally binding legal regulations.

9. SECURITY OF PERSONAL DATA

9.1. The Provider has adopted and undertakes to maintain the following measures to ensure the security of the processing of personal data throughout the processing:

  1. Organizational measures:
    • Provider staff are regularly trained on the principles and principles of personal data protection and cybersecurity;
    • The provider has in place rules for the handling of personal data and valuable information;
    • all employees of the Provider are obliged to maintain confidentiality at least to the extent of the personal data transmitted;
  2. Technical measures
    • Antivirus solution to protect against malware;
    • Solutions for network security;
    • Encryption of hard drives and external media of Provider personnel;
    • Backup of processed data;
    • Access to the Customer's data protected by a password or similar element.

9.2. The Provider shall secure the technical means belonging to the Provider and which it will use to protect the provision of the Services from cyber attacks in the latest and best manner, taking into account the nature of the personal data and the state of the art. The Provider is liable for damage to personal data by a third party if it is proved that they have not been responsibly secured in accordance with Article 9 of these Terms.

10. DISPOSAL OF PERSONAL DATA AFTER THE END OF PROCESSING

10.1. After the end of the provision of the Services, regardless of the method and reason for termination, the Provider will permanently destroy all personal data of the Customer's data subjects processed on the basis of these Terms and Conditions, except
where the storage of personal data is required by the law of the Czech Republic or the European Union.

11. OTHER ARRANGEMENTS

11.1. The Provider shall be entitled to charge the Customer the costs incurred for the purpose of processing any request referred to in Article 8 of these Terms or the inspection in accordance with paragraph 8.4 of these Terms.