The essential and necessary elements of a request for the exercise of the data subject’s rights in the field of processing and protection of personal data​ in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 General Data Protection Regulation (hereinafter referred to as the “Regulation” or “GDPR”) and Act No. 110/2019 Coll., on the processing of personal data (hereinafter referred to as “Act”)

I. Personal data controller

Eyeball s.r.o., with registered office at Jungmannova 745/24, Prague 110 00, ID no: 09674454, databox ID: 9y9r5s5, (the “Company” or the “Controller”).

II. Contact details:

The function of the Data Protection Officer for the Controller is performed by:

Martin Trávníček, MBA

email: gdpr@eyeball.club

III. Rights of data subjects

• the right to withdraw consent
• the subject’s right of access to data
• the right to rectification
• the right to erasure (right “to be forgotten”)
• right to restriction of processing
• the right to notification duty concerning changes to personal data or restrictions on processing
• right to data portability
• the right to object, unless exempted by the Act or GDPR
• the right to automated individual decision-making, including profiling
• the right to be informed about the origin and acquisition of personal data where the personal data have not been provided by the data subject to the controller.
• Forms for exercising rights: objection to the processing of personal data, exercising the right to data portability, withdrawal of consent, rectification, restriction of processing, erasure and access to personal data are available from our data controller staff.

IV. Exercise of data subjects’ rights

The data subject is entitled to exercise his or her rights by means of a written request, in the following manner:

• personal delivery to the address of the Data Controller
• by post to the address of the Data Controller
• electronically to the e-mail address of the Data Protection Officer: gdpr@eyeball.club
• by databox to the databox ID of the Data Controller

V. Particulars of the application

• A person who wishes to exercise his or her rights in relation to personal data shall state in a written request the relevant grounds and the facts which he or she objects to and wishes to assert.
• Each application must contain the legal requirements for the submission of the application and the applicant must prove his/her identity, e.g. by a certified signature for a paper application or a recognised electronic signature for an electronic application, or by submission via a data box.
• If the application does not comply with the statutory requirements, the applicant will be requested in writing to remedy the situation; in the event of non-compliance within the time limit, the application will be rejected.

VI. Processing of the application, time limit

• the processing of the request is free of charge, within 30 days of receipt of the request pursuant to Article 12(3) of the GDPR, unless the Act provides otherwise. In exceptional cases, this time limit may be extended if a delay is necessary due to the complexity and extensiveness of the processing on the part of the Controller,
• information may be provided by the controller in writing or by other means, or, if the data subject so requests, orally, provided that the identity of the data subject is established by other means.
  If the applicant makes a repeated request in the same matter, or if the request is manifestly unfounded or the data subject is not entitled to make it, the request shall be rejected by the controller and, in exceptional cases, the controller shall be entitled, in accordance with Article 12(5), to require the applicant to pay the administrative costs of the request in question, even if the request is rejected.

VII. Remedies

• if the data subject’s request pursuant to paragraph 1 is found to be justified, the controller shall rectify the defective situation without delay,
• if the controller does not comply with the data subject’s request pursuant to paragraph 1, the data subject has the right to apply directly to the supervisory authority, i.e. in the Czech Republic the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7 or the supervisory authority in the country of residence or establishment of the data subject in the EU, namely in the manner specified by the Controller in the decision document.