Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 General Data Protection Regulation (hereinafter referred to as the “Regulation” or “GDPR”)

Act No. 110/2019 Coll., on personal data processing (hereinafter referred to as the “Act”)

I. Personal data controller

Eyeball s.r.o., with registered office at Jungmannova 745/24, Prague 1 110 00, ID no: 09674454, databox ID: 9y9r5s5, (hereinafter referred to as the “Company” or “Controller”), as the controller of[1] personal data, hereby gives information, on the basis of this Regulation and the Act, about the manner and scope of processing of personal data, including the scope of the rights of data subjects related, unless otherwise specified by the Act, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) – (hereinafter referred to as “GDPR”).

II. Extent of personal data processing

Personal data are processed to the extent that the relevant data subject has provided them to the controller in connection with the conclusion of a contractual or other legal relationship with the controller, and even in the event of data subject registration in the Company’s application or web platform, or which the controller has otherwise collected and processes in accordance with applicable law or to fulfil the controller’s legal obligations under the Act.

III. Sources of personal data

directly from subjects providing personal data voluntarily (e.g. when entering into a contractual relationship, or registration to an application, platform or other environment operated by the Company e.g. from email, personal or telephone communications for requests directed to the controller, such as in particular Book Sales Call, Request and Quote) and these sources are not only a prerequisite for entering into or amending a contractual relationship, but also serve primarily to uniquely and unambiguously identify data subjects, which are determined by generally binding regulations, as a necessary requirement for the negotiation of the parties and the Company’s compliance with regulations and the law, in particular the personal data transmitted, but also the derivation of the data provided from publicly available registers, lists and registers/records (e.g. commercial register, trade register, public telephone directory, other directories etc.) CCTV systems that are under the management or ownership of the controller.

IV. Categories of personal data subject to processing

• Identification data is always broken down according to the types of data subject and the purpose of processing personal data, and its scope is determined by the necessity for the purpose of processing personal data: identification data means, in particular: first name, surname, title, date of birth, permanent, temporary and delivery address, where applicable, registered office, signature, citizenship, nationality, current education data, etc. Identification data are also personal data on the basis of which we are able to identify you unambiguously and which may be part of our platform or applications, such as a player’s profile and performance ratings.
• Contact data: contact data are in particular contact address, telephone number, e-mail address, etc. The contact data is thus the personal data on the basis of which we are able to contact you. For more detailed information regarding the specific categories of personal data we process, please refer to the text of the document by which you either consent to the processing of personal data or by which we inform you about the processing of personal data in the provision/performance of our contractual arrangements or other purposes of processing personal data on the basis of our contractual or legal obligation or on the basis of legitimate interest.
• descriptive and authentication data (e.g. bank connection or login/registration data), other data necessary for the performance of the contract, data provided in excess of the relevant laws processed within the scope of the data subject’s consent (processing of photographs or video recordings, or videoclips, use of personal data for the purpose of HR, etc.)
• taking a photo of the data subject incl. the unique gesture of the data subject when registering the data subject in the application environment and only for the purpose of ensuring the necessary functioning of our application environment. This fact is confirmed by every data subject over the age of 16 for the purpose of protecting the rights and legal claims of the Company
• categories of special data: in particular data about your health condition, if any.
• behavioural data on our website (for more information, see the Cookie Policy document published on the website: www.eyeball.club.

V. Categories of data subjects

Player, Club coach, legal representative of the player, employee of the controller, external collaborator (natural person, whether or not in business), partner of the controller, carrier, service provider, or other person who is in a contractual relationship with the controller, job applicant, natural persons involved in the processing of personal data, other data subjects.

VI. Categories of personal data recipients

Public administration bodies (police, bailiffs, etc.), or state etc. authorities in the performance of their legal obligations under the relevant legislation or on the basis of your consent to the processing of personal data, in particular other governmental and local government organisations, as well as partner Clubs, Professional Clubs in the provision of services of the controller, financial and insurance institutions, if any, persons providing postal and email distribution to persons, as well as contractors providing IT administration, websites, business and technical processing operations (suppliers of information systems and applications) and other processors of the controller, such as, in particular: Mailgun Technologies, Inc., Amazon Web Services, Inc., White Interactive, Ltd., and their contractual sub-processors or other possible recipients in the Czech Republic, abroad, EU countries. For more detailed information on the processors and recipients of personal data, please refer to the text of the document by which you either give us your consent to the processing of personal data or by which we inform you about the processing of personal data in the provision of the service and the sale of our product or specific service on the basis of our contractual obligation or on the basis of legitimate interest.

VII. Purpose of processing personal data

purposes of processing personal data of data subjects:

• negotiation of contractual relationship, performance of contract – conclusion and performance of Contract: Scouting Agreement incl. Terms of use/Terms & Conditions;
• ability to access the Club’s dedicated Platform (Software as a Service) section with video recordings, its entries and profiles of the players associated with them;
• option of Professional Club to watch video footage of amateur clubs and identify players;
• setting up a virtual account/registration in the Administrator Platform;
• the possibility of creating video clips (players application) and sharing these video clips within the platform and also within commonly available social media and networks;
• setting up a virtual account/registration in the administrator application;
  outreach to new and existing and professional clubs by the Company;
• recruitment, selection procedure for vacancies;
• internal administrative needs and internal registration and protection of the rights, legal rights and interests of the controller, the recipient or other persons concerned (e.g. recovery of claims, claims for damages, administrative proceedings under special regulations, generation of statistics)
• archives maintained on the basis of the law,
• the fulfilment of legal obligations by the controller and on the basis of its legal activities
• protection of the vital interests of the data subject
• improvements to the webmaster’s website based on their use
• statistical reporting.

VIII. Means of personal data processing and protection

It is carried out only by employees, at the workplaces and headquarters of the controller, also with the help of the processor and computer technology, or also manually for personal data in paper form, in compliance with all security principles and technical or organisational measures for the management and processing of personal data.

IX. Period of personal data processing

In accordance with the time limits set out in the relevant contracts, in the administrator’s filing and shredding rules or in the relevant legislation, this is the time necessary to secure the rights and obligations arising from both the contractual relationship and the relevant legislation which the administrator is bound to observe.

X. Notes

The Controller processes data with the consent of the data subject, except in cases provided by law where the processing of personal data does not require the consent of the data subject within the meaning of the Act, unless otherwise provided for as a result of statutory Exceptions or the GDPR.

In accordance with the provisions of the Act and further based on Article 6(1) GDPR, the controller may process the following data without the consent of the data subject:

• the data subject has given consent for one or more specific purposes,
• the processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of measures taken prior to the conclusion of the contract at the request of this data subject,
• the processing is necessary for compliance with a legal obligation to which the controller is subject,
• the processing is necessary to protect the vital interests of the data subject or another natural person,
• the processing is necessary for the purposes of the legitimate interests of the controller or third party concerned, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data.

XI. Technical and organisational measures for the security of personal data of data subjects

1. The controller has in particular adopted and maintains the following measures to ensure the level of personal data protection:

• all persons to whom access to personal data will be granted have been or will be informed of the obligations arising from the processing of personal data before such access is granted;
• the functionality and effectiveness of the measures to ensure the security of personal data will be checked regularly and to the extent necessary by means of own auditing and review activities in the area of measures and documentation.
• the making of records which make it possible to determine and verify when and by whom personal data have been recorded or otherwise processed;
• performing encryption and/or anonymisation of personal data;
• the ability to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services, given the technical measures in place and their regular monitoring;
• the ability to restore the availability of personal data;
• it has introduced a process for regularly testing, assessing and evaluating the effectiveness of introduced measures for processing security;
• the ability to protect the integrity of communications networks;
• antivirus protection and unauthorised access control;
• secure data transmission that allows unambiguous identification of the recipient through tools;
• when processing personal data, personal data will be stored exclusively on secure servers or on secure data carriers if the personal data is in electronic form.

2. The controller declares that it will adopt additional safeguards on an ongoing basis for the technical and organisational security of personal data, in particular it will adopt measures to prevent unauthorised or accidental access to, accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data (hereafter only “personal data breach”), at its discretion and taking into account the state of the art.

XII. Rights of data subjects

1. The basic and essential elements of the requests for exercising the rights of data subjects are published in the document “Essential elements for exercising rights”, published on all our websites. This document lists the rights of data subjects and provides forms for exercising the rights of data subjects, always at the following email address gdpr@eyeball.club or at the controller’s workplace.

2. In accordance with the provisions of Section 28 of the Act, the controller shall inform the data subject, upon request, of the right to access personal data and the following information:

• the purpose of the processing, the category of personal data concerned,
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, the intended period for which the personal data will be stored, any available information about the source of the personal data,
• if not obtained from the data subject, whether automated decision-making, including profiling, is taking place, the rights to request rectification, restriction of processing or erasure of personal data and the source of these data.

3. Any data subject who becomes aware or believes that the controller or processor is carrying out processing of his or her personal data which is contrary to the protection of the private and personal life of the data subject or contrary to law, in particular where the personal data are inaccurate with regard to the purpose of the processing, may:

• ask the administrator for an explanation, and demand that the administrator remedy the situation. In particular, this may involve blocking, correcting, supplementing or deleting personal data,
• if the data subject’s request pursuant to paragraph 1 is found to be justified, the controller shall rectify the defective situation without delay,
• if the controller does not comply with the data subject’s request pursuant to paragraph 1, the data subject has the right to apply directly to the supervisory authority, i.e., in the Czech Republic, the Office for Personal Data Protection, located at: Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz. 234 665 800 or by email: posta@uoou.cz or the supervisory authority in the country of residence or establishment of the data subject in the EU,
• the procedure referred to in paragraph 1 shall not preclude the data subject from submitting his or her complaint directly to the supervisory authority,

Contact details of the data protection officer of the controller: Martin Trávníček, MBA, e-mail: gdpr@eyeball.club or the address of the administrator’s registered office

[1] The data controller determines for what purpose and by what means personal data will be processed, collected, recorded and sorted or disclosed, and the controller is responsible for the proper implementation of such processing of your personal data.