GDPR

WHAT INFORMATION WE COLLECT

Personal data is any information relating to an identified or identifiable living person. Colour by Nikola processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.

When you register with us or enquire about our services, you will provide us with personal data. Given the diversity of the services we provide to personal clients, we process many categories of personal data, including as appropriate for the services we are providing:

Contact details including name, address, email, phone number.
Bank or payment card details.

PROCESSING OF DATA

Our policy is to collect only the personal data necessary for agreed purposes and we ask our clients to only share personal data where it is needed for those purposes.

Colour by Nikola wants to provide the best service experience; we therefore gather this data to understand your needs and personalise our service, thus providing you with a better service experience. The information will be used for:

Providing a tailored and personalised service to clients and customers with products and services most likely to interest you.
Providing updates on our products and services.
Providing information on legislation change that affects you.
Internal audit purposes.
Improving our services.
Processing payments.
Periodically send promotional or market research communications which we think you may find interesting using the contact details which you have provided.

Colour by Nikola may contact you by email or SMS. The lawful basis on which we process data for this purpose will be different depending on the reason for the contact.

If you are enquiring about our products or services we will use either "consent" or "contract" in order to fulfil your request for information.

DATA RETENTION

Colour by Nikola will as a minimum keep your information for as long as we are providing you a service or are likely to provide a service due to an enquiry we have received.

We review the need to hold personal data on an annual basis. Any personal data, physical or electronic, that no longer needs to be maintained for the purposes of meeting our legal or regulatory obligations will be reviewed and when appropriate securely destroyed.

Where data is processed solely for marketing purposes, any information we use for this purpose will be kept until you notify us that you no longer wish to receive this information, or until the data is deleted following annual review, whichever is earliest.

We may also use your address details to post out direct marketing materials telling you about products and services that we think may be of interest to you.

You may choose to opt out of any marketing communications at any time by any of the following methods:

Unsubscribing from the campaign.
Emailing us at nikolagmail.com.pavlickova@
By post to our registered address noted above.

SENSITIVE PERSONAL DATA

We will not normally ask you for sensitive personal data as defined under law as ‘special category information’ and specifically in Article 9 of the GDPR.

SHARING YOUR PERSONAL DATA

Colour by Nikola works with several agencies and carefully selected service providers that carry out certain functions on our behalf to support the services we provided to you. These include, for example, Paypal and companies that help us with technology services and also payment processing. We only share personal data that enables the agencies and our service providers to provide their services and it will always be shared in a secure and appropriate manner.

We may share personal data with other organisations in the following circumstances:

If the law or a public authority says we must share the personal data.
If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk).
To an organisation we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you to. If the transfer or sale goes ahead, the organisation receiving your personal data can use your personal data in the same way as us; or to any other successors in title to our business.

PROTECTION OF PERSONAL DATA

This section sets out some of the measures we have in place to secure personal data:

Access to personal data is provided only to those employees who require access to perform their job function.
Access to our computer systems is protected by robust security measures which include firewall, email and file encryption at rest and in transit, anti-virus and anti-ransomware, 24x7 security monitoring to detect unusual network activity.
Our staff are trained and tested on data protection and cyber security awareness including anti-phishing and USB bating.
We use the services of a specialist computer security services provider to ensure our systems remain secure using the latest technologies applicable for companies of our size and in our industry sector.
We have robust procedures and policies in place that are adhered to by our staff. Failure to comply will result in an appropriate disciplinary response.
All physical instances of personal data such as paper applications received via post are treated with the same strict security as electronic data.
Your rights and choices relating to your personal data.

Under data protection legislation, you have several rights regarding the use of your personal data, as follows:

THE RIGHT OF CONFIRMATION AND ACCESS

As a data subject you have the right to obtain confirmation from the data controller as to whether or not personal data concerning you is being processed. You also have the right to obtain from us free information about your personal data stored at any time, and a copy of this information. Furthermore, you have the right to obtain information as to whether personal data is transferred to a third country or to an international organisation. Where this is the case, you also have the right to be informed of the appropriate safeguards relating to the transfer.

RIGHT TO RECTIFICATION AND ERASURE (RIGHT TO BE FORGOTTEN)

You have the right to ask us to rectify inaccurate data or to complete any incomplete personal data that we hold. You have the right to ask us to erase your personal data without delay where one of the statutory grounds applies, so long as the processing is not necessary. If you request us to erase your personal data, then this means that our business relationship will end as we cannot provide our service without processing your data.

If you exercise your ‘Right to be Forgotten’, then all personal data stored will be deleted. This means that you may be contacted again in the event that you re-connected with us via web, phone or email and/or your details are given to us by a third party.

RIGHT OF RESTRICTION OF PROCESSING/RIGHT TO OBJECT

You have the right to restrict the processing of your personal data under certain circumstances, including if you have contested its accuracy and while this is being verified by us, or if you have objected to its processing and while we are considering whether we have legitimate grounds to continue to do so. You have the right to object, on grounds relating to your particular situation, at any time, to the processing of personal data concerning you.

RIGHT OF DATA PORTABILITY

You also have the right for certain data you have given us to be provided to you in a structured and commonly used electronic format (for example, a .csv file), so that you can move, copy or transfer this data easily to another data controller. You may also request that we transmit this data directly to another organisation where it is practical for us to do so.

AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING

You have the right not to be subjected to a decision based solely on automated processing, including profiling. La Richédo not process any personal data in this way.

DATA PROTECTION FOR EMPLOYMENT AND RECRUITMENT PROCEDURES

Details of how we process data for recruitment or employment procedures are covered separately and will be provided to applicants/employees as part of the HR process.

HOW TO EXERCISE YOUR RIGHTS

If you wish to contact us in respect of any of the Rights described above, please get in touch with our office:

Colour by Nikola, Dušní 8/11, Praha 1, 110 00, Czech republic

E-mail: nikola.pavlickova@gmail.com

We will respond to your request free of charge and within 30 days.