Privacy policy

With regard to the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), our commercial company Hypo na míru s.r.o., company ID number: 29276187, has adopted the following Privacy policy with effect from 25 May 2018, which contains the information on processing of your personal data in our company and your rights granted by the GDPR.

What personal data about you do we process?

We process only the personal data that you share with us by filling out the mortgage calculator form on the www.hyponamiru.cz website, or by telephone or electronic communication. This includes the following data:

1. Basic identification data (name and surname, postcode, age, marital status).
2. Contact details (e-mail address and telephone number) and all the information from the telephone and electronic communication.
3. Information on mortgage calculator usage, including all the information contained in the mortgage calculator form.
4. Information on financial circumstances (type of income, amount of monthly income and payment history).

Since we operate as a tied agent of the independent consumer credit broker of commercial company Broker Trust, a.s., company ID number: 26439719, we also have access to other personal data as the processor. We obtain this personal data on the forms of consumer credit providers [pursuant to Section 3 par. 1 point d) of Act No. 257/2016 Sb., on Consumer Credit, as amended], including all required attachments, or from e-mail communication. We do not use this data for our own purposes, but only for the purposes of Broker Trust, a.s., company ID number: 26439719, and individual consumer credit providers. This includes the following categories of personal data:

1. Basic identification data (name and surname, birth name, date of birth, title, national identification number, permanent residence, mailing address, educational attainment, marital status, number of family members).
2. Contact details (e-mail address and telephone number) and all the information from the telephone and electronic communication.
3. Information on financial circumstances (type and amount of monthly income, payment history, current housing situation (i.e., own apartment with or without mortgage, rental housing, living with parents or other), loan(s) repayments expenses, alimony or child support, living expenses, copies of rental agreements, bank statements).
4. Information on employment (employer name, job title, proof of income, duration of employment, type of employment, method of salary payment, information on probation and notice periods, proof of allowances, payslips).
5. Information on business (information on the subject and start of the business, copy of the tax return, tax payment certificate and certificate of no debt to the tax office).
6. Information on other income (pension certificate, parental allowance certificate, disability pension certificate, retirement allowance certificate, orphan’s pension certificate).
7. Information related to the loan application itself (amount of the loan, amount of collateral, maturity, fixation, type of property, additional property for collateral, creditworthiness, number of applicants, bank statements, loan account statements).
8. Information about the property requested (identification of the property, sales contract, future purchase contract, escrow contract, reservation contract, itemized budget, building permit, building location decision, building use decision, inheritance contracts, settlement contracts, lien contracts, loan contracts, property price appraisal and other documents).
9. Other documents (copy of ID card, copy of driver’s licence, copy of travel document, copy of birth certificate; always according to the needs of the individual bank with consent to their collection).

We also process data we collect ourselves through your activity on the websites www.hyponamiru.cz, www.vyrizeno.cz, www.hypapi.cz and linked profiles on the social networks Facebook and Twitter, or from clicks on targeted advertising placed on third-party websites, mainly when using Google Adwords and Google Analytics. This includes the following personal data:

1. All data about your conduct on our website (number of visits, monitoring of mouse movements on the page, visits to individual pages, information about from where you came to our website, etc.).
2. All data about conduct on our social network profiles (number of visits, visits to the individual pages, information about from where you accessed our website, etc.).
3. All data related to targeted advertising on third-party websites.

If you simply visit our website without using our mortgage calculator or financial product brokerage services, we store and subsequently read cookies on your device. These are text files containing small amounts of information that are downloaded to the user’s computer, smartphone or other device when they visit the website. Each time you visit the website again afterwards, the cookies are sent back to the original website or to another website that recognises the cookies. These files allow the identification of the device and the correct display of the website to the user, adapted to their individual preferences.

We use cookies to optimise the use of the website. We also use them to obtain anonymous, aggregate statistical data to help analyse how the user uses the website. This information will help to improve the structure and content of the website.

There are basically two types of cookies used: temporary and permanent. The former are temporary files that remain on your device until you log out of the website or disable them in your web browser. Permanent or fixed files remain on your device for the period specified in the cookies parameters or until you manually delete them. You can modify saving of cookies directly in your web browser; it is usually enabled by default. Links to instructions for cookies settings in the most used browsers are Chrome, Firefox, Internet Explorer, Safari, Opera.

Why do we process personal data?

Each processing of personal data has its own purpose. The purposes of personal data processing are divided into:

1. Purposes for which your consent is not required pursuant to the GDPR – this includes, in particular, processing for the performance of a legal obligation, as permitted by law or necessary for the performance of a contract, the protection of rights and protected interest.
2. Purposes for which personal data can only be processed based on your voluntary consent.

The extent of our right to process your personal data depends on the purpose for which we process the personal data. It also depends on your position vis-à-vis our company.

Processing on the basis of consent

Pursuant to Article 6 par. 1 point a) of the GDPR, processing is lawful if the data subject has given consent to the processing of their personal data for one or more specific purposes.

To use our mortgage calculator services, you must visit our website and thus personal data may be processed in connection with the use of cookies and personal data relating to your conduct on our website. You consent to our use of cookies on the website. We use this personal data for the following purposes:

1. Marketing processing, analysis and profiling to tailor offers regarding financial services and products in the field of consumer housing credit, to improve the services, to develop targeted advertising, to display tailored offers and targeted advertising within the advertising networks on websites other than www.hyponamiru.cz, and to connect to social networks such as Facebook or Twitter, including automatic login, the “Like” button feature, and displaying tailored offers and targeted advertising within these social networks and on websites other than www.hyponamiru.cz.

If you use the mortgage calculator services, we will process personal data for the following purposes:

1. The provision of the service of comparison and brokerage of financial products as described in the Terms and Conditions – this service consists of the automated evaluation of the entered data, providing the results of the comparison and the subsequent free-of-charge contact by the Controller or the cooperating mortgage specialist to broker financial services and products in the field of consumer loans for housing.
2. Brokerage of financial services and products in the field of consumer housing credit by the Controller who is a tied agent pursuant to Section 27 of Act No. 257/2016 Sb., on Consumer Credit, as amended, registered by the Czech National Bank under company ID number 05736501, as a tied agent of the independent consumer credit broker of commercial company Broker Trust, a.s., company ID number: 26439719.
3. Transfer of personal data to an external mortgage specialist to offer financial services and products in the field of consumer housing credit.
4. Consumer credit providers (mainly banks) pursuant to Section 7 of Act No. 257/2016 Sb., on Consumer Credit.
5. Commercial companies HubSpot, Inc., Slack Technologies, Inc., SenGrid and Digital factory s.r.o. for the purpose of management of internet campaigns, internal electronic communication and data analysis for the purpose of processing statistics on your behaviour and the behaviour of other customers in connection with the use of the services and features of the www.hyponamiru.cz portal.

On the basis of consent, personal data is processed for the period of consent, i.e., in the case of the mortgage calculator for the period of 10 years. However, if the consent is withdrawn, the personal data will be deleted even earlier.

Processing necessary for performance of legal obligations

Pursuant to Article 6 par. 1 point a) of the GDPR, processing is lawful if it is necessary for performance of a legal obligation to which the Controller is subject.

The reason for processing is our obligation to comply (mainly) with the following laws:

1. Act No. 257/2016 Sb., on Consumer Credit, as amended.
2. Act No. 634/1992 Sb., on Consumer Protection, as amended.
3. Act No. 89/2012 Sb., the Civil Code, as amended.
4. Act No. 253/2008 Sb., on selected measures against legitimisation of proceeds of crime and financing of terrorism, as amended.
5. Act No. 563/1991 Sb., on Accounting, as amended.

Processing for the purposes of fulfilling our legal obligations means, in particular, the fulfilment of tax and accounting obligations, the performance of review and the fulfilment of the obligation to cooperate with public authorities, including the transfer of your personal data to a public authority (e.g., the Police of the Czech Republic, the Czech National Bank or the competent tax authority).

For these purposes, we use personal data for the duration of the legal obligation, where the specific time limits are set by the aforementioned laws (e.g., archiving periods set by the accounting regulations). These time limits vary depending on the legal obligation involved.

Processing on the basis of legitimate interest

Pursuant to Article 6 par. 1 point a) of the GDPR, processing is lawful if it is necessary for the purposes of the legitimate interests of the Controller or third party concerned, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child.

In addition to the above, we may process your personal data to protect our own rights and legitimate interests. In this case, the processing period is based on the statutory limitation and prescription periods. If judicial, administrative or other proceedings are initiated, we process your personal data to the extent necessary for the duration of such proceedings.

We inform you that pursuant to recital 47 of the GDPR, we may process your personal data for direct marketing purposes for reasons of our legitimate interests. The above applies to cases where we send you marketing communications in connection with the provision of our services.

You have the right to object to this processing pursuant to Article 21 of the GDPR, the decision of such objection will be decided within one month. You can object by e-mailing at info@hyponamiru.cz.

For these purposes, we retain personal data for the duration of the normal limitation period (three years) and one year after its expiry, with respect to claims asserted at the end of the limitation period. If judicial, administrative or other proceedings are initiated, we process your personal data to the extent necessary for the duration of such proceedings and for the remainder of the limitation period after its conclusion.

You have the right to object to this processing based on of our legitimate interest.

Who processes your personal data and who do we transfer it to?

In the case of the mortgage calculator service, we act as the Controller, i.e., we determine the purpose of the processing, and the tools and means of processing. We are also responsible for its proper execution. We work closely with the commercial company Finance na míru s.r.o., company ID number: 29276187, which acts as a joint controller.

We may also transfer your personal data to the following processors or recipients:

1. Cooperating (external) mortgage specialists acting as independent entrepreneurs pursuant to Section 420 of Act No. 89/2012 Sb., the Civil Code, as amended.
2. An independent consumer credit broker, i.e., the commercial company Broker Trust, a.s., company ID number: 26439719.
3. Operators of websites and their content management systems (CMS), mainly the commercial company onspace s.r.o., company ID number: 64510565, and the commercial company Finance na míru s.r.o., company ID number: 29276187.
4. Companies providing delivery and postal services, mainly the commercial company Dropick s.r.o., company ID number: 28436491.
5. Consumer credit providers (mainly banks) pursuant to Section 7 of Act No. 257/2016 Sb., on Consumer Credit.
6. Commercial companies HubSpot, Inc., SendGrid, Smart Decision s.r.o. and Digital factory s.r.o.

We also disclose that we do not transfer personal data to a third country outside the EU or an international organisation.

What rights do you have when processing personal data?

We do everything possible to ensure that the processing of your personal data is carried out properly and, above all, securely. We guarantee you the following rights:

1. Right to information – the right to be informed about the means of processing and related rights.
2. Right to access – the right to know what data we process about you.
3. Right to rectification and completion – the right to update, correct or complete outdated or incomplete personal data. We always strive to keep personal data accurate, true and complete.
4. Right to withdraw consent – in the case of processing based on consent, you can withdraw it at any time.
5. Right to erasure – known as “the right to be forgotten”, we will automatically delete your personal data after the expiry of their processing purpose or the consent withdrawal.
6. Right to restrict processing – in certain cases, in particular in situations where you exercise the right to erasure, rectification or completion of personal data, we will process your personal data in a restricted manner and will not transfer it to anyone until we have removed any doubts about the processing.
7. Right to data portability – the right to obtain personal data in a machine-readable format or to transmit it to another controller.
8. Right to object to processing – in the case of processing based on a legitimate interest, we will review whether these interests override your right to privacy.
9. Right to lodge a complaint – if you believe that we have not dealt with your request in accordance with the GDPR, you have the right to contact the Office for Personal Data Protection.

Where and how can I exercise my rights?

At present, we do not have a data protection officer. Therefore, please contact us directly with requests to exercise your individual rights, either in writing at the delivery address Hanusova 1411/18, Michle, 140 00 Prague 4, or electronically at the e-mail address info@hyponamiru.cz.

Your request will be processed within one month. We are entitled to extend the time limit by two months if necessary, considering the complexity and number of applications. We will inform you of the extension, including the reasons for it, in due time.

We provide all communications and statements regarding the rights you have exercised free of charge. However, if the request is manifestly unfounded or unreasonable, in particular because it is repetitive, we are entitled to charge a reasonable fee considering the administrative costs involved in providing the information requested. In the event of a repeated request for copies of the personal data processed, we reserve the right to charge a reasonable fee for the photocopies and associated administrative costs for this reason.

Right to information about processing of your personal data

You are entitled to request information from us as to whether or not personal data is processed. If personal data is processed, you have the right to request the following information from us:

1. Information about the identity and contact details of the Controller.
2. Information about our representative and data protection officer, if applicable.
3. Information about the purposes of the processing.
4. Information about the categories of personal data concerned.
5. Information about the recipients or categories of recipients of personal data.
6. Information about our legitimate interests.
7. Information about the list of your rights.
8. Information on how to contact the Office for Personal Data Protection.
9. Information about the source of the personal data processed.
10. Information about automated decision-making and profiling.

All the information to which you are entitled is already contained in this Privacy policy, but nothing prevents you from requesting it again in writing or electronically. We will also be happy to provide you with further clarification if anything is unclear to you.

Right to access personal data

You have the right to know what data we process about you. If you are unsure which personal data we process about you, you can ask us to confirm whether and what personal data we process about you – simply speaking, you have the right to access that personal data.

As part of your right to access, you can ask us for a copy of the personal data we process, and we will provide you with the first copy free of charge and subsequent copies at a fee that corresponds only to the cost of making the photocopy and the associated administrative costs.

Right to rectification and completion

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.

We ask you to inform us of any changes to your personal data, such as changes to your e-mail address or telephone number.

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time. In such a case, your personal data will be deleted.

Right to erasure

In certain specified cases, you have the right to request that we delete your personal data. These cases include, for example, that the data processed is no longer necessary for the aforementioned purposes. After a period of 10 years, we delete personal data automatically, however, you can contact us earlier to exercise your right to erasure. Your request will then be subject to an individual assessment and you will be informed in detail about the processing of your request.

A request for the right to erasure will be granted in the following cases:

1. We no longer need the personal data for the purposes for which we processed it.
2. You withdraw your consent to the processing of your personal data, and the data is data for which your consent was necessary and we have no other reason why we need to continue to process this data (processing for a legitimate interest).
3. You exercise your right to object to the processing of personal data that we process on the basis of our legitimate interests and we find that we no longer have such legitimate interests that would allow such processing.
4. You believe that the processing of personal data carried out by us is no longer in compliance with generally binding regulations, in particular the GDPR.

Please note that exercising your right to erasure does not mean that we will immediately delete all of your personal data. This right does not apply if the processing of your personal data is still necessary to comply with our legal obligations, such as accounting and tax obligations, or to establish, exercise or defend our legal claims (in these cases, the processing is based on a legitimate interest).

Right to restrict processing

In addition to the right to erasure, you may also exercise the right to restrict the processing of personal data. This right allows you to request that your personal data be marked and processed in a restricted manner. Unlike the right to erasure, we will continue to store this personal data, however, we will not transfer it to recipients or otherwise process it (we will only store it) during the period of restriction. However, as with the right to erasure, processing of personal data will only take place if we are required to do so by law or in our legitimate interests.

Restrictions on processing will occur in the following cases:

1. You dispute the accuracy of the personal data – until we agree what data is correct and accurate, we will process it in a limited way.
2. We process your personal data without a legal basis, e.g., beyond what we are required to process, but you will prefer to restrict it rather than delete it.
3. We no longer need your personal data for the purposes specified, but you require it to establish, exercise or defend your legal claims.
4. You object to the processing – we are obliged to restrict the processing of your personal data during the period we are investigating whether your objection is justified.

Right to portability

We will provide you with your personal data in a structured, commonly used and machine-readable format. However, it must be data that we process automatically in electronic databases. This means that it will not concern data that we process only as processors on the forms of consumer credit providers (mainly banks), or data that you have provided to us during e-mail or written communication, or data contained in documents submitted for the processing of a consumer credit application according to the requirements of the consumer credit provider concerned. We automatically process only the basic data provided with your consent when completing the mortgage calculator.

If you wish us to disclose your personal data to another controller or company, we will transfer it in the appropriate format to the entity designated by you, provided that no legal, technical or other significant obstacles prevent us or that entity from doing so.

Right to object to processing

In cases where processing is based on a legitimate interest (exercise of our own rights, litigation, etc.), you have the right to object to processing pursuant to Article 21 of the GDPR.

If you find or believe that we are processing personal data in violation of the protection of your private and personal life based on legitimate interest or for direct marketing purposes, including profiling, statistical, scientific or historical purposes, you can contact us and ask us to explain or remedy the situation.

In the case of marketing activities, we will stop processing your personal data without further action. In other cases, we will do so unless we have compelling legitimate grounds for continuing such processing.

Right to lodge a complaint

The exercise of the above rights is without prejudice to your right to lodge a complaint with the Office for Personal Data Protection, located at Pplk. Sochora 27, 17000 Prague 7. For more information, refer to the website www.uoou.cz.