1. General

• 1.1. - This Engu Privacy Policy ("Policy") sets out how we process Your personal data, how we handle such data, and how You can exercise Your rights regarding Your personal data when You use the application, service, or official Engu Website, or any of the other related services ("Services").
• 1.2. - This Policy also provides You with all the necessary information under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR").
• 1.3. - The following definitions are used in this Policy:
  • a) "Company", "We" means BOHEMIA INTERACTIVE a.s., with its registered office at Stříbrná Lhota 747, 252 10 Mníšek pod Brdy, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, File 9791 (Company ID: 272 18 864, VAT ID: CZ27218864).
  • b) "User", "You" means a person, organisation or institution using the Services or entering into an agreement for the provision of any of the Services.
  • c) "Licence Terms" mean the licence terms for the Engu application, available at https://engu.cz/eula .
  • d) “Terms and Conditions” mean the terms and conditions for the provision of the Engu service, available at https://engu.cz/obchodni-podminky.
  • e) "Responsible Person" means the natural person responsible for ordering the Subscription, whether as an individual customer, a contact person for a customer who is a legal entity, or a person acting on behalf of that legal entity.
  • f) “Subscription” means time-limited access to the full version of the Engu educational service provided by the Company under the Engu Service Agreement.
  • g) “Services” are defined in Article 1.1 of this Policy.
• 1.4. - This Policy is an integral part of the Terms and Conditions or Licence Terms, and by agreeing to any of these documents, You declare that You have read and understood this Policy.
• 1.5. - The information contained in this Policy applies to every User of our Services. If You are a legal entity (e.g. a school), this Policy applies in particular to the personal data of the person who represents Your organisation or acts on its behalf in relation to the Subscription.
• 1.6. - The Company expressly declares that the name of the Service, "Engu", may change in the future or be replaced by another name. However, this does not affect the scope or content of the rights and obligations arising from this Policy.
• 1.7. - We are the controller of Your personal data, unless otherwise specified in this Policy. 

2.  Where do we obtain Your data?

• 2.1. - We obtain Your personal data directly from You, to the extent that You provide it to us, for example when You submit a contact form, conclude an agreement or communicate directly with us or our associates.
• 2.2. - We may also obtain some additional data from monitoring the use of the Services. Unless expressly stated otherwise in this Policy, this data is anonymised so that the data subject cannot be objectively identified. 

3.  For what purpose and on what legal basis do we process Your data?

Processing of personal data for the purpose of fulfilling our legal obligations

• 3.1. - We process Your personal data in accordance with Czech legislation applicable to our business activities. As the processing of Your personal data is based on a legal basis, Your consent to such processing is not required.
  • a) If You purchase a Subscription, we process Your personal data in accordance with Act No. 563/1991 Coll., on Accounting, Act No. 235/2004 Coll., on Value Added Tax, and Act No. 586/1992 Coll., on Income Tax, for the purposes of fulfilling our legal obligations under these legal regulations, in particular the storage of records of all performances and payments related to the Subscription.
  • b) If You purchase a Subscription as a consumer, we also process Your personal data for the purpose of fulfilling our obligations under Act No. 634/1992 Coll., on consumer protection.

Processing of personal data for the purpose of fulfilling our obligations under the agreement concluded with You or for taking measures prior to concluding the agreement at Your request

• 3.2. - We also process Your personal data for the purpose of fulfilling our obligations under an agreement concluded with You. If You request it (for example, by filling in and submitting a form), we may also process Your personal data prior to the conclusion of this agreement in order to take the necessary steps to negotiate the agreement. Without processing certain necessary personal data, we cannot conclude an agreement with You and subsequently fulfil our obligations arising from it.
  • a) If You contact us by filling in and submitting one of the forms on our website, we process the personal data You have provided in this way. We use this data to contact You through our representatives for the purpose of negotiating a Subscription and, where applicable, individual terms and conditions. Based on the data You provide in this way, we can also identify You and take further necessary steps to conclude an agreement.
  • b) Once You enter into a Subscription agreement, we are obliged to provide You with the Subscription in accordance with the agreed terms and conditions. We are also obliged to process the relevant payments, issue the relevant invoices, and inform You of important notices relating to the Subscription. We are also entitled to process the necessary personal data for these purposes.

Processing of personal data for the purposes of our legitimate interests

• 3.3. - We also process Your personal data for the purposes of our legitimate interests:
  • a) If You use any of the Services and have provided us with Your email address, we process Your email address to send You notifications to inform You about the Services or related offers or events.
  • b) We may also process Your personal data for the purpose of detecting and preventing fraudulent behaviour, including exceeding the limitations of the application licence or Subscription terms and conditions.
  • c) To a limited extent, we may also process Your personal data collected when monitoring the use of our Services for the purpose of optimising and improving them.
• 3.4. - A list of the categories of data we process under this Article Error: Reference source not found can be found in Annex No. 1 to this Policy. 

4.  How is Your personal data processed?

• 4.1. - Privacy and security are key aspects of creating and providing the Services. We have designated specific responsibilities for addressing privacy and security issues. We enforce our internal policies and guidelines through appropriate selection of activities, including proactive and reactive risk management, security and privacy engineering, training, and evaluation. We take appropriate measures to address online security, physical security, data loss risk, and other similar risks, taking into account the risk posed by the processing and the nature of the data being protected. We also restrict access to our databases containing personal data to authorised individuals who have a legitimate need to access such information.
• 4.2. - The personal data of end users of the Services is not processed or transferred to third parties by us, unless otherwise specified in this Policy. All data collected about traffic on students' computers is anonymous, so we never process their personal data. 

5.  Recipients of Your data

• 5.1. - All personal data that we pass on in accordance with this Article is obtained directly from You or Your organisation.
• 5.2. - The personal data we collect is made available primarily to our selected employees responsible for the Services, and only to the extent necessary for the performance of their job duties. Our employees have entered into a confidentiality agreement with us regarding all information they come into contact with in the course of their duties and are also required to comply with our internal regulations for the use of our systems where they come into contact with Your personal data.
• 5.3. - In addition to our employees, we transfer Your personal data to the extent necessary to selected external partners who are responsible for communicating with customers, negotiating individual terms and conditions, or providing support in the implementation of Services in education. These persons are bound by a confidentiality agreement regarding all information they come into contact with in the course of their work.
• 5.4. - Personal data that we have collected in connection with Your licence to any of the Services may be disclosed to third parties based on legal obligations that we may have. We may provide some of Your personal data to tax authorities, law enforcement authorities and, to a certain extent, judicial authorities.
• 5.5. - Some of Your personal data relating to Your Subscription may be shared with our partners who provide accounting or similar services to us. We may also share a necessary subset of Your personal data that we collect during Your use of the Services with our affiliates for the purpose of operating and improving the Services. All of these partners or affiliates have entered into a confidentiality agreement with us and are also required to comply with our policies governing the use of Your personal data.
• 5.6. - We may share the email address we use to send emails with electronic marketing service providers, provided that the email address will not be used for purposes other than those specified in this Policy.
• 5.7. - If You use a platform provided by a third party to access any of the Services, certain data about this access may be collected and processed by that third party. We are not responsible for the practices of these third parties in this case, so we recommend that You carefully review their privacy policies and, if necessary, the permissions You grant to these third parties.
• 5.8. - A list of our partners and third parties with whom we may share Your personal data is provided in Annex No. 2 to this Policy.

6.  How long do we store Your data?

• 6.1. - We process Your personal data only for the period necessary for the purposes of processing. We continuously assess whether there is still a need to process certain personal data necessary for a specific purpose. If we find that they are no longer necessary for any of the purposes mentioned, we will delete them. The period for which Your personal data is processed is specified in Annex No. 1 to this Policy. 

7.  Your rights

• 7.1. - Right to access and rectify personal data. You have the right to access and rectify or change any incorrect or incomplete personal data we collect about You.
• 7.2. - Right to erasure of personal data. You have the right to request that we erase all of Your personal data that is no longer necessary or that has been processed unlawfully. If You want us to erase Your personal data, You can contact us at dataprotection@bohemia.net. Once we receive Your request, we will erase all personal data that we are required to erase under the GDPR.
• 7.3. - Right to restrict the processing of personal data. You have the right to request that we restrict the processing of Your personal data in certain cases until Your objection or request for deletion or modification of Your personal data has been resolved.
• 7.4. - Right to data portability. You have the right to request that we transfer Your personal data that You have provided to us, if this data is processed on the basis of Your consent or on the basis of an agreement concluded with us and this personal data is processed automatically. If such a request is made, we will provide You with Your personal data that we have collected in a structured, machine-readable form. You are also entitled to request that we transfer this personal data to a new controller, if technically possible.
• 7.5. - Right to object to the processing of personal data. If You believe that the processing of Your personal data based on a legitimate interest is not proportionate to Your rights, You may object to such processing and request that we remedy the situation.
• 7.6. - Right to lodge a complaint. If You believe that we have violated applicable laws in the processing of Your personal data, You have the right to lodge a complaint with the official authority in Your country, in the country where You work, or where Your rights have been violated. In the Czech Republic, this official authority is:
  
  Úřad pro ochranu osobních údajů
  /Office for Personal Data Protection/
  Pplk. Sochora 27
  170 00 Prague 7
  Czech Republic 

8.  Final provisions

• 8.1. - This Policy shall become valid and effective on 30 July 2024.
• 8.2. - We may amend this Policy from time to time in light of changes in the Content of the Services provided. We recommend that You revisit this Policy from time to time to familiarise yourself with any changes to them.
• 8.3. - If You have any questions regarding the processing of Your personal data or wish to exercise any of Your rights under the GDPR, You may contact us at dataprotection@bohemia.net.