Privacy Policy related to registration to the Chocolate Experience Center

Dear visitors,

please pay attention to this document, where you will find all necessary information regarding your personal data processed in connection with your registration to visit the entertainment center CHOCOTOPIA (hereinafter referred to as „CHOCOTOPIA Center“) operated by Chocolate experience s.r.o., company ID no: 06199682, with a registered office at Celetná 557/10, Staré Město, 110 00 Praha 1, registered in the Commercial Register administered by the Municipal Court in Prague, section C, entry 278006 (hereinafter referred to as „Operator“).

For any questions regarding your privacy protection and the exercise of your rights, please use the following e-mail: gdpr@chocotopia.cz

1. For What Purpose Do We Process Personal Data?

1.1. Registration of Visitors To The CHOCOTOPIA Center – Conclusion and Performance of the Registration Contract

We process personal data primarily for the purpose of registering visitors to the CHOCOTOPIA Center, which we perform following our Rules of Visit. Registration is obligatory for all visitors who visit other sections than the freely accessible parts of the CHOCOTOPIA Center (the cafe and shop) for the purpose of ensuring the safety of CHOCOTOPIA Center’s visitors as well as ensuring the security of property and protection of the Operator’s rights. Among other things, the visitors in the course of the registration confirm that they are familiar with the Rules of Visit and due to age limit for entering the CHOCOTOPIA Center, they also confirm their age which is necessary to be achieved to be allowed to enter. By completing the registration, a registration contract is concluded between the visitor and the Operator (hereinafter referred to as the „Contract“).

Participants are registered through an electronic form that is available to visitors at the entrance to the CHOCOTOPIA Center, or alternatively online on the website www.chocotopia.cz. An adult who accompanies minors at the CHOCOTOPIA Center shall register for both, themselves and the minors.

The following personal data is processed for the purposes of registration of visitors and the conclusion of the Contract:

name, surname and birthdate, contact details (e-mail) of the visitor;
an indication of the visitor’s relationship with the minor they accompany (whether it is a parent or another person authorized to represent a minor visitor at registration),
information on the conclusion and further performance of the Contract,
your signature attached to the registration form (we do not use a biometric signature).

The legal title for processing of the above personal data is the conclusion and performance of the Contract with the visitor. Without provision of the above data, it is not possible to conclude the Contract and thus to allow visitors to visit the CHOCOTOPIA Center.

1.2. Fulfillment of Our Legal Obligations

Often, we have to process your personal data to comply with our obligations imposed by the law. Based on our legal obligations, we process personal data typically when:

carrying out our obligations in the field of accounting and fulfillment of related tax obligations,
archiving when required by the law.

1.3. Legitimate Interests

In justified cases, we also process personal data to protect our legitimate interests, typically to protect our rights in potential legal disputes (protection against claims by visitors against us, or the possibility to claim our rights against visitors), including court proceedings or in case of inspections and proceedings imposed by public authorities (Czech Trade Inspection and others). In such cases, we process your personal data to prove that we have acted in accordance with our contractual obligations or legislation.

Newsletters: We may process personal data from our visitors, from which we have received their email and/or telephone when registering to entry CHOCOTOPIA Center, in order to send them information and news about our similar services or products (especially information about upcoming events organized by the Operator). If you don’t want to receive these messages, you can unsubscribe from the newsletter at any time for free. The option will always be stated in each of the sent newsletters. If you do not wish to receive commercial messages at all, you can contact us via the email above.

We also process the following data for marketing purposes (in order to be able to send you relevant commercial messages): ZIP code, city, and state of your residence.

1.4. Sending Commercial Announcements (Consent)

To persons, who have actively subscribed to the newsletter and have provided us with their email or phone number for this purpose, we process these personal data in order to send them information and news about our services or products.

If you do not wish to receive these newsletters anymore, you can unsubscribe at any time for free. This option will always be indicated in each of the sent newsletters; before receiving the first newsletter, it is possible to withdraw your consent with their receival via the contact e-mail above.

2. Who Do We Receive Personal Information From?

We only collect personal data from you, our visitors. We do not collect any other data about you except for the data you give us, and which may arise as a result of the performance of the Contract. You are obliged to provide only accurate data and if your personal data changes, you must update the data without undue delay (via the contact email above).

3. How Do We Process Personal Data?

Your personal data is processed primarily in electronic form by automated means, namely through the electronic registration form and the Operator’s internal CRM system.

We may also process your personal data manually in accordance with the relevant purpose, where manual processing is necessary or appropriate. Our employees or other persons working for us may act in the management of your data for the purpose of, among other things, removing errors, inaccuracies, etc. However, these persons may only process personal data under the conditions and to the extent mentioned above and are bound by the obligation of confidentiality regarding personal data and security measures, disclosure of which would endanger the security of personal data.

We always process personal data in accordance with applicable legislation and provide them with due care and protection. We take care that you do not suffer harm to your rights, particularly the right to respect for human dignity. We protect personal data in such a way as to prevent unauthorized interference with your private and personal life.

For marketing purposes (targeted advertising – in order to be able to customize the commercial messages we send you), your profiling takes place based on information about your registrations, purchases from the Operator and the use of its services. The profiling is based on our legitimate interests (targeted advertising, preventing irrelevant or annoying commercial messages).

If you do not wish to be profiled for marketing purposes, you have the right to object to profiling and data processing for direct marketing purposes by using the contact details above. If you do so, we will no longer process your personal data for these purposes.

We do not make any automated decision making.

4. To Whom Do We Transfer Your Personal Data?

We use the following processors to process your personal data:

Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT UTRECHT, The Netherlands (systém „Zoho“ pro správu zákazníků)
Špaček Digital, s.r.o., se sídlem Jaurisova 515/4, Michle, 140 00 Praha 4; IČ: 05973180
SenseZOOM s.r.o., se sídlem Jindřišská 939/20, Nové Město, 110 00 Praha 1; IČ: 06035469
DWORKIN, spol. s r.o., se sídlem Praha 8 – Karlín, Rohanské nábřeží 657/7, PSČ 18600; IČ 62956400

Personal data are not transferred outside the EU unless otherwise stated above.

Personal data may be transferred to public authorities for the purpose of exercise of their legal powers.

5. How Long Do We Process Personal Data?

We process your personal data that we process for the purpose of your registration for the duration of the Contract. However, we may still process personal data that we process for the purposes set out below:

5.1. Protection of Legitimate Interests

We keep personal data for the period of the relevant limitation periods (which may be up to 15 years in the Czech Republic, claims for physical harm do not become time-barred) for the purpose of handling potential complaints and exercise of your rights against the Operator, respectively for the purpose of protection of our rights while claiming our rights against you.

For this purpose, the Operator processes your identification data (name and surname, birthdate, information about your residence) and contact information (e-mail, telephone), data on conclusion and performance of the Contract (including data about your visit to the CHOCOTOPIA Center).

5.2. Fulfilling Our Legal Obligations

Personal data that we process based on the law (typically billing data and information on provided services) must be processed for accounting and tax purposes (or for archiving purposes, where applicable). The processing period is 5 years from the end of the accounting period, in the case of documents relevant for VAT payments it is 10 years from the end of the tax period in which the transaction took place. The relevant legal regulation may provide for different periods.

We keep the necessary personal data under the requirements of the Archiving Act.

5.3. Dissemination of Commercial Messages (newsletters)

If you have given your consent to receive commercial messages, we will process your personal data necessary for this purpose until you have unsubscribed from the newsletter (withdrawn the consent) as specified above.

If your personal data is not processed based on your consent, it is not possible to withdraw your consent with processing of your data. However, at your request, we will always assess whether it is still necessary to process the data.

6. What Are Your Rights?

First of all, you have the right to request us to access your personal data, including a copy of all your personal data.

We will always inform you about:

the purpose of processing personal data,
personal data or categories of personal data subject to processing, including all available information about their source,
the nature of the automated processing, including profiling and information relating to the process used, as well as the significance and anticipated consequences of such processing for the data subject,
recipients, or categories of recipients,
the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
any available information considering the source of personal data, unless it is obtained from you.

Your other rights include right to:

ask us for an explanation,
require us to remove the resulting situation, in particular, it may involve blocking, repairing, supplementing, limiting the processing or disposal of personal data (right to be forgotten),
request personal data that relates to you in a structured, commonly used and machine-readable format and pass it on to another controller,
submit a question, respectively file a complaint to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7,
object to the processing of personal data concerning you.

7. How Do We Protect Your Personal Data?

Your personal data is absolutely safe with us. The following security measures are used for this purpose: Antivirus protection, firewalls, encryption, authorization data, physical protection measures, internal data protection directives.