Skip to main content

Privacy information for users, customers and other persons affected by the operation of the BUT e-shop

1. Personal data controller and e-shop operator

The personal data controller and e-shop operator is:

Brno University of Technology, Antonínská 548/1, 602 00 Brno, Identification No: 00216305, Tax ID No: CZ00216305, is a public higher education institution established by law. In the course of its activities, Brno University of Technology processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and repealing Directive 95/46/EC (General Data Protection Regulation), and other legislation. In connection with the above Regulation taking effect (hereinafter also the “GDPR”), Brno University of Technology (hereinafter also “BUT”) appointed a Data Protection Officer, Mgr. Lucie Schimmelová. The Data Protection Officer can be contacted at: Brno University of Technology, Gorkého 62/13, 602 00 Brno, email: poverenec@vut.cz.

(hereinafter the “University” or “controller”).

The e-shop at https://eshop.vut.cz is operated directly by the University through its authorised employees and relevant departments. The University determines the purposes and means of personal data processing connected with operating the e-shop, managing customer accounts, receiving and fulfilling orders, handling payments and billing, delivering goods and providing ordered services.

Any external suppliers of technical, hosting, maintenance, payment, transport or other support services are not operators of the e-shop. They process personal data only to the extent appropriate to the nature of the service they provide and their status under the applicable legislation.

2. Purposes of personal data processing

The University processes the personal data of e-shop users and customers in particular for the purposes of:

  • operating and administering the University e-shop and providing its basic functions,
  • creating, maintaining and managing customer accounts,
  • receiving, recording and fulfilling orders,
  • taking steps before entering into a contract and entering into and performing a contract,
  • handling payments and billing and keeping accounting and tax records,
  • preparing, handing over or delivering goods,
  • providing ordered services,
  • communicating with customers about their orders or contracts,
  • providing customer support,
  • handling contract withdrawals, claims concerning defects, complaints and other customer requests,
  • securing the e-shop, customer accounts and related information systems,
  • preventing fraud and other unauthorised conduct,
  • protecting the rights and legitimate interests of the University and other persons, including establishing, exercising or defending legal claims,
  • fulfilling the University’s statutory accounting, tax, record-keeping, inspection and other obligations,
  • sending commercial communications and offers where the legal requirements are met,
  • measuring visitor traffic, evaluating performance and improving the e-shop, where relevant analytics or similar tools are used for these purposes.

Depending on the nature of the goods or services ordered, different University departments or units may be involved in fulfilling an order and supplying what was ordered. This nevertheless remains personal data processing carried out by the University as a single controller.

3. Legal basis for processing

The personal data of e-shop users and customers are processed in particular on the following legal bases:

a) Performance of a contract

Under Article 6(1)(b) of the GDPR, personal data are processed where necessary:

  • to take steps at a customer’s request before entering into a contract,
  • to receive and fulfil an order,
  • to enter into and perform a contract,
  • to create and maintain a customer account,
  • to arrange payment, deliver goods or provide a service,
  • to conduct related communications with the customer,
  • to handle a claim concerning defects, withdrawal from a contract or another request arising from the contractual relationship.

b) Compliance with a legal obligation

Under Article 6(1)(c) of the GDPR, personal data are processed where necessary for the University to comply with its legal obligations, particularly those arising from legislation governing:

  • accounting and taxation,
  • consumer protection,
  • handling claims concerning defects and withdrawals from contracts,
  • records management and archiving,
  • providing assistance to public authorities.

c) Legitimate interests

Under Article 6(1)(f) of the GDPR, personal data may be processed where necessary for the legitimate interests of the University or a third party, in particular:

  • securing the e-shop, customer accounts and information systems,
  • preventing and detecting fraud or other unauthorised conduct,
  • protecting the University’s property and rights,
  • establishing, exercising or defending legal claims,
  • conducting necessary communications with the contact persons of customers that are legal persons,
  • ensuring the basic operation and technical functioning of the e-shop,
  • sending existing customers offers for the University’s own similar goods or services, where the legal requirements are met.

The University processes personal data on the basis of legitimate interests only where those interests are not overridden by the interests, fundamental rights or freedoms of the person concerned.

d) Consent

Under Article 6(1)(a) of the GDPR, personal data are processed on the basis of consent, in particular:

  • when sending commercial communications where no other legal basis is available,
  • when using analytics, marketing or other optional cookies and similar technologies,

Giving consent is voluntary. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

Further details about cookies and similar technologies are provided in the separate Cookie Notice.

4. Categories of personal data processed

The University processes, in particular, the following categories of personal data:

a) Identification and contact details

First name, surname, title where applicable, email address, telephone number, billing address, delivery address and other details necessary to identify the customer, communicate with them and fulfil their order.

b) Customer account details

User identifier, email address, authentication and security data associated with the account, order history, account settings and selected preferences.

If the customer account is password-protected, the password is stored only in a secure form.

c) Order and contract details

Details of the goods or services ordered, quantity, price, discounts, payment method, delivery method, order status, the contract concluded, the exercise of contractual rights and other information relating to the order.

d) Billing and payment details

Billing details, payer details, name or business name, identification number (IČO), tax identification number (DIČ), bank account number, payment reference (variable symbol), details of payments made or refunded and other information required for accounting, tax and payment administration.

When payment is made through a payment gateway, the University does not receive full payment card details. These details are processed by the relevant payment service provider in accordance with its own terms and privacy information.

e) Delivery or service provision details

Recipient’s first name and surname, delivery address, telephone number, email address, selected delivery or collection method and other details needed to deliver the goods or provide what was ordered.

f) Communications and the exercise of rights

The content of communications with the customer, information provided in enquiries, claims concerning defects, complaints, requests, notices of withdrawal from contracts and other submissions, including details of how they were handled.

g) Operational and technical data

IP address, device and browser details, date and time of access, login records, operational and security logs, data on browsing and activities in the e-shop, and data obtained through cookies or similar technologies.

h) Marketing data and preferences

Email address, telephone number, records of consent given or withdrawn, objections to direct marketing, subscriptions or unsubscriptions to commercial communications and, where applicable, responses to communications sent.

The University processes personal data only to the extent necessary for the relevant purpose.

Special categories of personal data, particularly health data, are not specifically requested in the routine operation of the e-shop. Users should therefore not enter such data in free-text fields unless they are necessary for the specific purpose.

5. Sources of personal data

Personal data are obtained in particular:

  • directly from users or customers when they register, create a customer account, place an order or communicate with the University,
  • from data generated through use of the e-shop, fulfilment of orders and performance of contracts,
  • from payment service providers, banks, carriers and other parties involved in fulfilling an order,
  • from the client where they name another person as the recipient of the goods, services or other performance ordered,
  • from publicly accessible registers where necessary, for example to verify the billing details of a business or legal person.

6. Requirement to provide personal data

Personal data marked as mandatory in the e-shop are required to enter into and perform the contract or to comply with the University’s statutory obligations.

Without these data, it may not be possible in particular to:

  • create a customer account,
  • receive and fulfil an order,
  • enter into and perform a contract,
  • receive or refund a payment,
  • issue an accounting or tax document,
  • deliver goods or provide a service,
  • handle a claim concerning defects, withdrawal from a contract or another request.

Providing personal data for marketing purposes and consenting to the use of optional cookies or similar technologies are voluntary and do not affect the ability to make a purchase. Rejecting certain optional cookies may restrict only the related additional functions of the e-shop.

7. Recipients of personal data

Personal data may be disclosed or transferred to the extent necessary, in particular to:

  • authorised University employees and other authorised persons responsible for operating the e-shop, managing orders, billing, payments, preparing and delivering goods, providing services or customer support,
  • the relevant University departments and units providing the goods or services ordered,
  • any suppliers of technical solutions, hosting, cloud, software, maintenance or other IT services,
  • payment service providers, payment gateways and banks,
  • providers of postal, transport, collection point and delivery services,
  • providers of accounting, tax, audit, legal and advisory services,
  • any providers of communication, customer support and commercial email tools,
  • public authorities and other authorised bodies where required by legislation or a binding decision of the competent authority,
  • other parties whose involvement is necessary to fulfil a particular order or provide what was ordered.

External parties are not operators of the e-shop.

The University discloses or transfers personal data only to the extent necessary and only where there is an appropriate legal basis for doing so.

8. Transfers of personal data to third countries

Personal data are not transferred to third countries or international organisations in connection with the operation of the e-shop.

9. Personal data retention periods

Personal data are retained only for as long as necessary for the relevant purpose and subsequently for as long as required by legislation or as necessary to protect the rights and legal claims of the University or the persons concerned.

In particular, the individual categories of personal data are retained as follows:

  • customer account data: for as long as the account exists; once it is closed, data no longer needed for other ongoing processing purposes are erased,
  • order and contractual relationship data: for the duration of contract performance and subsequently for as long as related rights and legal claims may be asserted or defended,
  • accounting and tax documents: for the period required by the applicable accounting and tax legislation,
  • data on claims concerning defects, contract withdrawals, complaints and other requests: until they have been resolved and subsequently for as long as necessary to protect the rights of the University or the person concerned,
  • personal data processed to send commercial communications on the basis of consent: for the period specified when consent is given, but no longer than until consent is withdrawn or the relevant purpose ceases to apply,
  • personal data used to send existing customers offers for the University’s own similar goods or services: until an objection is raised or the conditions for such processing are no longer met,
  • records of consent given or withdrawn, unsubscriptions from commercial communications or objections to direct marketing: for as long as necessary to demonstrate the University’s compliance with its obligations and ensure that the person concerned is not contacted again without authorisation,
  • operational and security logs: for as long as necessary to secure the e-shop, resolve technical and security incidents and prevent misuse,
  • data obtained through cookies or similar technologies: for the period specified in the Cookie Notice and the settings of the relevant tool.

If a dispute, inspection, administrative procedure or court proceedings begin, the related personal data may be retained until the matter is finally resolved and the resulting rights and obligations have been settled.

Once the specified period expires, personal data are erased or anonymised, paper documents are securely destroyed, and documents designated for archiving are retained under the applicable archival arrangements.

10. Rights of the data subject

Subject to the conditions set out in the GDPR, e-shop users and customers have the right to:

  • request access to their personal data,
  • request rectification of inaccurate personal data,
  • request completion of incomplete personal data,
  • request erasure of personal data where permitted by law,
  • request restriction of processing,
  • object to processing based on Article 6(1)(f) of the GDPR,
  • object at any time to the processing of personal data for direct marketing,
  • request portability of their personal data where processing is based on consent or a contract and is carried out by automated means,
  • withdraw consent at any time where processing is based on consent,
  • lodge a complaint with a supervisory authority.

Requests to exercise these rights may be submitted using the controller’s or Data Protection Officer’s contact details given above.

11. Right to lodge a complaint

E-shop users and customers have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection

Pplk. Sochora 27
170 00 Prague 7

Further contact details are available on the supervisory authority’s website.

12. Automated decision-making

The routine operation of the e-shop does not involve decisions based solely on automated processing of personal data, including profiling, that produce legal effects concerning the person or similarly significantly affect them.