American Academy LLC
As of January 1, 2020
This document was prepared by American Academy LLC, registered at 1712 Pioneer Ave. Ste.
2153, Cheyenne, Wyoming 82001, USA, Company Reg. No.: 2017-000752595, registered in
the register kept by the Secretary of State in Cheyenne, Wyoming, conducting business in
the Czech Republic through American Academy LLC, odštěpný závod with its registered
office at U Matěje 24/3, Dejvice, 160 00 Prague 6, Company Reg. No.: 076 67 418, registered
in the Commercial Register kept at the Municipal Court in Prague (Section A, insert 78989)
(hereinafter referred to as the “Company”) for the purpose of providing complete
information on the methods and conditions of processing personal data. This document is
intended to help you better understand issues of privacy protection and is a tool to facilitate
the exercising of your rights and addressing your requirements.
1. Legal framework
The Company always processes your personal data exclusively in accordance with applicable
legislation, i.e. Act 110/2019 Coll., on the processing of personal data, as amended, and
Regulation (EU) 2016/679 of the European Parliament and the Council (hereinafter referred
to as the “GDPR”) and legislation supplementing or replacing them. The Company places
special emphasis on the security of processing and protection of your personal data, which is
an absolute priority for us.
In exercising its business activities, the Company is obliged to comply not only with Act
110/2019 Coll. and the GDPR, but also the following legal regulations, which also impose
obligations affecting the processing of personal data and are binding for the Company:
a) Act 89/2012 Coll., the Civil Code, as amended,
b) Act 262/2006 Coll., the Labor Code, as amended,
c) Act 373/2011 Coll., on specific health services, as amended,
d) Act 187/2006 Coll., on sickness insurance, as amended,
e) Act 155/1995 Coll., on pension insurance, as amended,
f) Act 48/1997 Coll., on public health insurance and on amendments to certain related
acts, as amended,
g) Act 582/1991 Coll., on the organization and implementation of social security, as
amended,
2
h) Act 589/1992 Coll., on social security premiums and contributions to the state
employment policy,
i) Act 561/2004 Coll., on pre-school, primary, secondary, tertiary professional and other
education, as amended,
j) Act 563/2004 Coll., on pedagogical staff and on amendments to certain acts, as
amended,
k) Act 563/1991 Coll., on accounting, as amended,
l) Act 280/2009 Coll., the Tax Code, as amended,
m) Act. 586/1992 Coll., on income taxes, as amended,
n) Act 253/2004 Coll., on value added tax, as amended,
o) Act 480/2004 Coll., on certain information society services and on amendments to
certain acts, as amended,
p) Act 133/2000 Coll., on the population register and personal identification numbers
and on amendments to certain acts, as amended,
q) where appropriate, supplementary, amending or replacing legislation.
The Company is subject to supervision by the Office for Personal Data Protection of the
Czech Republic, to which you may submit a complaint in the event you are not satisfied with
the Company’s procedures for exercising your rights or when processing your personal data.
Office for Personal Data Protection
Pplk. Sochora 27
170 00 Prague 7
2. Who processes your information?
The Controller of your personal data is American Academy LLC, registered at 1712 Pioneer
Ave. Ste. 2153, Cheyenne, Wyoming 82001, USA, Company Reg. No.: 2017-000752595,
registered in the register kept by the Secretary of State in Cheyenne, Wyoming, conducting
business in the Czech Republic through American Academy LLC, odštěpný závod with its
registered office at U Matěje 24/3, Dejvice, 160 00 Prague 6, Company Reg. No.: 076 67 418,
registered in the Commercial Register kept at the Municipal Court in Prague (Section A,
insert 78989). You may exercise all your rights and direct your questions towards this
Controller.
Business partners of the Company include JK Education, s.r.o., Company Reg. No.: 015 55
804, with its registered office at Svatoslavova 333/4, Nusle, 140 00 Prague 4, Czech Republic,
registered in the Commercial Register kept at the Municipal Court in Prague, Section C,
insert 280537, , Pražské humanitní gymnázium, školská právnická osoba, Company Reg.
No.: 25088246, with its registered office at Svatoslavova 333/4, 140 00 Prague 4 - Nusle,
registered in the Register of School Legal Entities kept by the Ministry of Education, Youth
3
and Sports of the Czech Republic in file 2015 under sequence number 027, PHG Servis s.r.o.,
Company Reg. No.: 049 19 661, with its registered office at Svatoslavova 333/4, 140 00
Prague 4, registered in the Commercial Register kept at the Municipal Court in Prague
(Section C, insert 255206), and other companies within the American Education group, i.e.
any company controlled by American Education, s.r.o., Company Reg. No. 071 99 783, with
its registered office at U Matěje 24/5, Dejvice, 160 00 Prague 6, Czech Republic, registered in
the Commercial Register kept at the Municipal Court in Prague (Section C, insert 296485).
The Company processes your personal data through its authorized employees or co-workers,
as well as through trusted processors, whereby it is always the case that such persons:
a) are carefully selected and audited, are of good repute and capable of ensuring the
proper protection of your personal data,
b) are bound by confidentiality under severe sanctions,
c) are bound by strict rules of processing and at the same time they are obliged to
adhere to all of the safety standards that the Company determines and which it
regularly checks,
d) only process your personal data to the extent necessary for the fulfillment of the
given processing task, and only for the necessary period of time,
e) always process your personal data only in the secure environment of the Company’s
information system on secure computer equipment,
f) your personal data is always only processed by the Company or a co-worker who
provides you with mediation/servicing, or the person who personally participates or
participated in the given business case, as well as authorized employees of the
Company’s business partners ensuring the fulfillment of individual administrative or
other processes at the premises of the Company’s business partners, and always only
to the extent necessary for their work activities,
g) are obliged to constantly record all personal data processing activities,
h) are subject to regular and continuous control of the fulfilment of their obligations
when processing and compliance with the Company’s security standards.
3. What personal data does the Company process?
In accordance with the relevant legal regulations, the Company only processes data required
by the relevant legal regulation and data necessary for the Company and its business
partners to act with professional care. The Company further processes the personal data of
its employees, co-workers and third parties, which are necessary for the proper fulfillment of
obligations under the relevant legislation and a specific contract (employment, education,
etc.). For this purpose, the Company processes the following categories of data:
4
i. identification data - personal data used for your identification (name, surname,
maiden name, academic title, date of birth, number of a document proving your
identity, company registration number, etc.),
ii. contact information - personal information used to contact you (permanent
address, mailing address, telephone number, e-mail address),
iii. data necessary for the performance of the employment contract,
iv. data necessary for the provision of education,
v. data required by law for proper accounting, payroll and the organization of
sickness, social and health security;
vi. certain health data, if required in the context of the employer's statutory duties
(e.g. data on the pregnancy of an employee, data on an employee’s incapacity for
work, accidents at work and related medical examinations – initial and periodic),
vii. personal data stated in the CV of the applicant - processed before the selection
procedure in connection with the measures leading to the performance of the
employment contract, and after the selection procedure in the case of for
successful applicants in connection with the performance of the employment
contract,
The Company is obliged or entitled to process the personal data stated above even without
your consent by the Company, as their processing is imposed by the relevant legal
regulations, or the Company is entitled to process the data in connection with the fulfillment
of contractual obligations or based on a legitimate interest (see below). However, it remains
solely up to you whether you provide the Company with your personal information or not.
Nevertheless, if you do not provide personal information in the required scope, the
Company is entitled to not conclude a contract, provide a service or its cooperation.
viii. Personal data for the Company’s marketing activities - personal data processed by
the Company for the purposes of the Company’s marketing activities, in particular
sending commercial messages or advertisements (name, surname, telephone
number, e-mail address, postal address),
ix. Photographs/videos – including photographs/videos from events or meetings,
which require separate consent to be taken, photographs and videos can be used
for promoting the Company by publishing them on social networks, in the
Company’s presentations on the Internet, in leaflets , circulars, etc.
The Company is only entitled to process the personal data referred to in points viii. and ix.
with your consent, and always for the necessary period of time, but no longer than for the
duration of such consent. Granting consent for their processing is entirely voluntary and
does not affect the duration of any further cooperation.
5
The Company always processes personal data only to the extent necessary for the fulfillment
of the given purpose.
In general, the Company only processes the personal data that you have provided. In some
isolated cases, the Company also obtains personal data from publicly available sources or
from public authorities (courts, bailiffs, supervisory authorities, etc.), or from other
controllers or processors.
As the controller of personal data, the Company may also obtain personal data from a
person who processes personal data for the Company on the basis of a written
authorization.
4. What purposes does the Company processes personal data for?
The Company processes your personal data for the following purposes:
a) performance of its own activities,
b) fulfillment of its legal obligations,
c) performance of contractual obligations,
d) protection of persons, property, data, trade secrets and the legitimate interests of
persons, including proper identification and authentication of acting persons,
e) determination, execution and defense of the legal claims of the Company,
for the purposes referred to in point (a) to (e), the Company is entitled to process your
personal data even without your consent.
f) marketing actions and promotional activities of the Company - sending of marketing
offers, advertising, actions to increase brand awareness, promotions on the Internet,
g) where appropriate, other purposes.
For the purposes of points (a) to (g), the Company processes personal data solely with your
consent.
The Company is also entitled to process personal data (if applicable) for the purpose of
determining, exercising and defending its own legal claims, even though the personal data
have been obtained for another purpose. The Company is entitled to proceed in this way in
the event that the original purpose and the purpose of the defense of legal claims are
related or linked to each other in any way.
5. On what legal basis and for what period does the Company process
personal data?
6
The Company processes personal data within the meaning of Article 6 or Article 9 of the
GDPR on the following legal bases:
a) data subject has given consent - personal data are processed on this legal basis in
the absence of (if it is not possible to apply) another legal basis for the processing,
and always for the duration of the purpose for which the personal data were
obtained; however, until the withdrawal of the consent, whereas in such cases, you
always have the right to withdraw your consent (ways of withdrawing consent are
listed below), this deals with the processing of photographs, etc.,
b) performance of a contract - if a contract has been concluded between you and the
Company, the Company is entitled to process personal data obtained during the
performance of the contract or necessary for the exercise of the rights and
obligations under the contract, and for the duration of the relevant contract,
c) compliance with a legal obligation - The company is obliged to process selected
personal data, if such an obligation is stipulated by the relevant legal regulation, for
the period specified in the relevant legal regulation.
d) legitimate interest of the Company - in this case, the Company processes personal
data for the duration of its legitimate interest (typically the protection of persons
and property). In the event that you object to such processing justified by your
individual situation and your objection is accepted by the Company after due
consideration, the Company is obliged to terminate the given processing.
The Company’s legitimate interests include, in particular, the legitimate interest of:
i. conducting business as its principal gainful activity, which is the source of
income for the Company;
ii. ensuring the basic organizational and functional processes of the Company,
iii. determining, exercising and defending the Company’s legal claims,
iv. the protection of persons, property, data, trade secrets and the legitimate
interests of persons, including the interest in the proper identification and
authentication of acting persons.
Any personal data can be processed on several legal bases. Any personal data may be
processed provided there is at least one legal basis for its processing. In the event that the
last legal basis for the processing of the personal data is absent, the personal data must be
properly destroyed.
6. Who can personal data be provided to?
The Company is entitled to provide personal data to the following entities:
7
a) state authorities and other entities during the fulfillment of a legal obligation within
the meaning of the relevant legal regulations (e.g. .Act 187/2006 Coll., on sickness
insurance, as amended, Act 155/1995 Coll., on pension insurance, as amended, Act
582/1991 Coll., on the organization and implementation of social security, as
amended, etc.),
b) processors of personal data on the basis of a written contract for the processing of
personal data and providing sufficient technical and organizational guarantees to
protect personal data (e.g. IT service providers, accountants, etc.),
c) employees or other persons in a similar contractual relationship with the Company
for the performance of their duties on behalf of the Company;
d) other entities, if necessary for the determination, execution or defense of the
Company’s legal claims (e.g. courts, executors, lawyers, etc.),
e) other persons, with your consent,
whereby the personal data are provided to the above-mentioned recipients only to the
extent necessary for the intended purpose and for the necessary period of time.
7. Principles of personal data security
The Company is strictly committed to complying with all of the security and organizational
measures, which it has implemented to protect personal data.
The Company regularly and consistently checks compliance with security and organizational
measures to ensure the protection of personal data, regularly evaluates the findings and
updates its security and organizational measures as necessary.
Personal data are processed solely by authorized persons thoroughly reviewed by the
Company both before and during the processing. All persons who have access to personal
data are bound by the obligation of confidentiality under strict sanctions.
8. What are your rights and how you can exercise them?
Articles 15-22 of the GDPR define the rights that you may exercise against the Company. To
facilitate the exercising of your rights, the Company has created a simple form. Please always
use this form to avoid unnecessary prolongation of the entire process of exercising of your
rights and further possible complications.
Please send the signed and completed form to:
American Academy LLC, odštěpný závod
Svatoslavova 333/4
8
Nusle
140 00 Prague 4
or
American Academy LLC, odštěpný závod
Dominikánské nám. 656/2
602 00 Brno-střed
In order to protect your personal data, we DO NOT RECOMMEND sending a SIGNED AND
COMPLETED FORM via an unencrypted e-mail message.
You may exercise the following rights at your discretion:
a) right of access - The Company will provide you with an extract (confirmation) of
personal data processed about you to the extent pursuant to Article 15 of the GDPR
on the basis of an application (form) with your officially verified signature,
b) right to rectification - if you find that the Company is processing inaccurate or
outdated personal data, the Company is obliged to rectify inaccurate personal data
without undue delay after being notified of the fact, this is done on the basis of a
written request (form),
c) right to erasure - in the cases stated in Article 17 of the GDPR, the company shall
delete the processed personal data (in particular, in cases where you withdraw your
consent for the processing and there is no other legal basis for such processing, you
object to the processing and there are no the overriding legitimate interests of the
Company for the processing, when personal data are no longer needed for the given
purpose,…), this is done on the basis of a written request (form) or automatically, if
the personal data are no longer needed for the given purpose of processing,
d) right to restriction of processing - the Company will temporarily restrict the
processing of personal data until it assesses the legitimacy of your objection to the
processing, or until it verifies the accuracy of the personal data which you contest, or
in the event that the processing is unlawful, and you oppose their deletion and
request the restriction to their use instead. This is done on the basis of a written
request (form) if you request a restriction, or automatically in the case of a right of
objection or correction,
e) right to portability - if the processing of specific personal data is based on consent or
a contract and if it is carried out by an automated means, you have the right to
receive the personal data concerning you and transfer them to another controller.
This is done the basis of a written request (form) with your officially verified
signature,
9
f) right to individual dispute - if the processing is based on a legitimate interest of the
Company, you have the right to object to such processing for reasons specific to your
particular situation. The objection will be thoroughly assessed by the Company. The
objection shall be granted if your individual interest outweighs the Company’s
legitimate interests. This is done on the basis of a written request (form),
g) right to raise an absolute objection to direct marketing - if personal data are
processed for the purposes of direct marketing, you may raise an absolute objection.
Unlike the individual objection under (f) of this Article, this objection is not
considered, but processing for these purposes is automatically terminated. This is
done on the basis of a written request (form) or by clicking on the link provided
directly in the specific electronic marketing message,
h) right to withdraw consent to processing - consent to processing of your personal data
can be withdrawn either as a whole or for individual processing purposes. The
Company will no longer process personal data for which the consent to processing
has been withdrawn unless it has another legal basis for processing. The consent can
be withdrawn electronically by completing and confirming the form for the
withdrawal of consent to processing personal data, which will be sent to your e-mail
address after you send the message to study@americanacademy.com.
i) right not to be subject to a decision based solely on automated processing, including
profiling, which produces legal effects or similarly significantly affect you - this right
does not apply, the Company does not make any automated decisions, which
produce legal effects or similarly significantly affect you.
In all of the above cases, the Company will provide you with information on how your
request has been resolved without undue delay, but no later than one month after receiving
your request. Given the complexity and number of applications, the deadline can be
extended by a further two months.
In cases where requests are manifestly unfounded or disproportionate, in particular because
they are recurring, the Company may refuse to comply with the request or impose an
administrative fee for processing the request taking into account the costs of providing the
information.
The Company has appointed a Data Protection Officer to ensure the protection of personal
data and maintain quality and safety standards in the processing of personal data. The Data
Protection Officer can be contacted in the event of any uncertainty, questions or complaints
regarding the protection of personal data.
Data Protection Officer:
Tomáš Netopil
netopil@jkeducation.cz
10
These principles for the processing and protection of personal data are updated on an
ongoing basis.