GDPR

Information on the processing of personal data of customers

Administrator

The controller of personal data is TEMPUS DESIGN a.s., company ID No.: 087 67 220, with registered office at V parku 2294/4, Chodov, 148 00 Prague 4, registered in the Commercial Register kept by the Municipal Court in Prague under file No. B 24969 (hereinafter referred to as "TEMPUS" or "we").

For the purposes of this information, TEMPUS shall also mean any legal successor of the aforementioned companies, persons related to the aforementioned companies by property or personnel, persons controlled or controlling the aforementioned companies, or other persons related to the aforementioned companies in any other way, in particular all other companies of the TEMPUS Group.

Purposes and legal basis for processing

We process personal data for the following purposes:

1. the conclusion and performance of contracts with customers on the basis of the performance of the contract, if the customer is a natural person, or on the basis of our legitimate interest in the performance of such a contract, if it is a natural person who represents the customer;
2. internal administrative needs, production of statistics and records, based on our legitimate interest in ensuring proper recording of contracts concluded with customers;
3. sending newsletters and commercial communications, based on our legitimate interest in promoting our products and services to existing customers, or based on your consent if they are not existing customers;
4. the protection of property and persons, based on our legitimate interest in ensuring the protection of our property, the property of our employees and third parties, and ensuring security;
5. protection of legal claims, based on our legitimate interest in ensuring the proper protection and effective exercise of our rights and claims;
6. the fulfilment of general legal obligations, in particular in the field of tax and accounting, on the basis of the legal obligation to which we are subject as administrators.

Personal data processed and retention period

For the above purposes, we process, in particular, identification and contact data, data on the use of services and on the parameters of the services provided and records of mutual communication. We obtain this data directly from you by filling it in on the relevant forms and in the contractual documentation. In addition, to a limited extent, we obtain and further process personal data from publicly available sources, which are public registers (e.g. insolvency register or execution registers), always in accordance with legal requirements.

We keep personal data to the extent necessary for:

1. the duration of the contract in question in the case of the purpose under a) above;
2. for the duration of the contract in question and subsequently for a period of 3 years from its termination in the case of the purpose under point (c) above;
3. the duration of the limitation period, including the period covering any suspension or interruption thereof, but typically not more than 16 years after the termination of the contract in the case of the purposes under (b), (d) and (e) above;
4. the fulfilment of the relevant legal obligations in the case of the purpose under point (f) above.

Who processes your personal data and to whom do we transfer it?

All of the above-mentioned personal data are processed by us as the controller. This means that we determine the above defined purposes for which we collect your personal data, determine the means of processing and are responsible for its proper execution.

We generally do not pass on your personal data to other controllers. The exceptions to this are cases where we are obliged to pass on such data by law (in particular to tax authorities, courts and police in the exercise of their legal powers) and cases where we pass on such data to state authorities or third parties (in particular to victims of unlawful conduct) in order to achieve the aforementioned purposes.

Based on our legitimate interest, we may also share personal data with other TEMPUS Group companies for the purpose of managing customer relationships across the Group.

We also involve other entities as processors who process personal data for our company and according to our instructions. These are mainly information systems and technical infrastructure providers, and marketing agencies.

All processors are bound by a processing agreement to comply with the requirements of data protection legislation, in particular to protect your personal data.

What rights do you have when processing personal data?

Just as we have rights and obligations when processing your personal data, you also have certain rights when processing your personal data. These rights include:

• Right to withdraw consent to processing

You may withdraw your consent at any time. However, this does not affect the lawfulness of the processing based on the consent given before its withdrawal.

• Right of access

Simply put, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we transfer it, who processes it outside of us and what other rights you have in relation to the processing of your personal data. You can find out all of this in this Personal Data Processing Information. However, if you are unsure which personal data we process about you, you can ask us to confirm whether or not personal data relating to you is processed by us and, if it is, you have the right to access it. As part of your right of access, you can ask us for a copy of the personal data we are processing and we will provide you with the first copy free of charge and subsequent copies at a charge.

• Right to repair

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.

• Right to erasure

In some cases, you have the right to have us delete your personal data. We will delete your personal data without undue delay if one of the following reasons is met:

1. We no longer need your personal data for the purposes for which we processed it;
2. you exercise your right to object to processing (see "Right to object to processing" below) for personal data that we process on the basis of our legitimate interests and we find that we no longer have any such legitimate interests that would justify such processing;
3. it turns out that the processing of personal data carried out by us is no longer in accordance with generally binding regulations.

This right does not apply if the processing of your personal data is still necessary for:

1. to fulfill our legal obligation;
2. for archival, scientific or historical research or statistical purposes; or
3. establish, exercise or defend our legal claims.
   • Right to restriction of processing

In some cases, in addition to the right to erasure, you can exercise the right to restrict the processing of personal data. This right allows you in certain cases to request that your personal data be marked and not subject to any further processing operations - in this case, however, not forever (as in the case of the right to erasure), but for a limited period of time. We must restrict the processing of personal data if:

1. you dispute the accuracy of the personal data before we agree what data is correct;
2. We process your personal data without a sufficient legal basis (e.g. beyond what we need to process), but you may prefer to limit such data before deleting it (e.g. if you expect to provide us with such data in the future anyway);
3. We no longer need your personal data for the above processing purposes but you require it for the establishment, exercise or defence of your legal claims; or
4. object to the processing. The right to object is described in more detail in the section "Right to object to processing" below. We are obliged to restrict the processing of your personal data for the period of time that we are investigating whether your objection is justified.
   • Right to portability

You have the right to obtain from us all your personal data that you have provided to us and that we process on the basis of the performance of the contract. We will provide you with your personal data in a structured, commonly used and machine-readable format. In order to enable us to easily transfer the data at your request, it may only be data that we process automatically in our electronic databases. Therefore, we cannot always and under all circumstances transfer to you in this form all data that we keep in paper form.

• Right to object to processing

You have the right to object to the processing of your personal data based on our legitimate interest. We will stop processing your personal data if we do not have compelling legitimate grounds to continue such processing.

• Right to lodge a complaint

Exercising your rights in the above manner is without prejudice to your right to lodge a complaint with the Office for Personal Data Protection. You can exercise this right in particular if you believe that we are processing your personal data unlawfully or in violation of generally binding legal regulations.

You can file a complaint with the Office for Personal Data Protection, which is located at Pplk. Sochora 27, 170 00 Prague 7.

How can I exercise individual rights?

You can contact us on all matters related to the processing of your personal data, whether it is an enquiry, exercising a right, lodging a complaint or anything else, using the following contacts:

by e-mail to: pravni@tgx.cz, or

in writing at V parku 2294/4, Chodov, 148 00 Praha 4

Current contact information is available on our website.

We will process your request without undue delay, but within one month at most. In exceptional cases, in particular due to the complexity of your request, we are entitled to extend this period by a further two months. We will, of course, inform you of any such extension and the reasons for it.

TEMPUS group