POLICY FOR THE PROCESSING OF PERSONAL DATA

of the BDCG, a.s. company

Introduction

During cooperation with company BDCG, a.s., ID No.: 282 63 456, with registered office at Křižíkova 213/44, Karlín, 186 00 Prague 8, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Insert 18706 (“Company“) you entrust us with your personal data. The Company takes the protection of personal data seriously and handles personal data with sufficient care and responsibility in the conduct of its business activities.

We would like to explain to you how we treat your personal data and how we comply with the obligations arising from the processing of personal data under the relevant legislation, in particular Regulation (EU) No. 2016/679 from 27. April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR“) and national regulations governing the protection of personal data.

The Company has put in place and will continue to put in place appropriate technical and organisational measures to ensure that personal data is protected from misuse, loss or damage and will treat data in accordance with the GDPR and data protection legislation.

Collection and use of data

The Privacy Policy applies to the processing of personal data of our partners, suppliers, employees or directors of the Company, their family members, job applicants, customers and other individuals whose personal data is processed by the Company and to anyone else who contacts the Company or otherwise sends the Company any personal data (unless otherwise stated below). This means anyone who uses or provides services or subcontracts to the Company.

The company respects the basic principles set out in the GDPR when processing personal data. The relevant basic principles are set out below:

• Lawfulness principle – at least one legal basis for processing must be established before personal data can be processed;

• Purpose limitation principle – processing of personal data only for a predetermined purpose;

• Data minimisation principle – processing only personal data necessary, relevant and proportionate to the legitimate purpose;

• Fairness and transparency principle – openness and transparency of processing towards data subjects;

• The principle of integrity and confidentiality, the principle of access only to necessary information – implementation of the necessary organisational and technical measures to ensure that access to personal data is restricted so that it cannot be processed in an unauthorised or unlawful manner;

• Accuracy principle – processing of accurate and up-to-date personal data.

Legal basis for processing and purposes of processing personal data

The processing of personal data is always based on legal grounds for processing, including consent to the processing of personal data, compliance with a legal obligation, performance of a contract, legitimate interest, public interest or protection of the interests of the data subject.

Data controller

The data controller is the Company, which has established internal rules for the handling of personal data for these purposes. If you would like to contact us and ask us anything about the processing of your personal data, you can use the following contact details:

Email: jiri.brada@bdcg.cz

Tel: + 420 602 611 064

Correspondence address: BDCG, a.s.

Křižíkova 213/44, Karlín, 186 00 Prague 8

What data do we collect?

The Company collects the following categories of data:

1. Information you provide to the Company yourself

Information provided on these occasions:

• when entering into a contractual relationship between you and the Company
• the information you provide to the Company for the purpose of the business relationship
• if you contact the Company with your own offer of services or goods.

2. Information from other sources

Such sources include:

• publicly available sources, including public registers and the Internet,
• information we have received from third parties, such as your employers, co-workers or business partners, which we need to carry out our business relationship.

The Company may combine information gathered from these sources with other information available to it.

Why do we collect your data?

The Company is entitled to use the collected data for the following purposes:

1. Asset protection

If you come to visit us and are on our premises, the following collection of your personal data may occur:

• reception may ask you to provide your personal data;
• we operate a camera system in some buildings, which you can always find a separate notice at the entrance to the respective building.

We use the data collected in this way exclusively to protect the Company’s property and do not process or pass it on to third parties, but we reserve the right to use it in accordance with point 7. Below.

2. Conclusion, amendment and termination of contracts

We use the data to prepare contract documentation, amend contracts or terminate contracts.

We also use the data to keep records of the services and (sub)leases provided so that we can provide all the services to which we have committed, for proper billing of the services provided or for communication in connection with the services provided.

For this purpose, we absolutely need your personal data in order to comply with the legal requirements for entering into, amending and terminating the contractual relationship.

3. Reaching out for cooperation

We use the data to request services and products from suppliers.

4. Business activity

We use the data for the execution of orders and for communication with suppliers. We absolutely need your personal data in order to carry out the order.

5. Bookkeeping

We use the data for invoicing and bookkeeping. We absolutely need your personal data to comply with legal requirements for bookkeeping.

6. Recruitment of new employees

If you send us your CV, we will use your data in connection with the recruitment process. We only process your personal data in this way for the duration of the selection process, unless you give us your consent to store your data for a further two years in case of a new position opening up in the future.

7. Legal proceedings and defence of legal claims

We are entitled to use the collected data in connection with the investigation of offences and criminal offences or the settlement of disputes or legal claims related to business cooperation with the Company or in other cases permitted by applicable law.

Who can we share your personal data with?

The company may share the data collected:

1. With our contractual partners

The Company may only disclose information to its associates, suppliers, software providers, third parties who provide accounting services for the Company, consultants, advisors and other service providers or business partners, or to the owners of the real estate in which the subject of the (sub)lease is located, or to investment funds or companies for whose benefit the real estate is managed, if this is necessary for the performance of the services or if there is a legal interest in doing so.

We would like to assure you that all business partners of the Company are bound by the obligation of confidentiality, respectively. other agreed terms of processing and handling of personal data.

2. For legal reasons or in case of disputes

The Company may share your information when required to do so by law or other legal requirements, contracts, or upon request by government authorities:

• with the police and courts, government authorities or other third parties where necessary to enforce our rights or to protect the rights or property of the Company or other parties, or where disputes or legal claims arise in connection with the use of our services or business with the Company;

• with other parties in connection with any corporate conversion, sale of the Company’s assets, consolidation or restructuring, financing or transfer of the Company or any part thereof to the ownership of another company.

3. WITH YOUR CONSENT

The Company may also share your information in other ways if it notifies you and you agree.

What are your rights in relation to the processing of personal data?

The Company takes all necessary steps to enable you, as data subjects, to exercise your rights under the GDPR. In relation to the processing of personal data, the rights of data subjects include the right of access to personal data, the right to rectification, restriction of processing, portability or erasure of personal data, the right to object to the processing of personal data and the right not to be subject to any decision based solely on automated processing of personal data.

Data subjects may request the exercise of their rights by means of a written or oral request. In order to ensure sufficient protection of personal data processed by the Company and to prevent misuse of personal data, the Company has adopted the following rules for the verification of the identity of data subjects.

Written requests

For a written request to exercise the right, the data subject completes the request form, which can be downloaded here. The signature of the data subject on the form must be officially certified.

Oral requests

Data subjects may also request the exercise of a particular right in person at the Company’s registered office.
Your identity will be verified by an authorised member of staff (e.g. at reception) on presentation of one of the following documents: an ID card, passport or other document with a photograph sufficient to clearly identify you.

The exercise of the rights of data subjects shall be without prejudice to the rights of third parties. In the event that requests from data subjects are manifestly unfounded or unreasonable, in particular because of their repetitive nature, the Company may require a reasonable fee not exceeding the necessary costs of providing the information referred to above or of ensuring the exercise of the rights of data subjects to respond to the request.

The company ensures sufficient communication and cooperation to ensure that all requests received are processed within a reasonable time.

1. Retention and deletion of data

We retain your information for the duration of your contractual relationship with the Company and, as a standard, for ten (10) years after it ends. The Company will delete or anonymise your data as soon as you request it (except as set out below).

Where permitted by law, the Company may retain some of your data beyond the retention period in the following cases:

• if we are dealing with a problem with you, such as a pending dispute or legal claim.
• where we are required to do so by law, or where we hold such data in aggregate or anonymous form.
• where we need such data for legitimate business purposes.

2. Where personal data is stored

Your personal data is stored both in electronic form and in physical form (printed). Documents in electronic form are stored on local disks in the corporate part of the cloud storage, which can only be accessed by authorised persons under a username and password. Documents in physical form are stored in locked cabinets to which only authorised persons have access.

3. Access to your data

You can contact us at any time, free of charge, to ask whether we process your personal data and, if so, to request detailed information about this processing. You can use any of the Company’s contact details to do this, and make your request via any of the methods listed above.

4. Change of your data or error in your data

If during the course of your contractual relationship with the Company there is any change in your personal data, such as a change of name, change of residence or registered office or email address, or if you become aware that we are working with outdated or incorrect data, please let us know as soon as possible. You may use any of the Company’s contact details to do so.

5. Restrictions on processing

We consider that we do not interfere with your privacy in connection with the processing of personal data. If this still bothers you, please let us know as soon as possible. You can use the Company’s contact details to do this.

If you believe that:

• we process your inaccurate data,
• the processing of your data is unlawful and you do not wish to have all your data deleted,
• We no longer need your data for the above purposes, but you would like to use it to resolve your legal claims, for example in legal proceedings,
• you can ask us to restrict the processing of only some of your personal data or for only certain processing purposes.

6. Data portability

You can contact us at any time to have us pass on your data that we hold to a third party that you specify.

7. Withdrawal of consent to the processing of personal data

If you have given us your consent to process your personal data for a specific purpose, you can withdraw this consent at any time by using the Company’s contact details.

8. Lodging an objection

You have the right to object to the processing of personal data that is processed for the purposes of carrying out a task carried out in the public interest or in the exercise of official authority or for the purposes of protecting the legitimate interests of the Company. If the Company does not demonstrate that there is a compelling legitimate reason for the processing which overrides the interests or rights and freedoms of the natural person, it shall terminate the processing without undue delay upon objection.

9. Complaint to the Office for Personal Data Protection

If you believe that your data is being handled in violation of the law, you can file a complaint with the Office for Personal Data Protection at any time.