Personal Data Processing

To make the following text easier to understand, we offer a simple glossary of the terms you will encounter further in the text.

Glossary of terms

Legitimate interest — The interest of the controller (SPEA s.r.o.) or of a third party, for example in a situation where the data subject is a customer or business partner of the controller.

Personal data — Information about a specific, identifiable person.

Product — Goods supplied by our company.

Recipient — A person to whom personal data is disclosed.

Service — Any service our company offers you, including our products, services and their support.

Controller — A person who determines the purpose and means of the processing of personal data; and who may also decide to entrust the processing to another person as a processor.

Data subject — A living natural person whose personal data is being processed.

Purpose — The reason for which the controller uses your personal data.

Processing — An activity the controller or processor performs with personal data.

Processor — A person who processes personal data on behalf of the controller.

The controller of personal data is SPEA s.r.o., with its registered office at Máchovy sady 302, Bystřany, postal code 417 61, Krajský soud v Ústí nad Labem, spisová značka C 37477, company ID (IČO) 05051487, VAT ID (DIČ) CZ05051487.

Collecting and processing your personal data is necessary for the performance of a contract, for compliance with our legal obligations and, where applicable, for the protection of our legitimate interests. We process only such data as enables us to provide you with the products and services you are interested in, or data necessary for our proper mutual business cooperation.

We collect and process primarily the personal data of you as customers of our products, users of our services and our business partners, including potential future customers and business partners who are interested in our products and services or in business cooperation with us, or whom we have approached with our offer. Depending on the specific situation, we also process data about representatives of legal entities, including members of statutory bodies and employees.

Our company processes mainly the following categories of personal data:

Basic data

In our company we consider the following in particular to be basic data:

• identification data: title, first name, surname, date of birth, and where applicable identity card number, birth number or company ID (IČO);
• contact data: permanent residence address, delivery or other contact address, telephone, e-mail address;

Other data

We also process data closely related to the way you use our products and services, or data you communicate to us or otherwise create in the course of using the services. Or, where applicable, data arising from the nature of our business cooperation. We consider such other data to include in particular:

• bank account number, customer number, and other personal data arising from the performance of a specific contract or from the applicable legal regulation.

If you are arranging one of our products or services with us, or are interested in them, you provide us with basic data or, where applicable, other data necessary for us to be able to conclude a contract with you, or for us to assess whether and which product or service we can offer you.

In these cases we, as the controller, process your data which you provided to us in connection with the preparation and conclusion of the contract for the given product or service, as well as data we have assigned to you for easier processing of your data in our information systems (e.g. customer number, supplier number, etc.). And further, data we have obtained about you in the course of performing the agreed contract.

We also obtain your personal data in the course of your communication with us. It makes no difference whether you communicate with us electronically, by postal correspondence, by telephone, during a personal visit or, for example, via a data box. If personal data obtained in this way relates to a product or service we provide, our company is the controller of the data provided in this way.

If camera recordings are made on our premises, any personal data of yours is managed by our company.

Our company uses the personal data obtained mainly for the following purposes:

• compliance with legal obligations;
• conclusion and performance of a contract for a product, service or cooperation;
• ensuring operational activities;
• accounting and tax purposes;
• debt recovery;
• information and product campaigns;
• keeping customer records;
• keeping records of business partners.

In practice, you will most often encounter the following situations:

Customer service

Customer identification

In order to be able to conclude a contract with you and provide our products or services, we need to know your basic data. We also require your identification when you exercise your rights in personal data protection matters.

Why we process your data:

• to conclude and perform your contract
• to comply with obligations under legal regulations

Contract preparation

We collect and process only the data needed and necessary for drafting your contract. In order to be able to conclude a contract with you, we need to know your name, date of birth and contact details. The further scope of data depends on the type of product or service, or the type of business cooperation, that is the subject of the contract.

Why we process your data:

• to prepare your contract
• to comply with obligations under legal regulations
• to protect our rights and legitimate interests

Managing relationships with customers and business partners

We respect your needs and preferences. To this end, we strive to keep a complete overview of which products you purchase and which services you use. We deal with you on a wide range of matters concerning our product or service, in particular its establishment, set-up, changes, provision of product information and more.

Similarly, we have an interest in managing our mutual relationships if you cooperate with us as our business partners.

In addition to our products and services, your requests may also concern the exercise of your rights in personal data protection matters.

Why we process your data:

• to perform your contract
• to protect our rights and legitimate interests

Use of products and services

By choosing our products and using our services, your data is processed on our part. This mainly concerns your basic data, data about products and services or business cooperation. We register it, manage it and, in cooperation with you, keep it up to date.

Why we process your data:

• to conclude and perform your contract

Marketing

We publish marketing campaigns on the company's website, or through our business partners or in print.

Why we process:

• to protect our rights and legitimate interests

Security and risk management

Business risk assessment

When concluding contracts with suppliers, we also assess the business risk relating to the given business partner. We use this data to assess risk, e.g. whether you will be able to meet your obligations. We use external registers as well as internal databases for this purpose.

Why we process:

• to protect our rights and legitimate interests

Security

For these purposes we protect the life and health of people as well as physical property, e.g. by installing camera systems, which are installed to protect persons and property against unlawful conduct, primarily as part of the prevention and investigation of unlawful conduct by persons on premises used by our company. We process camera recordings in accordance with the purpose for which they were made and under strict rules ensuring the protection of your data as well. Processing your data also helps us in the prevention of cyber risks.

Why we process:

• to comply with obligations under legal regulations
• to protect our rights and legitimate interests

Internal administration

Accounting and taxes

We collect and process your identification and transaction data for the purpose of fulfilling our accounting and tax obligations towards regulatory and state authorities, imposed on us by the Accounting Act, the VAT Act and other Czech accounting and tax laws, and for mandatory reporting to regulatory authorities.

Why we process:

• to comply with obligations under legal regulations

Exercising the company's rights

If developments in our mutual relations force us to enforce our receivables through legal channels, or if we are a party to court proceedings concerning you, we will use, to the extent necessary, your basic data, data about products and services, data from our communication and, where applicable, other data necessary to protect our rights.

Why we process:

• to comply with obligations under legal regulations
• to protect our rights and legitimate interests

Reporting, information management, process optimisation, training

Our employees process your personal data in fulfilling internal obligations established within every company. For example, we have a comprehensive approval and reporting system in place for individual business cases.

For these purposes, the data is aggregated (summarised from a large number of individual data items into an overall total) and the result is an aggregate figure with no direct link to a specific person. We also prepare various reports on the basis of legal regulations.

Why we process:

• to comply with obligations under legal regulations
• to protect our rights and legitimate interests

Our company obtains your personal data primarily from you, in the course of negotiating the conclusion of a contract and subsequently during its performance, or from third parties who broker such negotiations.

We may also obtain your personal data from public registers or from state administration bodies. In specific cases, based on the applicable legislation, we may also obtain your personal data from non-public registers.

More details on the sources of your personal data that we process are given in the following examples.

Sources of your data for marketing purposes

For these purposes we use data we have collected directly from you. To this end, we process your basic personal data or data available from publicly accessible sources.

Sources of data for security and risk management

For these purposes we use your data kept in internal databases, obtained directly from you or about you on the basis of existing or previous contractual cooperation, containing the information necessary for security assessment and risk management.

Personal data listed in public registers

In cases where we pursue our legitimate interests, in particular our interest in acting prudently, we may also obtain your basic data and certain other data from public registers, for example the trade licensing register, the land register and similar.

Our company processes your data both manually and by automated means. However, in the automated processing of your data we do not use automated decision-making that could have an impact on your rights.

The protection of your data in our company is secured organisationally and technically in accordance with the applicable legislation.

Your personal data may, upon a justified request, also be transferred to third parties that have statutory authority to require the transfer of such personal data, such as various state authorities.

Customer care and service

Our company shares your basic data and, where applicable, data about products and services and data from our communication with certain other parties. We do so primarily to protect our rights and legitimate interests. We need to share the data not only for our security and risk management, but also to maintain the integrity and currency of your data and the speed and quality of service in customer identification and authentication, customer relationship management and your use of products and services. We also share data for our administrative purposes.

Camera systems

In order to ensure the security of the premises in which it carries out its production, business and other activities, and also to ensure the security of the services provided, our company has installed and operates camera systems with recording. We always draw your attention to the placement of these camera systems with information signs and pictograms at the entrance to such an area.

In the event of security incidents, the camera recordings made are made available for assessment only to designated employees of our company. They may be handed over only to law-enforcement authorities or to administrative authorities for the conduct of misdemeanour proceedings, on the basis of their written request. Our company may also provide the recordings to these authorities on its own initiative if it suspects that a criminal offence or misdemeanour captured in the recording has been committed. The recordings made are stored in a secure manner and, unless handed over to the competent state authorities, are deleted after the set period of 14 days.

Our processors

We sell and service our products mainly through our company's own employees. However, we also use an external network of contractual partners.

If we entrust someone else with performing a certain activity forming part of our activities or services, personal data may be processed in the course of it. In some cases, these suppliers or external sales representatives of ours also become processors of personal data. A processor is entitled to handle the data solely for the purposes of performing the activity with which it has been entrusted by our company. In such a case, your consent is not required for the processing activity, as such processing is permitted directly by legal regulation.

We use in particular the following categories of processors to process your data outside our company:

• providers of legal services
• providers of printing and postal services, including couriers
• valuers

Recipients of personal data and requests without consent

Certain state authorities and other organisations are entitled to request information about you. These are in particular courts, the public prosecutor's office or the Police of the Czech Republic. We provide your data solely where the relevant law imposes such an obligation on us.

An important goal of our company is to protect and secure your personal data. We use various technologies, procedures and processes to protect your personal data against unauthorised access, use and disclosure. For example, we process the personal data provided in computer systems and store it in data storage facilities with restricted access, located in guarded buildings. For transfers of personal data with a high degree of confidentiality (such as bank account numbers or passwords) over the internet, we use encryption to protect it.

Where we store personal data

The personal data collected by our company is processed and stored exclusively in the territory of the Czech Republic.

Retention of personal data

Our company retains your personal data for the time strictly necessary to provide products and services, complete the requested transactions or for other necessary purposes, such as compliance with our legal obligations and contractual commitments, dispute resolution and legal enforcement of concluded agreements, or for possible administrative proceedings. These needs differ depending on the type of product or service provided, or on the other type of contractual relationship agreed, and the actual retention period may therefore vary considerably.

When handling your data for specific purposes, we respect the principles of data minimisation. That is, we collect only such data of yours as we strictly need for the specific purpose. At the same time, we set strict internal archiving rules ensuring that we do not retain your data longer than we are entitled to.

For almost all contractual relationships we must ensure documentation of the calculation and payment of taxes, arising from the legislation governing value added tax and the related tax proceedings. Under this legislation we are obliged to keep tax documents, and records with detailed data relating to selected services provided, for 10 years from the end of the tax period in which the supply took place. In general, we are obliged to retain most basic personal data on the basis of this legislation.

In exceptional cases, for example in the course of litigation, documents containing your personal data may be retained for longer in order to protect our legitimate interests. This applies in particular where we would have to present evidence in litigation, administrative proceedings or due to the enforcement of a decision (with regard to the statutory limitation periods under the current Civil Code, e.g. in connection with warranties provided).

We retain data processed on the basis of your consent for the period for which the consent has been validly granted to us. For the avoidance of doubt, we retain the consent itself and any change or withdrawal of your consent, on the grounds of our legitimate interests, for the entire period of validity of the consent and for no longer than 5 years after it has expired.

Our company strives for transparent and fair processing of your personal data, and for ensuring its due protection, always in accordance with the applicable legislation. To assure you of our responsible approach to processing your data, we are ready to respond quickly and professionally to your legitimate requests, by which you can verify our accountability in processing your data and, where appropriate, help us remedy shortcomings should they exceptionally occur in this activity.

• If the processing of personal data is based on your consent, you have the right to withdraw your consent for future processing at any time;
• You have the right to request from us, as the data controller, access to your personal data and more detailed information about its processing;
• You have the right to request that we rectify your inaccurate or incomplete personal data;
• You have the right to ask us to provide your personal data in a commonly used and machine-readable format allowing its transfer to another controller, if we obtained it on the basis of your consent or in connection with the conclusion and performance of a contract, and it is processed by automated means;
• You have the right to object to the processing of some or all of your personal data;
• You have the right to ask us to erase your personal data if we no longer have any legal ground for its further processing;
• You have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

If we process your personal data, we do so on the basis of the relevant legal grounds enabling the provision of the products and services you use, the operation of our company, the fulfilment of our contractual and legal obligations, ensuring the protection and security of our systems and our customers, or the pursuit of other legitimate interests of our company, as described in the sections of this Information above, or we process your personal data on the basis of your consent.

I want an overview of what data of mine you process

You have the right of access to your data and to further related information. However, the rights of third parties must not be affected by this. We will provide you with such data and information free of charge. If your requests were manifestly unfounded or excessive, in particular because they are repetitive, we may refuse such requests as unfounded, or require you to pay a fee corresponding to the costs of providing this data and information.

I would like my data corrected

It may happen that your data is recorded incorrectly or is out of date. At your request we will of course correct it. And we will likewise complete incomplete data about you if you draw our attention to it.

I do not wish you to continue using my personal data

We fully respect your right to erasure of personal data. As soon as all the reasons for its retention have ceased, we will delete it even without your request. If you ask us to delete your personal data earlier, we will inform you why and for how long we still have to retain your data before it is deleted.

I believe you are using some of my personal data unlawfully

On the basis of your objection, we will assess and, until it is resolved, block any use of your personal data where there are doubts as to whether we are using it in accordance with the applicable legislation.

I do not want to provide you with some of my personal data

You are not obliged to provide us with your personal data. In specific situations we will always inform you which of your personal data is necessary for concluding the relevant contract, and your refusal, where applicable, will lead us to conclude that we will not be able to provide you with the offered product or service.

I want to withdraw my consent

If you have given us your consent to the processing of your data, you are entitled to withdraw this consent at any time. Withdrawal of this consent does not affect the processing of your data during the entire period for which your consent was validly granted. Withdrawal of your consent will only affect the processing of your data for the specific purpose or purposes for which it was granted. However, it does not affect the processing of your personal data for other purposes and on other legal grounds, where such personal data is covered by them (e.g. compliance with an obligation laid down by a legal regulation).

Over time, the legislation governing the rules and conditions of the processing and protection of your personal data may change, or our terms, procedures and methods of processing and protecting your personal data may change. We will always inform you of them by updating this Information, unless the given change requires that we also let you know by individual communication (by letter or electronic message).

If you have a request or complaint concerning the processing of your personal data, or a question for the person responsible for the processing of personal data in our company, please contact us at the e-mail address spea@spea-servis.cz.

We will respond to your requests, questions or complaints as soon as possible, but no later than within one month of their receipt. If, due to the complexity of dealing with your request or a high number of requests from other persons, we were unable to handle your request in time, we will inform you of the necessary extension of the deadline.

If your request is not handled to your satisfaction, you may contact the data protection officer of SPEA s.r.o., who is Ing. Pavel Sedláček. He can be contacted at the address SPEA s.r.o., Máchovy sady 302, Bystřany, 417 61, or via the web form.

Date of issue / update of this document – 1 January 2022