Personal data processing

STATEMENT ON THE PROCESSING OF PERSONAL DATA

This is an English translation provided for information. In case of any discrepancy, the Czech version prevails.

Statement on the processing of personal data and information for data subjects pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter “GDPR”)

1. Controller of personal data

ÚVTnet s.r.o., Hrnčířská 383, 252 42 Jesenice – Zdiměřice, Company ID (IČO): 29133653, registered in the Commercial Register maintained by the Municipal Court in Prague (Městský soud v Praze), Section C, Insert 202520 (hereinafter the “controller”), hereby informs you, in accordance with Article 12 of the GDPR, about the processing of your personal data and about your rights.

Principles of personal data processing: When processing personal data, we honour and respect personal data protection standards and adhere to the following principles: we always process personal data for a clearly and comprehensibly specified purpose, by specified means and in a specified manner, and only for the period that is strictly necessary. We collect the personal data of our clients and employees only to the extent necessary and do not transfer them to third parties, with the exception of those who are directly involved in processes within the company for the purpose of their necessary processing. Cooperating persons (employees, subcontractors) are required to commit to the controller's personal data processing principles and undergo regular training. The company, as the data controller, has established the position of Data Protection Officer (DPO), who oversees the proper protection of the personal data of their owners, i.e. the company's customers. The DPO's contact details are published in a remotely accessible manner on the controller's (company's) website.

2. Scope of personal data processing

Personal data are processed to the extent to which the data subject concerned has provided them to the controller in connection with the conclusion of a contractual or other legal relationship with the controller, i.e. on the grounds of legitimate interest, or which the controller has collected otherwise and processes in accordance with applicable legislation or in order to comply with the controller's legal obligations.

3. Sources of personal data

▪ directly from data subjects (registration, web contact forms and chat, e-mails, telephone, website, business cards, etc.)

▪ publicly accessible registers, lists and records (e.g. the Commercial Register, the Trade Licence Register, the Land Register, etc.)

▪ automated recording of electronic communications on the basis of Act No. 127/2005 Coll. (zákon č. 127/2005 Sb.) and Decree No. 357/2012 Coll. (vyhláška č. 357/2012 Sb.)

▪ “Cookies” technology and other common technologies for recognising the subscriber's device without the possibility of unambiguously identifying the user. This tracking technology can be refused in the user's browser. More about cookies at www.allaboutcookies.org.

4. Categories of personal data subject to processing

▪ address and identification data used for the unambiguous and unmistakable identification of the data subject (e.g. first name, surname, title, where applicable birth number (rodné číslo), date of birth, permanent residence address, Company ID (IČO), VAT ID) and data enabling contact with the data subject (contact details – e.g. contact address, telephone number, fax number, e-mail address and other similar information)

▪ IP addresses, telephone numbers and other traffic and location data arising from the operation of the services, collected and retained due to a legal obligation

▪ IP addresses and other traffic and location data to the extent necessary to maintain the quality of the service

▪ descriptive data (e.g. bank account details)

▪ other data necessary for the performance of the contract

▪ data provided beyond the scope of the relevant laws, processed on the basis of consent given by the data subject (processing of photographs, use of personal data for the purposes of personnel procedures, etc.)

5. Categories of data subjects, processors, other controllers of personal data

▪ employee of the controller

▪ carrier

▪ service supplier

▪ another person who is in a contractual relationship with the controller

▪ job applicant

In justified cases, your personal data may be processed by third parties that are subject to EU legislation and located in the territory of EU countries, for example: Smartsupp.com, s.r.o., CZ03668681, technical support chat; Sledovanitv.cz s.r.o., CZ01607910, IPTV platform Sledování TV; SMART Comp. a.s., Brno, Kubíčkova 1115/8, CZ25517767, IPTV platform Kuki; Družstvo EUROSIGNAL, CZ26461129, development and operation of information systems; iQuest s.r.o., CZ 27096483, development and operation of information systems

6. Categories of recipients of personal data

▪ state administration in cases of a legal obligation laid down by the relevant legislation

▪ processor engaged by the controller

▪ employees 7. Purpose of personal data processing

▪ purposes covered by the data subject's consent

▪ negotiations on a contractual relationship ▪ performance of the contract

▪ protection of the rights of the controller, the recipient or other persons concerned (e.g. recovery of the controller's receivables)

▪ archiving carried out on the basis of law

▪ selection procedures for job vacancies

▪ compliance with legal obligations by the controller

8. Method of processing and protection of personal data

Personal data are processed by the controller. Processing is carried out at its establishments, branches and registered office by individual authorised employees of the controller or, where applicable, by a processor. Personal data may also be managed by another controller with the status of a joint controller. Processing takes place by means of computer technology or, where applicable, also manually in the case of personal data in paper form, in compliance with all security principles for the management and processing of personal data. To this end, the controller has adopted technical and organisational measures to ensure the protection of personal data, in particular measures to prevent unauthorised or accidental access to personal data, their alteration, destruction or loss, unauthorised transfers, their unauthorised processing, as well as any other misuse of personal data. All entities to which personal data may be disclosed respect the data subjects' right to privacy and are obliged to act in accordance with the applicable legislation on personal data protection.

9. Period of personal data processing

In accordance with the time limits set out in the relevant contracts, in the controller's filing and shredding rules or in the relevant legislation, this is the period strictly necessary to secure the rights and obligations arising both from the contractual relationship and from the relevant legislation.

10. Notice

The controller processes data with the consent of the data subject, except in cases laid down by law in which the processing of personal data does not require the data subject's consent. In accordance with Article 6(1) of the GDPR, the controller may process data without the data subject's consent in the following cases:

▪ the data subject has given consent for one or more specific purposes,

▪ processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,

▪ processing is necessary for compliance with a legal obligation to which the controller is subject,

▪ processing is necessary in order to protect the vital interests of the data subject or of another natural person,

▪ processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,

▪ processing is necessary for the purposes of the legitimate interests pursued by the controller concerned or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

11. Rights of data subjects

1) In accordance with Article 12 of the GDPR, the controller, at the request of the data subject, informs the data subject of the right of access to personal data and to the following information:

▪ the purpose of the processing,

▪ the category of personal data concerned,

▪ the recipients or categories of recipients to whom the personal data have been or will be disclosed,

▪ the envisaged period for which the personal data will be stored,

▪ any available information as to the source of the personal data, where they are not collected from the data subject,

▪ whether automated decision-making, including profiling, takes place.

2) Any data subject who discovers or believes that the controller or processor is processing his or her personal data in a manner that is contrary to the protection of the private and personal life of the data subject or contrary to the law, in particular if the personal data are inaccurate with regard to the purpose of their processing, may:

▪ Ask the controller for an explanation.

▪ Ask the controller's Data Protection Officer for an explanation.

▪ Require the controller to remedy the situation that has thus arisen. This may include, in particular, blocking, rectification, completion or erasure of the personal data.

▪ If the data subject's request under paragraph 2 is found to be justified, the controller shall remedy the defective situation without delay.

▪ If the controller does not comply with the data subject's request under paragraph 2, the data subject has the right to contact the supervisory authority directly, i.e. the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ).

▪ The procedure under paragraph 2 does not preclude the data subject from submitting a complaint directly to the supervisory authority.

▪ The controller has the right to charge a reasonable fee for providing the information, not exceeding the costs necessary to provide the information.

This statement is publicly available on the controller's website.