Processing and protection of personal data

Personal data controller:

• Company name: AKCENTA CZ a.s.
• ID No.: 25163680, Tax ID No.: CZ25163680
• Registered office: Prague 1, Salvátorská 913/8, post code 110 00, Czech Republic

Data protection officer:

• Martin Douda
• E-mail: dpo@akcenta.eu
• tel.: + 420 498 777 843

Your personal data and the processing of your personal information are handled in accordance with the instructions you gave when providing the data to us; generally in connection with a contractual relationship with our company. Data gleaned dif-ferently, (i.e., from public records or from third parties an authority or other body) is handled in a manner compliant with valid and effective regulations on the pro-cessing of such data. Depending on the situation, these may be:

• identification data (e.g., name, surname, ID number, date and place of birth, position, identity card number, by whom and when the card was issued,
• card validity, gender, place of birth, nationality, whether the person is politically exposed, tax residence and tax ID),
• address / contact details (e.g., address of permanent residence, telephone number, mobile phone number, e-mail),
• data on the services used (e.g., bank account numbers, internal payment account balances, transaction data, telephone call records, other communication records), or
• other data (e.g., information of a commercial and marketing nature).

These principles of personal data processing are intended for natural persons who-se personal data we process (so-called data subjects). These may be:

• clients and potential clients of our organization
• website visitors and users of other communication channels
• other entities in whose personal data we have a legitimate interest in processing.

In principle, the following applies: if we require your personal data, you are obliged to provide it to us; failure to provide data would lead to the impossibility of estab-lishing a contractual relationship with our company. An exception is the case in which we need your consent to process your personal data. Giving consent is com-pletely voluntary.

Your personal data is stored only for the necessary amount of time and is archived for the allowed time period as per legal regulations:

• data that is necessary for us to have in order to fulfill our legal obligations is kept for the period required by the relevant legal regulations. Unless the re-tention period for the personal data is explicitly stated, the data is stored for as long as the obligation lasts.
• data that we have for the conclusion and fulfillment of contracts is stored for the duration of the contractual relationship;
• data that we have for ongoing or imminent legal disputes shall be stored for the maximum limitation or preclusion periods (i.e, six months after the expira-tion of such limits). This takes into account the fact that a summons may be served by the court several months after filing;
• data processed on the basis of our legitimate interest is stored for the duration of such interest (e.g., data stored on a recording from the camera system is stored for a maximum of ten days, commercial messages sent on the basis of our legitimate interest are sent only until you unsubscribe);
• data processed on the basis of your consent is stored for the period for which you have given your consent.

We have internal rules in place that verify the lawfulness of the possession of per-sonal data, and we do not hold data for longer than we are entitled to.

The processing of your personal data is done in accordance with valid and effective legal regulations, a basic overview of which is given below :

Regulation of the European Parliament and Council (EU) 2016/679 of the 27. April 2016 on the protection of individuals with regard to the processing of personal data, and on the free movement of such data and repealing of the Directive 95/46/ES (General Data Protection Regulation), hereinafter referred to as “GDPR",

• Act No. 21/1992 Coll., on banks,
• Act No. 370/2017 Coll., on payment systems,
• Act No. 256/2004 Coll., on doing business on capital markets,
• Act No. 164/2013 Coll., on international cooperation in tax administration, and
• Act No. 253/2008 Coll., on certain measures against the legalization of pro-ceeds from crime.

We collect and process personal data only if there is at least one legal justifi-cation for the specified purpose, and this only to the extent and for the time period necessary to fulfill the aforementioned purpose, which may be:

Consent to send marketing news

By subscribing to our newsletter (marketing news) and then confirming your sub-scription via the link sent to you, you agree to the processing of your personal data for the purpose of sending newsletters. Your data is not passed on to third parties and will be kept until revoked.

The provision of personal data is voluntary. You are not obliged to provide your per-sonal data, however, the newsletter cannot be sent to you without it.

In the event that your consent to receive commercial communications from us is re-voked, we will continue to store your e-mail address. This is in order to prevent us from contacting you again to offer goods or services. However, as part of the revoca-tion of your consent, you may inform us that you do not wish us to process your per-sonal data for the purpose of such follow-up.

Information provided actively - contact form

Some parts of our website may ask you to provide information that will allow us to contact you (e-mail, and/or telephone number, name or company name). The admi-nistrator has a legitimate interest in the processing of the above contact details in order to provide an offer and the possible future conclusion of a framework agree-ment. You will be informed as to which information is mandatory and which is opti-onal. The provided contact details are kept for the period of one year.

Information provided passively – cookies

When navigating our company's website, certain information may be passively coll-ected (i.e., obtained without being actively provided by you) using various technolo-gies (such as cookies, pixels and javascript measuring systems, especially Google Analytics, and standard server logging of your HTTP requests).

Your internet browser automatically shares anonymously listed information, such as the URL of the web portal or search engine you just left (the so-called "referrer URL"), your IP address, the version of the browser and the operating system that your computer is currently using, the default language settings, or information about installed browser add-ons. This site requires the storage of cookies in your browser for its operation. You can set it to inform you when a cookie is sent, or you can reject or disable cookies altogether, but certain parts of this website may not work properly without cookies. You can find more information in our Policy on the use of Cookies.

There are some cases in which the following external entities have access to your personal data:

• banks / designated individuals (usually in connection with the confirmation of identification to meet the requirements of AML “anti-money laundering” laws). List of our banking partners;
• legal authorities and legally designated bodies;
• our professional advisors (i.e., auditors, legal, financial or tax advisors);
• support service providers (IT service providers including web hosting and Cloud services, providers of postal and communication services and electro-nic communications services);
• external collaborators and contractors, as necessary for contract fulfillment;
• law enforcement agencies and insurance companies, as necessary (in-cidents, insured events).

We process your personal data either independently or in accordance with the GDPR. We use the professional services of "personal data processors" on the basis of personal data processing agreements. Key processors who are subject to all security measures do have access to certain personal data of clients to the extent necessary for the agreed purpose. They are listed below:

In order to ensure the implementation of the offered services that are provided (i.e., payment systems / investment services), in certain exceptional cases and under certain circumstances, you could require that we transfer your personal data for pro-cessing outside the EU / EEA to a so-called third country. In such cases, the transfer would take place in accordance with relevant legal requirements and the protection of your personal data would be ensured throughout. As a rule, however, no transfer of your personal data to a third country takes place unless the data is stored with a Cloud / communication service provider from the USA. (Transfer to the USA is pos-sible on the basis of “binding corporate rules").

We process your personal data transparently and in accordance with legal requirements. Please note that under the GDPR you have the right to the following:

• request access to your personal data, i.e., you have the right to obtain information from us on whether we process your personal data, and if so, what the data is and how it is processed;
• request the correction of any personal you deem to be inaccurate, and supplement incomplete data at any time;
• in certain cases, you may request the following: restrictions on the processing of your personal data or the deletion of your personal data, or you can raise an objection to the processing itself (see Articles 17, 18 and 21 of the GDPR);
• you have the right to revoke consent at any time of any processing that was based on your consent. Withdrawal of consent does not affect the legality of previous data processing;
• in certain cases you have the right to obtain the personal data you have provided to us in a standard and machine-readable format (see Article 20 of the GDPR). You can then pass this information on to another administrator, or if technically possible, you can ask the administrators to pass it on to each other.

You can exercise your rights by sending your application or objection to the registered office address of our company, or by e-mail to dpo@akcenta.eu. You also have the right to lodge a complaint with the Office for Personal Data Protection, in particular if we have not complied with your request.