INFORMATION ON THE PROCESSING OF PERSONAL DATA OF BUSINESS PARTNERS

Dear business partners, The following information is provided to ensure full and transparent awareness of how your personal data is processed by the data controller, in accordance with Articles 13 and 14 of the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

1. Identity and contact details of the Controller: SPL a.s., located at Třebohostická 3069/14, 100 00 Prague 10, ID No: 28002890, registered in the Commercial Register kept at the Municipal Court in Prague, section B, insert 15608 Contact person: Mgr. Lucie Svobodová Phone: 603 188 546 Email: lucie.svobodova@safichemgroup.com (“We” or “Controller”)
   
   We are committed to protecting the privacy and personal data of our tenants, business partners, and the natural persons acting on their behalf, with whom we come into contact. Below are details regarding the processing – particularly the collection, disclosure, and other uses – of personal data related to our tenants and other business partners and the natural persons acting on their behalf.
2. A Data Protection Officer has not been appointed by the Controller.
3. Personal data that we process about you: We obtain your personal data from several sources. You or your company, or the company you represent, are the primary sources of your personal data (e.g., when entering into a contract with you, and you or your company provide us with your identification or payment details). We may also collect your personal data for the purposes mentioned above from publicly accessible sources, such as public listings, registers, and records (e.g., the trade or business register), or it may be provided to us by third parties (especially information from a camera system operated at the company's registered office).
   
   The information or data we process about you should be considered personal data, which includes:
   • Name, names, and surname;
   • Date of birth;
   • Permanent or other residence;
   • Contact details (phone, email, delivery address);
   • ID number of the individual – entrepreneur;
   • Tax identification number of the individual – entrepreneur;
   • Employment position or designation of the individual at a business partner;
   • Bank account details;
   • Information from the camera system operated at the company's registered office.
4. Purpose of processing personal data and legal basis for processing: The purposes for processing your personal data are:
   1. Managing relationships with you – tenants, business partners, customers, and potential tenants and partners, particularly in the form of concluding, fulfilling, and potentially modifying a concluded contract; Processing personal data for this purpose is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract in accordance with Article 6(1)(b) of the General Data Protection Regulation and necessary for the purposes of the legitimate interests pursued by the Controller and third parties in accordance with Article 6(1)(f) of the General Data Protection Regulation.
   2. Fulfilling tax and accounting obligationsů; Processing personal data for this purpose is necessary for complying with legal obligations of the Controller under Article 6(1)
   3. Of the General Data Protection Regulation, specifically set out by:
      1. Act No. 563/1991 Coll., on Accounting, as amended, ("Accounting Act");
      2. Act No. 586/1992 Coll., on Income Taxes, as amended ("Income Tax Act");
      3. Decree No. 500/2002 Coll., implementing certain provisions of Act No. 563/1991 Coll., on Accounting, as amended, for accounting units that are entrepreneurs accounting in a system of double-entry accounting, as amended.
      
      If further processing of your personal data beyond the obligations set by legal provisions, our legitimate interests, or the legitimate interests of a third party is desired by us, we will always seek your prior written consent.
5. Instruction on your obligation to provide personal data: Providing your personal data for the purposes mentioned above is a necessary requirement for the proper performance of the contract with you. However, you must also provide your personal data for legal reasons, especially for the proper fulfillment of our tax and accounting obligations. Failure to provide your personal data in the specified scope could ultimately prevent the performance of the contract or could jeopardize the quality of its performance.
6. Legitimate interests of the Controller or a third party in cases where processing is necessary for the purposes of legitimate interests pursued by the Controller or a third party: The processing of your personal data may also be necessary for our legitimate interests, particularly in connection with the possibility of asserting our rights and claims arising from the contractual relationship between you – the tenant, business partner, customer, and potential tenant and partner - and us, the protection of our property, and communication with you.
   
   Personal data of representatives of tenants, business partners, and suppliers, who are legal entities, are also processed based on our legitimate interests. Since these representatives act in most cases on behalf of the tenant, business partners, or suppliers based on a contractual relationship with them (they are, in particular, employees, members of statutory bodies, commercial representatives, or authorized persons, etc.), for the purpose of fulfilling the contract concluded between us and the respective business partner, this is not a case where the interests or fundamental rights and freedoms of these representatives of tenants, business partners, or suppliers requiring the protection of personal data should take precedence over these legitimate interests of ours.
7. Recipients or categories of recipients of personal data:
   • state authorities (in particular the Office for Personal Data Protection, criminal justice authorities, the Czech Police, public prosecutors, courts, tax administrators) and other entities based on other legal provisions;
   • entities that provide us with services (in particular banks, insurance companies, IT services, lawyers, and other advisors) with whom we have concluded an appropriate personal data processing agreement;
   • possibly selected companies from the SAFICHEM GROUP if there is a legitimate interest.
8. Transfer of personal data abroad: We do not intend to transfer personal data to a third country or an international organization.
9. Retention period of personal data: When handling your personal data for specific purposes, we respect the principle of storage limitation, where we only retain your personal data for as long as is strictly necessary. We also respect the data minimization principle by retaining only personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
   
   We retain your personal data for the duration of our contractual relationship for the purpose of exercising rights and obligations arising from it, and after its termination for other necessary purposes, such as compliance with our legal obligations, contractual commitments, dispute resolution, and legal enforcement of legitimate claims or for potential administrative proceedings. These needs vary depending on the specific reason for their retention, and therefore the retention period of various types of your personal data significantly differs in specific cases, and may reach up to 10 years after the termination of the contractual relationship.
   
   Furthermore, legal provisions related to accounting and tax obligations also define the archiving period, during which accounting documents must be archived. Accounting documents and accounting records that we use to prove the management of accounting must be kept for the following period of 5 years starting from the end of the accounting period to which they relate.
   
   In exceptional cases, such as in the conduct of a legal dispute, due to the protection of our legitimate interests, the retention of some documents containing your personal data may be extended. This is especially true in cases where we would need to submit these documents as evidence in a legal dispute, in administrative proceedings, or due to the enforcement of a decision.
   
   In cases where a camera recording from the camera system operated at the premises at the company's registered address is provided at our request, it will only be retained by us for as long as is strictly necessary.
10. Automated individual decision-making, including profiling: No decision-making based solely on automated processing, including profiling, which would have legal effects on you or similarly significantly affect you, occurs during the processing of your personal data.
11. Your rights in relation to the processing of your personal data: In relation to the processing of your personal data by us or on our behalf, you have the following rights:
    • the right to request access to personal data concerning you as the data subject and the right to obtain a copy of your processed personal data;
    • the right to rectification of your personal data - if you find that they are not correctly recorded or are inaccurate);
    • the right to erasure to the extent of voluntarily provided personal data, i.e., within the fulfillment of contractual obligations. On the other hand, it is not possible to demand the erasure of personal data that we are obliged to collect based on a legal obligation;
    • the right to restriction of processing;
    • the right to data portability;
    • the right to object to processing based on our legitimate interests or the legitimate interests of a third party;
    • the right to lodge a complaint with a supervisory authority, in case you believe that the processing of personal data is in violation of the General Data Protection Regulation. You may lodge a complaint with the relevant supervisory authority, which is the Office for Personal Data Protection, pplk. Sochora 27, 170 00 Prague 7 (see www.uoou.cz).

Where can you exercise your rights and how? You may exercise your rights by sending an email to the address mentioned above among our contact details or by sending a written request to our registered or correspondence address.
All communications and statements regarding your exercised rights are provided free of charge. However, if a request is manifestly unfounded or excessive, particularly because it is repetitive, we are entitled to charge a reasonable fee that takes into account the administrative costs of providing the requested information. In the case of repeated exercise of the request to provide copies of processed personal data, we also reserve the right to charge a reasonable fee for administrative costs for this reason.

How long can you expect a response? We will provide a response and possibly information about the measures taken as soon as possible, but no later than within one (1) month. We are entitled to extend the period if necessary, considering the complexity and number of requests, by two months. We would inform you of any such extension, including the reasons, in advance.