Personal Data Processing and Protection Policy

English translation of the original Czech version: „Zásady zpracování a ochrany osobních údajů“

This Personal Data Processing and Protection Policy (“Policy”) sets out the fundamental principles applied by RECUAIR, s.r.o., Company ID (IČO): 06400213, with its registered office at Trojanova 117, 278 01 Kralupy nad Vltavou (“Company”) when collecting and processing personal data. This Policy gives effect to the Company’s rights and obligations arising in particular from the following generally binding legal regulations:

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”);

• Act No. 480/2004 Coll., on Certain Information Society Services and on Amendments to Certain Acts (Act on Certain Information Society Services), as amended (“Act on Certain Information Society Services”);

• Act No. 127/2005 Coll., on Electronic Communications and on Amendments to Certain Related Acts (Act on Electronic Communications), as amended (“Act on Electronic Communications”).

This Policy applies to all persons visiting the Company’s website at https://www.recuair.com (“Website”), regardless of whether they are in a contractual relationship with the Company.

What is personal data

In accordance with the GDPR, personal data means any information relating to an identified or identifiable natural person (i.e. not a legal entity). In principle, this covers any information which, whether on its own or in combination with other information, may be used to identify a specific natural person (“Personal Data”).

What personal data the Company processes

The Company may collect the following Personal Data about you:

1. Personal data you provide to the Company yourself

This Personal Data consists in particular of the details you provide in a completed registration, order, or other form, or that you communicate to the Company by e-mail, telephone, fax, or other similar means. You may also provide Personal Data to the Company [when entering a competition], [when submitting a review of a product or service], or [when reserving a place on a training course]. This primarily concerns your first name, surname, correspondence address, e-mail address, telephone number, bank account details, chosen payment method, and similar information.

The Company will process the above Personal Data for the purpose of:

• providing the service, product, or information in which you have expressed interest;

• if you are an existing customer, also providing information about other services or products similar to those that were the subject of your previous purchase;

• if you are a new customer, sending you commercial communications and offers of products and services only where you have given the Company your express consent to do so;

• assessing and evaluating your application for a job position.

2. Personal data the Company collects about you itself

When you visit our Website, the Company may collect certain information necessary to ensure the proper and convenient operation of the Website. Such information includes the internet protocol (IP) data used to connect your computer to the internet, your registration details, browser type and version, time-zone settings, browser plug-ins, details of your visit — including the applicable Uniform Resource Locator (URL) — the path to and from the Website (including date and time), the products you viewed or searched for, response times, download errors, the length of visits to particular pages, information about your interaction while visiting the Website (such as scrolling, clicks, and cursor position), and the manner in which you left the page.

The Company uses this personal data to administer and improve the Website and for the purposes of ensuring internal operations, including troubleshooting, data analysis, testing, research, statistical purposes, and recording page-view frequency. This Personal Data may also be used to measure advertising effectiveness and to provide relevant advertising.

Disclosure of personal data

Personal Data the Company obtains about you may be disclosed [within the [●] group, i.e. to persons affiliated with the Company,] and to third parties (“Processors”) who assist the Company in performing its contractual obligations by providing certain services (e.g. delivery of a service). The Company transfers Personal Data only to Processors who provide sufficient guarantees of an adequate level of security for your Personal Data and who process such Personal Data solely on the basis of a personal data processing agreement. On this basis, the Company may transfer Personal Data to the following Processors:

• external partners and suppliers, for the purpose of fulfilling the Company’s contractual obligations;

• payment service providers and payment processors, for the purpose of securing the transfer of funds and carrying out payment transactions;

• postal and delivery service providers, for the purpose of delivering the products or services offered by the Company;

• the administrator of the Website.

In certain circumstances, the Company may be required to provide your Personal Data to third parties (e.g. law-enforcement authorities) in accordance with generally binding legal regulations.

Personal data protection measures

In order to protect your Personal Data and minimise the risk of unauthorised access to it, the Company has adopted organisational and technical measures. These measures include:

• organisational restrictions limiting the circle of persons authorised to come into contact with Personal Data; and

• technical safeguards protecting the Company’s servers and Website against unauthorised interference.

Persons who come into contact with Personal Data are instructed on personal data protection principles and are bound by confidentiality when processing such data.

Retention period for Personal Data

The Company retains Personal Data only for the period strictly necessary to perform its contractual obligations and to comply with the obligations arising for the Company under applicable legal regulations. Personal Data processed on the basis of your consent is retained by the Company only for the duration of the purpose for which consent was given.

Once the legal ground on which your Personal Data is processed ceases to apply, the Company will destroy such Personal Data and all existing copies of it.

Cookies

In operating its Website, the Company uses so-called cookies, i.e. small text files (“Cookies”) sent from the Company’s server to your browser and returned to the Company’s server when you visit the Website again. Cookies thereby enable the Company to recognise your browser, to remember information about your previous activity on the Website, and to tailor the content of the Website to your needs.

The Company uses the following types of Cookies:

• [first-party Cookies, which enable the basic operation and functionality of the Website and without which the content of the Website could not be displayed correctly;]

• [technical Cookies, which make it possible to analyse the use of the Website, ensure secure log-in, remember the progress of your order, and store registration details and shopping-basket contents;]

• [advertising Cookies, which enable the display of targeted advertising, the sharing of the Website on social networks, and the posting of comments on products.]

Cookies can be removed using your browser settings. Your browser can also be configured so that Cookies are not stored automatically. However, if you block, disable, or otherwise refuse certain Cookies, the Website may not display correctly, or it may not be possible to use certain services or features of the Website.

Rights of data subjects

In connection with the Company’s processing of your Personal Data, you are entitled to the following rights guaranteed by personal data protection regulations:

• the right to withdraw your consent to the processing of Personal Data, where the processing is based on such consent;

• the right to request access to your Personal Data and to information about which of your Personal Data is processed by the Company;

• the right to have inaccurate Personal Data corrected and, where applicable, incomplete Personal Data completed;

• the right to erasure of the Personal Data being processed;

• the right to restriction of the processing of Personal Data;

• the right to receive the Personal Data you have provided to the Company in a structured, commonly used, machine-readable format, and the right to transmit that data to another controller;

• the right to be informed of a breach of the security of Personal Data;

• the right to object to the processing of Personal Data; and

• the right to lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection, at Pplk. Sochora 27, 170 00 Prague 7, or via data box to ID qkbaa2n.

The above rights, and any complaints, may be exercised with the Company, as data controller, in writing at the address given below, or by e-mail to libor.tosovsky@recuair.com.

RECUAIR, s.r.o., Trojanova 117, 278 01 Kralupy nad Vltavou

This Policy is valid and effective as of 20 May 2018.