Personal Data Processing Policy

Through this Personal Data Processing Policy, Metrostav Development a.s., Company ID No.: 28440412, with its registered office at Koželužská 2450/4, 180 00 Prague 8 – Libeň, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. B 14524, together with all its subsidiaries (hereinafter referred to as the “Company”), in its capacity as a data controller, informs data subjects—i.e. natural persons whose personal data it processes—about the principles of personal data protection and the data processing activities carried out, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data.

Basic Information on the Processing of Personal Data

This Personal Data Processing Policy applies to all employees, clients, suppliers, and customers of the Company, as well as to any other individuals who contact the Company or otherwise provide or disclose personal data to it (unless stated otherwise below). This includes all persons who use the Company’s services, provide services or supplies to the Company, or are otherwise in a relationship with the Company. Personal data are processed by the Company both manually and automatically within its information systems. If personal data of data subjects are processed in connection with the sending of marketing communications through automated systems, automated decision making may occur, including profiling.

Sources of Personal Data

The Company obtains personal data either i) directly from the data subjects (when entering into a contractual relationship with the data subject or for the purposes of establishing such a contractual relationship, when the data subject contacts the Company with an offer or request, when the Company communicates with the data subject, etc.) or ii ) from other sources (publicly accessible registers, websites, from third parties - business partner of the Company, employer of the data subject, etc.). The Company may combine the information collected from these sources with other information it obtains through its own activities, i.e. by processing and evaluating personal data already collected.

Purposes of Personal Data Processing

The Company processes personal data for the following purposes:

• preparation, fulfilment and registration of contracts concluded as part of development activities
• contacting the data subjects for the purpose of future business cooperation
• fulfilment of the Company's legal obligations
• tax and accounting purposes
• debt recovery
• litigation and defence of the Company's legal claims
• marketing, advertising and corporate communication
• recruitment of new employees
• protection of property, security and third parties
• prevention and ethics line

Categories of Data Subjects

• employees of the Company
• job applicants
• clients within the framework of the Company's development activity
• other natural persons (business partners, employees of business partners, etc.)

Scope of Processed Personal Data

• identification data: title, first name, surname, social security number, date of birth, ID number, VAT number, gender, data from an identity document
• contact details: permanent residence, correspondence address, registered office, place of business, telephone number, e-mail address
• other data: bank details, photos, data listed in the job applicant's CV (education, knowledge, work experience, etc.)

Legal title of personal data processing

• fulfilment of contracts
• consent granted by the data subject
• fulfilment of the Company's legal obligations
• legitimate interests of the Company (claims collection, litigation, protection of property and third parties)

Personal data storage period

The Company always keeps all personal data for the period necessary to comply with the purpose for which the personal data is processed, in particular for the period:

• established by law or other generally binding legal regulations
• established in the consent granted
• or duration of the contractual relationship and, by default, ten years after its end, unless other archiving periods are stipulated by law

Security of personal data

The Company has implemented a multi-level system for protection of processed personal data, which includes organizational and technical measures against the access of unauthorized persons to the personal data processed.

Sharing and Transfer of Personal Data

With regard to specific categories of data subjects, the Company is authorized to provide personal data to other processors and recipients in order to fulfil legal and contractual obligations, i.e. those being:

• companies of the Metrostav Group
• suppliers of construction works within the Company's development activities
• suppliers of IT technologies
• other suppliers and service providers
• banking institutions in the case of project financing of a development project
• other persons participating in the conclusion and registration of contracts and related documents
• persons of apartment building managers
• courts, Police of the Czech Republic, state authorities

In addition to the above-mentioned entities, the Company is entitled to share or transfer personal data with other entities, if the data subject has consented to this. Considering the fact that the Company develops its development activities only in the territory of the Czech Republic, it does not transfer personal data abroad or to international organizations.

Rights of data subjects

The subject of personal data is entitled, in connection with the processing of its personal data, to exercise the rights listed below in relation to the Company, while for its requests it can use the contact details listed at the end of policy hereof:

• information on whether the Company processes its personal data and, if so, to request additional information about such processing
• the right to correct inaccurate personal data
• the right to erase personal data (in the case of a data subject's request for erasure of its personal data, the Company will delete it without any undue delay after delivery of the given request, unless there is another legal reason for its further processing (unsettled dispute or legal claim between the Company and the data subject, legal archiving period not yet expired, personal data is stored in anonymous or aggregated form, the Company needs personal data for legitimate business purposes)
• the right to restrict the processing of only some personal data or only for certain processing purposes (if the data subject believes that its personal data being processed is inaccurate, that the Company is processing it illegally, that the Company no longer needs them, but the data subject would like to use them for the defence of its legal claims or if the data subject objects to its processing, until the legitimacy of the Company's interest in its processing is verified
• the right to object to processing, including the right to object to processing for marketing purposes, including profiling<
• the right to transferability of personal data (transfer of personal data of the data subject processed by the Company to a third party to the extent instructed by the data subject)
• the right to withdraw consent to processing of personal data/li>
• the right to file a complaint with the Company or the Office for Personal Data Protection www.uoou.cz

In case processing of personal data is based on a consent granted by the data subject, this data subject is entitled to revoke the consent at any time, without prejudice to the legality of the processing based on the consent granted before its revocation. Consent can be revoked in writing at the address of the Company's registered office or at the e-mail address: info@metrostavdevelopment.cz. In such a case, the Company is obliged to delete personal data of the data subject, with the exception of the case when their processing is based on another legal title (performance of the contract, legitimate interest of the Company, etc.).

Contact

Any questions and requests regarding the protection and processing of personal data in the Company can be addressed to the following e-mail: info@metrostavdevelopment.cz