GDPR

Translated from the Czech-language memorandum published on libenskyfamilyoffice.com.

GDPR (General Data Protection Regulation) refers to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. It establishes a single set of data protection principles and rules across the EU. The regulation was adopted in May 2016 and has applied since 25 May 2018.

Purpose of this document

This memorandum explains the terms under which Libensky Family Office a.s., Horní náměstí 371/1, 779 00 Olomouc, IČ: 049 21 640 (referred to as "we," "us," or "the Company") processes your personal data. It applies to you if you are:

• A visitor to our company's registered office or premises
• A business partner of the Company, or a person representing a business partner

Who is responsible for processing my personal data?

The data controller responsible for the proper processing of your personal data is the Company (see above).

How can I contact the data controller?

You can reach us at:

• Address: Preslova 444/39, 602 00, 779 00 Brno – Pisárky
• Email: libenskyfamilyoffice@gmail.com
• Web: libenskyfamilyoffice.com

What categories of personal data are processed?

The Company processes the following categories of personal data:

1. Data about business partners and their representatives

• Identification data: first name, last name, titles, date of birth, place of residence
• Contact data: telephone number, email address, correspondence address
• Banking details: name of the bank and account number
• Data relating to the contractual relationship and its performance

2. Data about visitors to the company's premises

• Identification data: first name, last name

What is the legal basis for processing?

We process personal data on the following legal grounds:

• Compliance with legal obligations — the Commercial Code and other legislation require it.
• Performance of a contract — to exercise rights and fulfil obligations arising from agreements between you and the Company.
• Our legitimate interests — where processing is necessary to protect our interests and your interest in data protection does not override ours.
• Consent — the Company does not currently process data on the basis of consent, but may do so if you provide it.

For what purposes is personal data processed?

• Preparing and amending contractual documentation — legal basis: performance of a contract.
• Exercising rights and obligations under a contract — legal basis: performance of a contract.
• Verifying creditworthiness (e.g. checking insolvency registers, international sanctions lists) — legal basis: legitimate interest, performance of a contract, legal obligation.
• Accounting, tax records, and document archiving — legal basis: legal obligation, legitimate interest.
• Protecting the Company's assets — legal basis: legitimate interest.
• Handling disputes, including establishing, exercising, or defending our legal claims and debt recovery — legal basis: performance of a contract, legitimate interest.
• Sending business offers — we may use your contact details to offer an extension of our existing cooperation — legal basis: legitimate interest.

Where is my personal data stored?

Your personal data is stored both electronically and in physical (printed) form. Electronic documents are kept on the local drives of workstations. Physical documents are kept in lockable cabinets accessible only to authorised persons.

Who outside the Company will have access to my personal data?

Personal data you provide is processed and stored within the Company. Where processing is based on the legitimate interests and purposes described above, your data may also be processed by external collaborators and contractual partners of the Company. We carefully select any parties we work with, based on the guarantees they provide for the technical and organisational protection of the personal data we share with them.

How long will my personal data be retained?

We generally process your personal data for the duration of the contractual relationship with the relevant business partner. After the relationship ends, we retain only those documents or personal data for which we have a legitimate interest (e.g. a potential defence of our interests in a dispute) — for 10 years after the relationship ends — and/or those we are legally required to retain (in some cases for up to 30 years). In line with the principle of data minimisation, we process only the personal data strictly necessary for a given purpose and retain it only as long as necessary. Once that period elapses, the data is deleted or anonymised.

What are my rights regarding the processing of my personal data?

You have the right to request access to your data at any time — meaning we will tell you, on request, what personal data of yours we process, for what purpose, from what source it was obtained, to whom it has been disclosed, and how long it will be retained.

You have the right to request correction of inaccurate personal data, or to have it completed if incomplete. You also have the right to request erasure of personal data that is no longer needed for the purpose for which it was originally collected, or that we are no longer entitled to use for other reasons (e.g. it was processed unlawfully, or erasure is required by law).

You have the right to request restriction of processing — meaning you can ask us not to delete data we would otherwise be required to delete, and to stop working further with your personal data until it is clarified whether the data being processed is accurate, or whether an objection you raised against processing was justified (see the right to object below).

You have the right to data portability — meaning you can request that we provide the personal data we process about you in electronic form, in a way that is easily transferable to another controller (service provider), or that we transfer that data directly to another controller. This right applies only to personal data we obtained electronically, on the basis of your consent or a concluded contract.

You have the right, at any time, to object to the processing of your data for direct marketing purposes (sending business offers). If you do, your personal data will no longer be used for that purpose.

You also have the right to object to processing based on our legitimate interest — in that case we will continue processing your data only if we can demonstrate compelling legitimate grounds for doing so.

Where processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. Processing will then stop immediately.

How can I exercise my rights?

You can exercise your rights (including the right to object) by contacting the Company in writing or by email — see the contact details above. For faster and more effective handling of your request, please use the contact email published on our website, libenskyfamilyoffice.com.

What if I believe my personal data has been processed unlawfully?

In that case, you have the right to lodge a complaint with the relevant supervisory authority.

Does automated decision-making, including profiling, take place?

Automated decision-making means a decision made by a machine (computer) without human involvement, which has legal or similarly significant effects on you (e.g. refusal or termination of a contract). No such processing of your personal data takes place at the Company — all relevant decisions are made by a specific member of Company staff.