Information on the processing of personal data of business partners

Dear business partners,
The information below is provided to ensure you are fully and transparently informed about the processing of your personal data by the data controller, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "General Data Protection Regulation").

1. Identity and contact details of the controller: VUAB Pharma a.s., with its registered office at Vltavská 53 252 63 Roztoky, ID No: 63078180, registered in the Commercial Register maintained by the Municipal Court in Prague, Section B, Entry 3036 Contact person: Mgr. Lucie Svobodová tel.: 603 188 546 e-mail: lucie.svobodova@safichemgroup.com (hereinafter referred to as „My“ or also „Controller“)
   
   We have committed to protecting the privacy and personal data of our tenants, business partners and individuals acting on their behalf, with whom we come into contact with their personal data. We provide the following information regarding the processing - primarily the collection, publication and further use - information relating to the processing - primarily the collection, publication and further use - personal data relating to our tenants and other business partners and individuals acting on their behalf.
2. The data protection representative was not appointed at the Controller.
3. Personal data that the Controller processes about you: We obtain your personal data from several sources. The primary source of your personal data is you personally or your company, or the company you represent (e.g. when we enter into a contract with you and you personally, or the company you represent, provide us with your identification or payment details for these purposes). We may also obtain your personal data for the above purposes from publicly available sources, such as public lists, registers and registers (e.g. the Commercial Register or the Trade Register) or may be provided to us by third parties (in particular information from the camera system operated on the premises at the company's registered office).
   
   The information or data we process about you is considered personal data, which includes:
   • Name, optionally names and surnames;
   • Date of birth;
   • Permanent or other residence;
   • Contact details (telephone, email, delivery address); ID No individual entrepreneur;
   • VAT No individual entrepreneur;
   • Work position or classification of an individual at a business partner;
   • Bank account details;
   • Information from the camera system operated on the premises at the company's registered office.
4. Purpose of processing personal data and legal basis for their processing: The purpose of processing your personal data is:
   1. Managing relationships with you – tenants, business partners, customers and potential tenants and partners, in particular in the form of conclusion, performance and possible amendment of the concluded contract; The processing of personal data for this purpose is necessary for the performance of the contract to which the data subject is a party, or to take measures taken before the conclusion of the contract at the request of that data subject data within the meaning of Article 6(1)(b) of the General Data Protection Regulation and necessary for the purposes of the legitimate interests of the Controller and third parties within the meaning of Article 6(1) (f) of the General Data Protection Regulation.
   2. Fulfillment of tax and accounting obligations; The processing of personal data for this purpose is necessary for the performance of the Controller's legal obligations, in accordance with Article 6(1)(b) of the General Data Protection Regulation and necessary for the purposes of the legitimate interests of the Controller and third parties within the meaning of Article 6(1) (f) of the General Data Protection Regulation.
   3. General Data Protection Regulation, established in particular:
      1. Act No. 563/1991 Coll., on Accounting, as amended (hereinafter referred to as the "Accounting Act");
      2. Act No. 586/1992 Coll., on Income Taxes, as amended (hereinafter referred to as the "Income Tax Act");
      3. Decree No. 500/2002 Coll., implementing certain provisions of Act No. 563/1991 Coll., on Accounting, as amended, for accounting entities that are entrepreneurs keeping accounts in a double-entry accounting system, as amended.
   
   If it is further desirable for us to process your personal data beyond the scope of obligations stipulated by law, or our legitimate interests or the legitimate interests of a third party, we will always ask for your prior written consent.
5. Information on your obligation to provide personal data: Providing your personal data is, in the case of the above-mentioned purposes, a necessary requirement for the proper performance of the contract with you. However, you must also provide your personal data for legal reasons, in particular for the proper fulfillment of our tax and accounting obligations. Failure to provide your personal data to the required extent may, in extreme cases, mean that the contract cannot be fulfilled or may compromise the quality of its performance.
6. Authorized interests of the Controller or a third party in the event that processing is necessary for the purposes of the authorized interests of the Controller or a third party: The processing of your personal data may also be necessary for the purposes of our legitimate interests, in particular in connection with the possibility of exercising our rights and claims arising from the performance of the contractual relationship between you - the tenant, business partner, customer and potential tenant and partner - and us, the protection of our property and communication with you.
   
   We also process the personal data of representatives of tenants, business partners and suppliers who are legal entities on the basis of our legitimate interests. Given that these representatives act in most cases for tenants, business partners or suppliers on the basis of a contractual relationship with them (they are, in particular, employees, members of statutory bodies, sales representatives or authorized persons, etc.) in order to fulfill the contract concluded between us and the business partner in question, this is not a case where the interests or fundamental rights and freedoms of these representatives of tenants, business partners or suppliers requiring the protection of personal data should take precedence over these legitimate interests of ours.
7. Recipients or categories of recipients of personal data:
   • state authorities (in particular the Office for Personal Data Protection, law enforcement authorities, the Police of the Czech Republic, public prosecutors, courts, tax administrators) and other entities under other legislation;
   • entities that provide services to us (in particular banks, insurance companies, IT services, lawyers and other advisors) and with whom we have concluded a relevant personal data processing agreement;
   • possibly selected companies from the SAFICHEM GROUP, if there is a legitimate interest.
8. Transfer of personal data to third countries: We do not intend to transfer personal data to third countries or international organizations.
9. Personal data retention period: When handling your personal data for specific purposes, we respect the principle of storage limitation, whereby we retain your personal data only for the time necessary. We also respect the principle of data minimization, whereby we only retain personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
   
   We retain your personal data for the duration of our contractual relationship for the purpose of exercising the rights and obligations arising therefrom, and even after its termination for other necessary purposes, such as compliance with our legal obligations, contractual obligations, dispute resolution and legal enforcement of legitimate claims or for possible administrative proceedings. These needs vary depending on the specific reason for their retention, and therefore the retention period of different types of your personal data varies significantly in specific cases, and may reach up to 10 years from the termination of the contractual relationship.
   
   Reference can also be made to legal regulations regarding accounting and tax obligations, which also define the archiving period for which accounting documents must be archived. Accounting documents and accounting records that we use to document the accounting must be kept for the following period of 5 years, starting at the end of the accounting period to which they relate.
   
   In exceptional cases, for example, in the event of litigation, some documents containing your personal data may be kept for a longer period of time in order to protect our legitimate interests. This is especially the case when we would have to submit these documents as evidence in litigation, administrative proceedings or for the purpose of enforcing a decision.
   
   If a camera recording from the camera system operated on the premises at the company's registered office is provided at our request, it will only be kept by us for the necessary period.
10. Automated individual decision-making, including profiling When processing your personal data, there is no decision-making based solely on automated processing, including profiling, that would have legal effects for you or would significantly affect you in a similar way.
11. Your rights in connection with the processing of your personal data: In connection with our or for us processing of your personal data, you have the following rights:
    • the right to request access to the personal data relating to you as the subject of data and the right to obtain a copy of your processed personal data;
    • the right to rectification of your personal data - if you find that they are not managed correctly or are inaccurate;
    • the right to erasure to the extent of voluntarily provided personal data, i.e. within the scope of fulfilling contractual obligations. Conversely, you cannot request the erasure of personal data that we are obliged to collect due to a legal obligation;
    • the right to restriction of processing;
    • the right to data portability;
    • the right to object to processing based on our legitimate interests or the legitimate interests of a third party;
    • the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data infringes the General Data Protection Regulation. You can lodge a complaint with the competent supervisory authority, which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7 (see www.uoou.cz).

Where can you exercise your rights and how? You can exercise your rights by sending an e-mail to the address provided above in our contact details or by submitting a written request to our address or correspondence address.
All communications and statements regarding your exercised rights are provided free of charge. However, if a request is manifestly unfounded or disproportionate, especially because it is repetitive, we are entitled to charge a reasonable fee taking into account the administrative costs associated with providing the requested information. In the event of a repeated request for copies of processed personal data, we also reserve the right to charge a reasonable fee for administrative costs for this reason.

How long can you expect an answer? We will provide you with the statement and, if applicable, the information about the measures taken as soon as possible, but no later than one (1) month. We reserve the right to extend this period by two months in case of need and taking into account the complexity and number of requests. We will inform you about any extension of the period and the reasons for it.