Personal data processing policies

(hereinafter referred to as the “Principles”)

I. Basic provisions

1. Personal data controller.The personal data controller pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as: “GDPR”) is In Investments a.s., with its registered office at K Moravině 1871/7, 190 00 Prague 9, Company ID: 03 00 25 78 (hereinafter referred to as the “Controller”, “or the “Company”).
2. Contact the Administrator. You can contact the Administrator in the following ways: electronically at the e-mail address obchod@ininvest.cz or via the electronic contact form on the website https://www.ininvest.cz
3. Personal data. Personal data means any information about an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
4. The Company as a processor. Since the Company provides its services as an intermediary of investment products, the Company is in the position of a processor in relation to personal data processed by the investment service provider.
5. Scope of collection of personal data. If you contact the Administrator via an electronic contact form, the Administrator will process in particular the information provided in the electronic contact form, primarily your e-mail and/or telephone number and further electronic data, in particular your IP address, browser type, domain name and cookies. If you contact the Administrator via e-mail or telephone, the Administrator processes the personal data that you have provided to him/her in this way. The provision of your personal data is always completely voluntary in all cases. The Administrator also processes the personal data that he/she has received from you during the duration of the contractual relationship.

II. Purpose, lawful basis and duration of personal data processing

1. Purpose of processing personal data. All personal data that you have provided to the Administrator via an electronic contact form, by e-mail or by telephone will be processed by the Administrator primarily for the purpose of processing your message and preparing a response to it, or in order to contact you directly. Processing of your personal data is also possible for the purpose of submitting an offer, arranging a meeting and for the possible exercise of rights and obligations arising from the contractual relationship between you and the Administrator. The provision of personal data is a necessary requirement for the conclusion and performance of the contract; without the provision of personal data, the contract cannot be concluded or the Administrator can perform it. The Administrator also processes your personal data for the purpose of fulfilling the Administrator's registration obligation, in particular pursuant to Act No. 256/2004 Coll., on business on the capital market, Act No. 253/2008 Coll., on certain measures against the legalization of proceeds from crime and the financing of terrorism, and Act No. 563/1991 Coll., on accounting. The Administrator processes your personal data to prove the fulfillment of the Administrator's legal obligations. Last but not least, the Administrator may also process your personal data for the purpose of sending commercial communications and performing other marketing activities and for the purpose of presenting the Administrator and promoting the services provided by the Administrator.
2. Legal basis. The legal basis for processing personal data is, depending on the circumstances:
   • legitimate interest of the Controller pursuant to Article 6(1)(f) GDPR (sending commercial communications, demonstrating compliance with legal obligations);
   • processing of personal data based on consent pursuant to Article 6(1)(a) GDPR (contacting clients of business partners for whom the Company is the processor after the termination of the contractual relationship concluded between the business partner and the client) performance of the contract between you and the Controller pursuant to Article 6(1)(b) GDPR;
   • fulfillment of the Controller’s legal obligations pursuant to Article 6(1)(a) GDPR c) GDPR (fulfillment of legal obligations, in particular pursuant to Act No. 256/2004 Coll., on entrepreneurship on the capital market, Act No. 253/2008 Coll., on certain measures against the legalization of proceeds from crime and the financing of terrorism and Act No. 563/1991 Coll., on accounting);
   • Your consent to processing for the purposes of providing direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6, paragraph 1, letter a) GDPR in conjunction with Section 7, paragraph 2 of Act No. 480/2004 Coll., on certain information society services in the event that no order for goods or services has been made.
3. Personal data retention period. The Administrator stores personal data for the period specified below. After the expiry of the personal data retention period, the Administrator deletes the personal data. The Administrator stores personal data:
   • for the entire period during which you are in contact with the Administrator, but no longer than 2 years from the last communication between you and the Administrator, unless a brokerage contract or investment advisory contract has been concluded between you and the Administrator;
   • for the period necessary to exercise the rights and obligations arising from the contractual relationship between you and the Administrator and to assert claims from these contractual relationships;
   • for the period during which the Administrator is obliged to store personal data pursuant to special legal regulations;
   • for the period until consent to the processing of personal data for direct marketing purposes is revoked, but no longer than 2 years.

III. Recipients of personal data

1. Recipients of personal data. The Administrator may transfer your personal data:
   • to processors with whom the Administrator has concluded a processing agreement; the list of such processors is provided below;
   • to other recipients for the fulfillment of the Administrator's legal obligation, in particular criminal law enforcement agencies, the Tax Office, the Financial Analysis Office, etc.)
2. Transfer of personal data abroad. The Administrator does not intend to transfer personal data to a country outside the EU or an international organization, except in cases where the transfer of personal data occurs through a data storage service provider (cloud). For this purpose, the Administrator uses Microsoft Corporation data centers, the operation of which is in accordance with European personal data protection standards (GDPR).

IV. Your rights

1. GDPR. Under the conditions set out in the GDPR, you have
   • the right to access your personal data pursuant to Article 15 GDPR;
   • the right to rectification of personal data pursuant to Article 16 GDPR, or restriction of processing pursuant to Article 18 GDPR;
   • the right to erasure of personal data pursuant to Article 17 GDPR;
   • the right to data portability pursuant to Article 20 GDPR;
   • the right to object to processing pursuant to Article 21 GDPR;
   • the right to withdraw consent to processing in writing to the address or e-mail of the Administrator specified in Article I of these Principles, if the lawful basis for processing is the consent of the data subject.
2. OPDP. if you believe that your right to personal data protection has been violated, you have the right to file a complaint with the Office for Personal Data Protection.

V. Personal Data Security Statement Administrator's Statement

1. Prohlášení Správce. The Administrator declares that it has taken all appropriate technical and organizational measures to secure personal data, in particular measures to secure data storage and personal data storage in paper form. The Administrator declares that it uses appropriate anti-virus programs, secure passwords and ensures secure storage of backups. The Administrator further declares that only persons authorized by him have access to personal data.

VI. Final provisions

1. Granting consent. By checking the consent box in the electronic contact form, you agree to receive commercial communications (newsletters).
2. Withdrawal of consent. You may withdraw the consent granted in accordance with the previous paragraph at any time. If you withdraw your consent, the processing of your personal data based on such consent before its withdrawal will not be affected.
3. Dispute resolution. All legal relationships arising in connection with the processing of personal data under these Principles are governed by the law of the Czech Republic, regardless of where access was made. The Czech courts are competent to resolve any disputes arising in connection with the protection of personal data under these Principles.
4. Amendment of the Principles. The Administrator is entitled to amend these Principles at any time. The Administrator will publish a new version of the Personal Data Protection Principles on its website or send you a new version of these Principles to the e-mail address you provided to the Administrator.

These Policies come into effect on January 1, 2019.