DATA PROTECTION

I. Content and purpose of the document

1. This document contains information regarding the protection of personal data provided by visitors to the www.acrios.com website, our clients and those interested in our services and products.

2. The purpose of this document is to inform you (data subjects) of your rights and to provide clear information on how personal data will be handled.

3. We appreciate your trust in providing us with your personal data, and therefore we are already proceeding with the processing of personal data not only in accordance with Act No. 110/2019 Coll., on the protection of personal data, but we are also adapting the handling of personal data to Regulation (EU) 2016/679, i.e. the General Data Protection Regulation, which will come into force on 25 May 2018 and is commonly known as GDPR. Clicking on the number of the regulation in the previous sentence will take you directly to the text of this regulation and you will also find there the exact legal provisions that we refer to in this text below.

4. The content that awaits you in this document:

• Content and purpose of the document
• Personal Data Controller - who are we and how can you contact us?
• What personal data do we process and how do we obtain it?
• For what purposes do we process personal data, for how long and what entitles us to do so?
• Disclosure of personal data to others
• Information about your data protection rights
• Other important information for exercising your rights

__________________________________________________________________________

II. Personal data controller - who are we and how can you contact us?

ACRIOS Systems s.r.o., ID No.: 05082251, with registered office at Meziříčská 2868, 756 61 Rožnov pod Radhoštěm (hereinafter referred to as the "Administrator")

we are registered in the Commercial Register at the Regional Court in Ostrava, registration number C67331

contact e-mail: malinowski@acrios.com, contact phone: +420 732 533 741, our website: www.acrios.com

III. What personal data do we process and how do we obtain it?

We process the data you provide us with. In specific cases, this may include, in particular, the provision of data by filling in one of the forms on the website, by entering data into the user account set up on our website, by providing data in the preparation of contracts and related documents and in connection with the execution of contracts (i.e. in connection with the delivery of goods, provision of services), by personal contact, by telephone, in writing, by e-mail or by other means of communication (text messages, messages in applications such as skype, FB messenger).

We also process data that you yourself publish on the internet and in particular on social networks (e.g. Facebook, Instagram, Linkedin) and data from public registers (in particular for the inclusion or checking of your identification data in contracts).

If we need your consent to process certain personal data for specific processing purposes, we will only process such data for that purpose with your consent.

You provide us with the data voluntarily in principle, only in some cases we would not be able to deliver the ordered goods (e.g. if we have to send them to a specific address and you do not provide it) or provide a service (e.g. certain input data are necessary for consulting), we will always notify you in advance. You are only obliged to provide us with data if the law directly requires it.

Personal data may fall under the category of "ordinary personal data" or it may be special categories of data, i.e. sensitive data, where the law provides for stricter conditions for processing.

A. Common personal data we process:

First name, last name, title, address, date of birth, age, birth number, ID number, phone number, email, IP address, cookies, information about the goods and services you have ordered, information about what goods you have purchased from us and what services we have provided to you, your marital status, gender, profile picture, pictures from our live meetings/educational events you have attended, video recordings of these events.

B. Special categories of personal data ("sensitive" personal data) that we process:

We do not process any special categories of personal data.

IV. For what purposes do we process personal data, for how long and what entitles us to do so?

A. Processing of personal data for the purpose of concluding a contract and fulfilling contractual obligations

In order for us to enter into a contract with you and deliver the goods/products or services you have ordered, and to conduct related communications with you, we process the following common personal data: name, surname, title, address, date of birth, gender, age, birth number, ID number, telephone number, e-mail, information about the goods and services you have ordered, information about what goods you have purchased from us and what services we have provided to you.

The legal title (authorisation) for the processing of this data is directly for the performance of contractual obligations under the contract concluded between us. Such an obligation may be the delivery of goods, the sending of specific instructions, etc. This does not have to be a contract concluded in a traditional printed form, signed in manuscript. For example, it may also be a contract concluded verbally, over the telephone or by filling in and submitting an order form on the website and our confirmation of such order.

For this purpose, we process personal data for the duration of the contractual relationship between us. After the end of the contractual relationship, some data is then retained for the purposes of compliance with legal obligations or for legitimate interest purposes, as you will read in the following sections of this document.

B. Processing of personal data for compliance with accounting, tax and other legal obligations

In order to comply with the obligations arising from applicable legislation, in particular in the field of accounting, tax law and the obligations arising from Act No. 253/2008 Coll., we process data such as: Name, surname, title, address, date of birth, gender, age, birth number, ID number, telephone number, e-mail, information about the goods and services ordered, information about what goods you have bought from us and what services we have provided to you.

The period of time for which the data is processed is determined directly by the relevant legal regulations that oblige us to process it.

C. Processing of personal data for the purposes of our or a third party's legitimate interests

A legitimate interest can cover a wide range of situations. We therefore inform you about the legitimate interests for which we process personal data:

• The legitimate interest is the protection and proof of our rights and legal claims, in particular those arising from contracts concluded or damages caused. For these purposes, we process personal data for a period of 4 years after the end of the contractual cooperation or our last contact if no contract has been concluded. This period is set in relation to the limitation periods for claims, taking into account that we may not become aware of any claim brought before a court immediately when it is brought by the other party. For this purpose, data from contracts and our communications with each other are stored.
• Furthermore, direct marketing is a legitimate interest. For the purpose of sending commercial communications, we will process the following personal data of our clients. If we use the classic printed form or a phone call or one of the communication applications such as skype, messenger to send you our offer or information about our news, we will also respect this if you let us know that you do not want further contact.
• In order to provide you with tailored products and services and to send you only offers and information that will be of value to you, we have our database of contacts and personal data divided into multiple lists. For example, if you would like to receive information about our newsletter, your email contact will be included in the "newsletter mailing" database. Similarly, if you send us an order from the website, your contact will be included in the "ordered" list and, once paid, in the "paid" list. This processing thus serves directly for the fulfilment of our contractual obligations, part of which is used for normal marketing (i.e. falls under the category of legitimate interest).

D. Processing of personal data on the basis of your consent

If you give us your consent, we will process your personal data to send you offers of our services/products. We will need your consent for this processing if you are not our client. Before you give us your consent, we will inform you of what data and for what specific purpose the processing will relate to. You can withdraw your consent at any time. However, if we also process some of your personal data on the basis of another legal basis (see A to C above), we will continue to process your personal data for those purposes after your consent has been withdrawn, as consent is not required for those specific purposes.

V. Disclosure of personal data to other persons

We are assisted by other persons who act as processors to ensure that we meet some of our contractual or legal obligations. In particular, these include cooperating accountants, law firms, data storage and software application providers. We have written contracts with processors agreeing to data protection obligations to keep your data safe. A current list of processors can be requested and will be emailed to you.

Personal data will also be disclosed to the relevant administrative authorities if we are obliged to do so by law (i.e. in particular in the case of an inspection in which the relevant authority is entitled to require the submission of personal data).

VI. Information about your other data protection rights

A. Right of access to personal data

This is the right to confirm whether we are processing your personal data and, if so, to access that data and information about its processing.

B. Right to rectification of personal data

This is the right to have inaccurate personal data concerning you corrected without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing an additional declaration (in which you provide complete data).

C. Right to erasure of personal data (right to be forgotten)

In the cases provided for by law or the GDPR, you have the right to request that we delete your personal data without undue delay (the GDPR lists the grounds in Article 17, including exceptions where deletion is not carried out).

D. Right to restriction of processing

In the cases set out in Article 18 of the GDPR, you have the right to request that we restrict the processing of your personal data.

E. Right to data portability

Under the conditions set out in Article 20 of the GDPR, you have the right to obtain your personal data and transfer it to another controller.

F. Right to object

Where we process personal data for legitimate interest purposes, you have the right to object to such processing and we will then no longer process the data unless our legitimate interest overrides your interests or rights and freedoms. If the legitimate interest is direct marketing, then objecting will always result in the cessation of further processing for direct marketing purposes.

G. Right to lodge a complaint with the supervisory authority

If you believe that your data protection rights are being violated, you have the right to file a complaint with the Office for Personal Data Protection. For more information about the Office and data protection, please visit the Office's website directly at www.uoou.cz.

VII. Other important information for exercising your rights

If you have any further questions about the processing of your personal data by us, you can contact us at malinowski@acrios.com. By sending a message to this email or by sending a written request to our address listed at the beginning of this document, you can also directly exercise your rights as described in Article VI. Please note that we may contact you afterwards to verify that the request is indeed made directly by you and to reasonably verify your identity and request. The same applies to any telephone or similar communications.

The current version of this document can always be found at www.acrios.com
This version is effective as of 25.5.2018.