Information Memorandum on Personal Data Processing

Leite group s.r.o., Company ID: 041 64 920, with registered office at Kabešova 943/2, Vysočany, 190 00 Prague 9, registered in the Commercial Register maintained by the Municipal Court in Prague under file number C 243533 (hereinafter "we") consider the protection of personal data to be an integral part of our obligations not only to clients and employees, but also to you, our suppliers and customers, their subcontractors, members of statutory bodies and contact persons and other employees, members of implementation teams and their subcontractors (hereinafter "business partners" or "you"). We therefore pay due attention to the protection of personal data and when ensuring the protection of personal data, we act in accordance with legal regulations.

In this document you will find information about what personal data we process within the relationship between us and you. You will find information here about whether we process personal data based on your consent or based on another legal basis (reason), for what purposes we process the data, whether we transfer it to someone and what rights you have in connection with the processing of your personal data. Please therefore consider this document as an important source of information about how we process your personal data.

1. What personal data do we process?

   We process the following personal data:

   1. Identification data, which means in particular name, surname, date of birth, job position and in case you are our customer as a self-employed natural person, then also your Company ID and VAT ID
   2. Contact data, which means personal data that enable us to contact you, especially contact address, phone number, email address, etc.
   3. Records of mutual communication, which means in particular written correspondence or records of other forms of communication;
   4. Information necessary for contract performance, which means in particular data on used services and the scope of their use, login identifiers and in case you are our customer as a self-employed natural person, then also your bank account number.

2. Why do we process personal data and what authorizes us to do so?

   We process personal data for the following purposes:

   1. conclusion and performance of contracts with business partners, based on contract performance if the business partner is a natural person, or based on our legitimate interest in performing such contract if it concerns a natural person who represents the business partner or otherwise participates in contract performance (e.g., employees of our business partners and customers who are users of our services);
   2. internal administrative needs, creation of records of provided services, based on our legitimate interest in ensuring proper records of concluded contracts with business partners and legitimate interest in managing relationships with business partners and process optimization;
   3. security and maintenance of IT infrastructure, protection of our equipment and other assets, based on our legitimate interest in adopting especially technical measures to ensure cybersecurity and protection of our assets;
   4. protection of legal claims, based on our legitimate interest in ensuring proper protection and effective enforcement of our rights and claims;
   5. compliance with legal and other obligations, especially in the area of tax and accounting, based on legal obligation that applies to us as a controller

3. From what sources do we obtain personal data and how long do we process it?

   We obtain personal data directly from you by filling them in when requesting our services and in contractual documentation. We also obtain and further process personal data that your employer provided to us about you for the purpose of using our services.

   We retain personal data to the necessary extent for the period of:

   1. contract duration in case of purpose under letter a) above;
   2. for the duration of the limitation period, including the period covering its possible suspension or interruption, typically no longer than 16 years after termination of the contract in case of purposes under letters b) to d) above;
   3. fulfillment of relevant legal obligations in case of purposes under letter e) above.

4. Who processes your personal data and to whom do we transfer it?

   We process all the mentioned personal data as a controller. This means that we determine the above-defined purposes for which we collect your personal data, determine the means of processing and are responsible for its proper implementation.

   For personal data processing, we also use services of other processors who process personal data on our instruction. Such processors are especially:

   1. Suppliers of related IT services providing hardware and software support.

   All processors are bound by a processing agreement to fulfill requirements according to legal regulations on personal data protection, especially to protect your personal data.

   Furthermore, we are obliged to transfer processed personal data to state administration bodies, courts, criminal proceedings bodies, supervisory bodies if they request it, or to audit companies if required by legal regulations.

5. What rights do you have when processing personal data?

   Just as we have our rights and obligations when processing your personal data, you also have certain rights when processing your personal data.

   Right of access

   Simply put, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we transfer it, who processes it besides us and what other rights you have related to the processing of your personal data. You have learned all this in this Information on personal data processing. However, if you are not sure which personal data we process about you, you can ask us for confirmation whether personal data concerning you are or are not processed by us, and if so, you have the right to obtain access to this personal data. Within the right of access, you can

   request a copy of processed personal data, whereby we will provide you with the first copy free of charge and additional copies for a fee.

   Right to rectification

   If you find that the personal data we process about you are inaccurate or incomplete, you have the right to have us correct or complete them without undue delay.

   Right to erasure

   In some cases, you have the right to have us erase your personal data. We will erase your personal data without undue delay if one of the following reasons is fulfilled:

   1. We no longer need your personal data for the purposes for which we processed them,
   2. you exercise your right to object to the processing of personal data that we process based on our legitimate interests, and we find that we no longer have any such legitimate interests that would justify this processing, or
   3. it turns out that our processing of personal data has ceased to be in accordance with generally binding regulations.

   But please keep in mind that even if one of these reasons applies, it does not mean that we will immediately delete all your personal data. This right does not apply if the processing of your personal data is still necessary for:

   1. fulfillment of our legal obligation,
   2. archiving purposes, scientific or historical research or for statistical purposes, or
   3. establishment, exercise or defense of our legal claims.

   Right to restriction of processing

   In some cases, in addition to the right to erasure, you can exercise the right to restriction of personal data processing. This right allows you in certain cases to request that your personal data be marked and that this data not be subject to any further processing operations – in this case, however, not forever (as in the case of the right to erasure), but for a limited time. We must restrict the processing of personal data when:

   1. you contest the accuracy of personal data until we agree on which data are correct,
   2. we process your personal data without sufficient legal basis (e.g., beyond what we must process), but you would prefer only their restriction before erasure of such data (e.g., if you expect that you would provide us with such data anyway in the future),
   3. we no longer need your personal data for the above-mentioned processing purpose, but you require them for the establishment, exercise or defense of your legal claims, or
   4. you object to the processing of personal data. During the period in which we investigate whether your objection is justified, we are obliged to restrict the processing of your personal data.

   Right to object to processing

   You have the right to object to the processing of personal data that occurs based on our legitimate interest. We will stop processing your personal data unless we have compelling legitimate grounds to continue such processing.

   Right to lodge a complaint

   The exercise of rights in the above-mentioned manner does not affect your right to lodge a complaint with the Office for Personal Data Protection. You can exercise this right especially if you believe that we process your personal data unlawfully or in violation of generally binding legal regulations. You can lodge a complaint against our processing of personal data with the Office for Personal Data Protection, which is located at Pplk. Sochora 27, 170 00 Prague 7.

6. How can individual rights be exercised?

   In all matters related to personal data processing, whether it is a question, exercise of rights, lodging a complaint or anything else, you can contact us using the following contacts:

   Email: info@leite-group.eu

   Correspondence address: Leite group s.r.o., Kabešova 943/2, Vysočany, 190 00 Prague 9

   Current contact information is available on our website.

   We will handle your request without undue delay, but no later than within one month. In exceptional cases, especially due to the complexity of your request, we are entitled to extend this deadline by another two months. We will of course inform you about such possible extension and its justification.