Information on the processing of client personal data RONDA INVEST a.s.

Introductory information

1. For the purposes of processing personal data, RONDA INVEST is the controller who has determined the purposes and means of processing.
2. RONDA INVEST processes the subject's personal data in the context of all its activities as a small-scale payment service provider and in the provision of regular information to subjects via web-based communication.
3. RONDA INVEST processes the personal data of the subjects in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the "Regulation").
4. RONDA INVEST has appointed a Data Protection Officer (hereinafter referred to as "DPO") to oversee data protection compliance within RONDA INVEST. The DPO is directly accessible at emailugdprpoverenec@rondainvest.cz.

What categories of data we process

1. We only process such data to provide our services to our clients, to comply with our legal obligations and to protect our legitimate interests.
2. RONDA INVEST collects, processes and stores in particular the following categories of personal data of clients:
   1. Identifying personal data - in particular name, surname, date of birth, birth number, address of residence, ID card number (passport, ID card), photo from ID card, nationality, country of birth, image of the client's signature; if the client is an entrepreneur, also ID number and address of registered office.
   2. Contact personal data - in particular telephone number, email, delivery address, access data enabling communication between RONDA INVEST and the client electronically, such as login names, passwords, PINs, and other security features used for secure authentication of the client.
   3. Data on products and services provided to the client - data related to the agenda, account number, contract number, data on the use of products/services or preferred language, geolocation data, transaction data, recommendations and offers.
   4. Data from mutual communication - data from the use of the RONDA INVEST website and applications, as well as information about mutual contact through any contact point (for how long, on what topic, and through which communication channel), including the resolution of complaints and service requests.
   5. Other data - e.g., CCTV footage, phone records.
3. Birth number

When concluding a contractual relationship, RONDA INVEST is obliged to ascertain the birth number of the client - a natural person or a natural person who is a member of the statutory body of a legal entity or who is an authorised person, and to store it for a specified period of time so that RONDA INVEST can provide the agreed services in accordance with the legal regulations and fulfil its obligations under the contract.

Purpose of processing of personal data of clients

1. Clients' personal data must only be collected for specific, explicit, and legitimate purposes and may not be further processed in a way that is incompatible with those purposes. The purpose of the processing is transparently communicated to the client.
2. Processing of personal data without the client's consent
   1. For the purpose of processing client documentation in connection with the negotiation, execution, and settlement of trades. Without the personal data provided for this purpose, RONDA INVEST cannot:
      • Verify the identity of the client when negotiating a contract or trade.
      • Prepare the contract documentation or an amendment to it and discuss it with the authorised person.
      • Comply with the requirements of the supervisory authorities.
      • Provide information and statements of agreed transactions only to authorised persons. Therefore, the contractual relationship cannot be concluded or continued without the provision of such data.
   2. To enable the use of products and services: If you use our services, your data is processed by us. In particular, this includes your identification data, data about products and services, and data based on your use of internet or mobile applications.
   3. For the purpose of fulfilling RONDA INVEST's legal obligations arising from legal regulations, in particular for:
      • Fulfilment of pre-contractual obligations under the Civil Code.
      • Fulfilment of contractual obligations under the contract concluded with the client.
      • Preservation and archiving of data according to legal requirements.
   4. To protect the rights and legally protected interests of RONDA INVEST:
      • For this purpose, we mainly evaluate data concerning the use of services by our clients to set the parameters of our products and services as accurately as possible.
      • Resolving all disputes, in particular for the purposes of litigation and other disputes.
      • For the purpose of managing our relationship with our customers, where we deal with clients to set up, adjust, change, provide product and service information, and address requests, wishes, and complaints, including requests and exercise of privacy rights.
      • We use the subjects' address and identification personal data for the purpose of direct marketing of RONDA INVEST products and services. Processing for direct marketing purposes can be considered as processing carried out for the legitimate interest of RONDA INVEST. The client is always given the opportunity to object to further marketing based on a legitimate interest of RONDA INVEST.
3. Processing of personal data with the client's consent
   1. Processing of personal data that does not fall under the above purposes may only be carried out with the client's consent. The provision of such consent is entirely at the discretion of the client. Within RONDA INVEST, the following processing is involved:
      • Making and keeping copies of clients' personal documents. Copies of identity cards may only be made with the express consent of the holder. RONDA INVEST may copy personal documents mainly to prevent crime. However, consent to obtain a copy is voluntary and withholding it does not prevent future contracts.
      • Processing client data for marketing purposes beyond the legitimate interest, especially to offer individual products and services upon the client's request or send offers for consented services.

Method of processing and storage of personal data and their storage period at RONDA INVEST

1. RONDA INVEST stores the data only for the necessary period in accordance with legal regulations and archives it for 10 years following the end of the calendar year in which the contractual relationship with RONDA INVEST was terminated. Strict internal archiving rules ensure data retention only as authorized.
2. Data processed with the client's consent is retained for the duration of the consent. RONDA INVEST also retains the consent itself and any changes for 10 years after it expires, for legitimate interests.
3. RONDA INVEST processes personal data manually or automatically and stores it securely in physical or electronic form. Client data is stored in RONDA INVEST's information system.
4. RONDA INVEST does not use automated decision-making or profiling that evaluates personal aspects (e.g., economic situation, behavior, preferences, or location).

Recipients of the client's personal data

1. Client personal data is managed mainly within RONDA INVEST. It may be transferred to third parties only on a legal basis, primarily for legal obligations. The client is transparently informed about the data recipients.
2. RONDA INVEST may disclose data to third-party processors, including IT, archiving, debt collection, legal, and marketing services. Access to these entities will always be based on a personal data processing agreement.
3. With the client's consent, data may be transferred to other entities.
4. Remote data processing and storage is not conducted. All data is processed in the Czech Republic, with no transfer to third countries or international organizations.

Sources of personal data

1. RONDA INVEST collects personal data mainly:
   • From the clients directly when entering into contracts for services or indirectly during service usage.
   • From RONDA INVEST's website or mobile applications.
   • From publicly available sources (e.g., public registers).
   • From potential candidates for RONDA INVEST services.

Rights of clients as personal data subjects

1. When collecting, processing and storing personal data, RONDA INVEST takes full care to protect the rights of data clients as they arise from the relevant legal provisions. In connection with the processing of personal data, clients, as data subjects, are entitled to the rights specified below, which they may exercise at their own discretion:
   • Right of access to personal data - the client may request free information about the processing of his/her personal data RONDA INVEST is entitled, in cases where requests made by the client are manifestly unreasonable or disproportionate, in particular because they are repetitive, to demand a reasonable fee for providing information on the client's personal data processed, not exceeding the costs necessary to provide the information. A request may also be refused on the same grounds
   • The right to portability (i.e. the client can obtain the personal data concerning him/her that he/she has provided in a structured format, in a commonly used and machine-readable format, and the right to transmit this data to another controller).
   • The Client, as a personal data subject, who discovers or believes that RONDA INVEST, as the controller, or another person who processes personal data for RONDA INVEST, is processing his/her personal data in violation of the protection of his/her private and personal life or in violation of applicable law, may request an explanation or request that RONDA INVEST or the processor:
     • correct and/or complete inaccurate personal data concerning him/her without undue delay,
     • erase his or her personal data (in particular where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed or where consent to processing has been withdrawn or an objection to processing has been raised and there are no overriding legitimate grounds for further processing),
     • restrict the processing of his or her personal data (in particular, if the accuracy of the personal data is contested or the processing is unlawful and the subject refuses to erase the personal data and requests instead a restriction on their use or the personal data are no longer necessary for the purposes of the processing but are required by the subject for the establishment, exercise or defence of legal claims).
   • In the case of processing carried out on the basis of consent, the client as data subject has the right to withdraw the consent given at any time, in part or in full, with future effects. Without the corresponding consent, RONDA INVEST will no longer carry out the processing in question. Consent may be withdrawn at the email or postal contact address below. Withdrawal of consent does not affect the lawfulness of processing based on consent given prior to its withdrawal.
   • The client, as a data subject, also has the right to file a complaint against the processing of personal data with the Office for Personal Data Protection, Pplk. Sochora 27, Postal Code 170 00, Prague 7,www.uoou.cz
2. In connection with the exercise of their rights and in the event of any questions or information regarding the handling of personal data, clients are entitled to contact RONDA INVEST on the RONDA INVEST Call Centre telephone line +420 296 187 888, via email info@rondainvest.cz, or contact the DPO directly via gdprpoverenec@rondainvest.cz.