PERSONAL DATA PROCESSING POLICY

INTRODUCTION

The aim of this Policy document is to provide information on your rights and obligations with regard to the processing of your personal data by Podnikatelská záložna a.s.

In order to comply with all relevant legislation when processing personal data, in particular with the general Regulation (EU) 2016/679, on the protection of personal data (hereinafter referred to as “GDPR”), and Act No. 110/2019 Sb., on the processing of personal data (hereinafter referred to as the “Personal Data Processing Act”), we hereby fulfil our information obligation and provide you with clear and comprehensible information on the following:

1. who the data controller is and whom you can contact if you have questions regarding the processing of personal data;
2. what personal data we collect;
3. sources from which we obtain personal data;
4. whether you are obliged to provide us personal data;
5. purposes for which we collect and process personal data without your consent;
6. purposes for which we collect and process personal data only with your consent;
7. how we process personal data and how we protect them;
8. to whom we transfer personal data;
9. how long we store personal data; and 
10. your rights in connection with the processing of personal data.

1. WHO CAN YOU CONTACT IF YOU HAVE A QUESTION REGARDING THE PROCESSING OF PERSONAL DATA?

Personal data means any information relating to an identified or identifiable natural person (‘data subject’)

Data subject is a natural person to whom the personal data relates, for example a person who requests the controller to provide a service or who is or will be in a contractual or other legal relationship with the controller (hereinafter “you”). Legal entities are not data subjects.

Processing  means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller is the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data. The controller of your personal data is the company Podnikatelská záložna a.s., whose registered office is at Vinohradská 2396/184, Prague 3 – Vinohrady, 130 00, IČO (Company Identification No.): 055 62 597, registered under file No. B 22004 in the Commercial Register kept by the Municipal Court in Prague (hereinafter referred to as “Controller” or “we”). Our e-mail address is info@firemnizalozna.cz, and the telephone number is + 420 779 998 121.

In order to protect personal data, we have designated a Data Protection Officer, who, among other things, ensures that all processing of personal data by the Controller is carried out properly and in accordance with the laws. The data protection officer’s e-mail is dpo@firemnizalozna.cz, and the phone number is +420 226 296 052.

Processor is a natural or legal person, public authority, agency or other body hired by the Controller to process personal data on behalf of the Controller (for example, an intermediary or an accounting company. 

2. WHAT PERSONAL DATA DO WE COLLECT?

We only process personal data that will allow us to properly provide our services, comply with legal obligations and protect our interests protected by law. We collect data primarily about our clients, including potential clients who are interested in our services and products or whom we have contacted with our offer. Furthermore, depending on specific circumstances, we collect and process data of other persons, for example pledgors, guarantors, the client’s representatives on the basis of a power of attorney or the law, co-debtors, the client’s spouse, etc.

If you have expressed interest in our products and services and provided personal data to us, we will store the personal data that will allow us to contact you, i.e., name, surname, telephone number, and e-mail address. We collect and process these personal data so that we can contact you, identify you and continue the process of making the contract.

In order to provide our services and conclude the necessary contracts related to the services (especially the provision of business loans), we collect and process, in addition to the above personal data, your other identification data, such as the academic degree or date of birth, if no birth registration number has been assigned to you, place of birth, gender, address of permanent or other residence, citizenship, IČO (Identification No.), your bank account number, type, number and period of validity of the identity card and the name of the authority that issued the card. 

In order to be able to provide credit to you in accordance with legal regulations, we also process a set of information given by you regarding your reliability and solvency, credibility and payment morale and information obtained from intermediaries, business partners, Comfort Finance Group CFG members or, as the case may be, also data from client information registers. 

We process your birth registration number in order to fulfil our obligations pursuant to Act No. 253/2008 Sb., on selected measures against legitimisation of proceeds of crime and financing of terrorism. With your consent, we process your birth registration number for the purpose of unique identification in the Comfort Finance Group CFG’s information systems and, if credit is provided, for the purpose of verifying your reliability and solvency, credibility and payment morale in client information registers. 

We process your personal data only to the extent necessary for the relevant purpose. If you have given us your consent, we use the above personal data also for other purposes (see the section ”Processing of personal data with your consent”).

3. FROM WHAT SOURCES DO WE OBTAIN PERSONAL DATA?

We obtain personal data from several sources, always in accordance with the law and on the basis of one or more titles.

You yourself are the basic direct source from which we obtain your personal data. You provide personal data to us mainly via a web form or during a telephone conversation conducted in connection with negotiating the conclusion of a contract or other legal relationship.

We collect data also from other important information sources, in particular from “public data sources”, which we use to obtain personal data from publicly available registers, lists and records (commercial register, trade register, land registry, insolvency register, etc.), and from other public data sources (including selected information which is relevant for risk management and which you have published about yourself or made publicly available on the Internet and social networks).

If we have your consent, we also obtain personal data from intermediaries, business partners or members of the Comfort Finance Group CFG as they are the source of information about the services and products provided by Group members.

Your personal data may also be generated directly by us, both through the use of our services or products and through our internal activities (such as the client rating).

4. ARE YOU OBLIGED TO PROVIDE PERSONAL DATA TO US?

When concluding a contract and during its term, we are obliged to ascertain and process specified personal data in accordance with relevant legislation. Such processing does not require your consent, however, unless you let us know the personal data required by relevant legislation, it will not be possible to provide to you our products and services. Similarly, this may be the case when the provision of data is necessary for the conclusion and performance of a contract with you, for the fulfilment of our legal obligations or protection of our interests protected by law (see the section “For what purposes do we process personal data without your consent?”).

5. FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA WITHOUT YOUR CONSENT?

We carry out the processing of personal data without your consent mainly for the following purposes:

1. 1. fulfilment of obligations arising from legislation, in particular:
2. performing your identification and fulfilling other obligations pursuant to Act No. 253/2008 Sb., on selected measures against legitimisation of proceeds of crime and financing of terrorism;
3. fulfilment of obligations pursuant to Act No. 89/2012 Sb., the Civil Code;
4. fulfilment of obligations pursuant to Act No. 563/1991 Sb., on accounting
   1. fulfilment of contractual obligations under the contract we have concluded with you, in which case the purpose also includes the transfer of your personal data to third parties that we use to fulfil our contractual obligations – a list of the third parties is provided in the section “To whom we transfer personal data”);
   2. protection of our rights and interests protected by law, for example for the purpose of recovery of debts and making other claims in court, in which case the purpose also includes the transfer of personal data among companies within the Comfort Finance Group CFG in order to consider the possibility of obtaining the required product and to ensure protection of our rights and interests protected by law;

In performing our activities, we are obliged to act prudently, with professional care and protect not only your interests, but also the interests of our owner. In fulfilling this obligation, we use our affiliation with the Comfort Finance Group CFG, we work together with companies in the Group and exchange information regarding your payment morale, credibility, reliability and solvency. Due to the cooperation, it is therefore possible to better assess whether the chosen product is suitable for you and meets the requirements of both parties to the contract.

3. 4. storage and archiving of data on the basis of and in accordance with the law.

6. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA WITH YOUR EXPLICIT CONSENT?

The processing of personal data that is not required by law and to which we do not have a title, can only be carried out with your consent. The provision of such consent is entirely at your discretion and you can revoke it at any time.

With your consent, we process personal data mainly for the following purposes: 

1. 1. creating and passing over the offer of services that are provided by companies belonging to the Comfort Finance Group CFG;

If you give us your consent to the transfer of personal data (including your birth registration number) in order to receive information about the products and services of companies belonging to the Comfort Finance Group CFG, you will be sent primarily marketing information, usually in the form of electronic mail, addressed printed matter or text messages. In order to be able to create an offer that would fully meet your requirements, we also collect information regarding our services that you use or search for. An overview of the companies belonging to the Comfort Finance Group CFG can be found in the section “To whom we transfer personal data”;

6. 2. making and storing copies of identity documents, unless it is required by law;

We make and keep copies of your identity documents primarily for the purpose of security and protection of your interests and for the purpose of your reliable identification. If making a copy of the document is not a necessary condition for providing the service, we only copy the data from the identity document; 

6. 3. use of your birth registration number for the purpose of unique identification in the information systems of the Comfort Finance Group CFG:

The use of your birth registration number as a unique identifier in our systems requires your consent. The main reason for us to use your birth registration number is your simple and reliable identification when providing you services, as well as the limitation of potential errors that may arise when other identifying personal data of our clients accidently match. This measure also allows us to fulfil our obligation to carry out activities prudently and protect our clients’ interests.

6. 4. creating and passing over the offer of services that are provided by our business partners;

If you give us your consent to the transfer of personal data for the purpose of receiving information about products and services of our business partners, you will be sent primarily marketing information, usually in the form of electronic mail, addressed printed matter or text messages. An overview of our business partners can be found in the section “To whom we transfer personal data”.

7. HOW DO WE PROCESS AND PROTECT PERSONAL DATA?

We strictly protect your personal data. We process personal data manually even in electronic information systems, which are subject to constant and strict physical, technical and procedural control. If we use cloud storage, we always choose clouds which are located within the EU and provide a high level of data security.

Any persons who come into contact with personal data in performing their job duties or obligations assumed under a contract are bound by confidentiality and are duly trained.

We always process your personal data ourselves or within the Comfort Finance Group CFG. We only transfer data outside the Comfort Finance Group CFG if we have your consent or if it is required by legal regulations.

If we authorise another party to carry out a certain activity that forms part of our services, the activity may include the processing of your personal information. The persons authorised to perform such activity become the processor of personal data. The processors may handle the data only and exclusively for the purposes of performing the activity for which we have authorised them. In such a case, your consent to the data processing activities is not required, as such processing is directly permitted by law.

8. TO WHOM WE TRANSFER PERSONAL DATA

We transfer your personal data only in accordance with legal regulations and, if so required, only in accordance with your consent. Your personal data is not transferred to third countries outside the EU.

We transfer your personal data to the following bodies or persons:

1. 1. entities in the performance of our obligations under legal regulations, for example in accordance with the Anti-Money Laundering Act, in particular to courts, bodies responsible for criminal proceedings (i.e., courts, prosecutors and police responsible for criminal proceedings), tax administrators, bailiffs, financial arbitrators, social security authorities, client information registers (for example, CBCB – Czech Banking Credit Bureau, a.s., with its registered office at Štětkova 1638/18, Nusle, 140 00 Prague 4, IČ (Identification No.): 26199696, CNCB – Czech Non-Banking Credit Bureau, z.s.p.o., with its registered office at Štětkova 1638/18, Nusle, 140 00 Prague 4, IČ (Identification No.) 71236384), to supervisory authorities within the exercise of their legal powers;
   2. if it is necessary for the protection of our rights and legally protected interests, also to other entities, such as courts, distrainors, auctioneers, etc., to the extent needed to assert our claims;
   3. persons authorised by us to perform their contractual and legal obligations, including the exercise of contractual rights, for example to accountants, providers of IT services, lawyers;
   4. member companies of the Comfort Finance Group CFG listed below, for the purpose of assessing payment morale, credibility and creditworthiness or, as the case may be, for the purpose of  them offering their services and products:

1. 5. our business partners listed below, for the purpose of assessing payment morale, credibility and creditworthiness or, as the case may be, for the purpose of  them offering their services and products:

9. HOW LONG DO WE RETAIN PERSONAL DATA?

We retain your personal data for the entire period during which we provide you with our services and products. Subsequently, after the end of the business relationship, we restrict their use, but we will still store them as we have a legal obligation to keep them for another 10 years (archiving obligation arising from the Anti-Money Laundering Act and tax regulations). 

If you express your interest in our services and products and let us know that you would like us to contact you with an offer, but no specific negotiations take place afterwards and you do not give us consent to further processing of your personal data, we will delete the data 1 month after you have provided them to us.

If you apply for a business loan, but the loan agreement is not concluded for whatever reason, we will process your personal data obtained in connection with the application and assessment of your request for a maximum period of 1 year from the rejection or withdrawal of the application.

We store personal data that we process on the basis of granted consent for the period of validity of the consent.

If we process data solely for the purpose of protecting a legitimate interest, we retain them only for as long as the legitimate interest exists (e.g.,  during the limitation period).

10. WHAT ARE YOUR RIGHTS IN CONNECTION WITH PERSONAL DATA PROCESSING?

Legal regulations governing the protection of personal data guarantee you certain rights and you can exercise them against us via an e-mail to info@firemnizalozna.cz, on the telephone number +420 779 998 121 or at the address of our registered office, i.e., Vinohradská 2396/184, Prague 3 – Vinohrady, 130 00. In the matter of your personal data protection, you may also contact our Data Protection Officer at the e-mail address dpo@firemnizalozna.cz and on the telephone number +420 226 296 052.

1. Right of access to personal data

You have the right of access to personal data which we have collected concerning you and to other related information (e.g., purpose, category of personal data, retention period, source). You also have the right to request a copy of the processed personal data. However, we may charge you for repeated provision of such copy a fee corresponding to the costs of processing and providing such information. 

2. Right to data portability

If it is convenient for you from the point of view of easier communication with another service provider, you may exercise your right to data portability and ask us to transfer personal data that we have obtained from you or from other sources in order to ensure the provision of our services and products or that we have obtained on the basis of your consent. 

3. Right to revision of decisions based solely on automated processing

At present, we do not make decisions on the provision of services and products that would be based solely on automated processing. If, in an effort to improve and speed up the services and products provided, we introduce, for example, automated evaluation and approval of loan applications without human intervention and you disagree with the outcome of the automated evaluation of your application, you will have the right to object to such a decision, express your comments and ask us to review it. 

4. Right to rectification of personal data

If your personal data are incorrect, inaccurate or have been changed, you have the right to have them rectified. Taking into account the purposes for which we process your personal data, you also have the right to have incomplete personal data completed.

5. Right to erasure of personal data (‘right to be forgotten’)

We automatically erase personal data immediately after the expiry of our title to their processing (e.g., the statutory archiving period of 10 years from the termination of the contract has elapsed, unless some other legal regulation stipulates otherwise). Nevertheless, you can still exercise your right to their erasure.

6. Right to restriction of personal data processing

You also have the right to obtain restriction of the personal data processing, especially if we deal with your objection to the processing of personal data or your notice regarding inaccuracy of data.

7. Right to withdraw consent to personal data processing

If you give us your consent to the processing of personal data, you will have the right to withdraw it at any time, and the same applies to your consent to the use of your birth registration number. After the withdrawal of your consent, we will stop the processing of your personal data for which we have no title other than your consent.

8. Right to object

Should you not wish us to continue the processing that we carry out on the basis of the protection of our legitimate interest, you can apply an ‘objection’. This can be done in several ways:

1. via our commercial communications, as we have incorporated into them the possibility to stop their sending through a specified communication channel;
2. if you no longer wish us to call you, please let us know during the call; and
3. you can send the objection to our contacts (see above).

The objection should be relevant and reasoned and it should be clear from it why you believe that the processing adversely affects your privacy or the protection of your rights and interests protected by law. We will then consider whether the protection of our legitimate interest or third parties is still more significant than the impact on the client or potential client. This does not apply to processing for the purpose of direct marketing, where the processing is terminated automatically upon receipt of your objection. However, due to the service and fulfilment of our rights and obligations we may continue to contact you even after unsubscribing from marketing communication.

9. Right to lodge a complaint with The Office for Personal Data Protection

Should you disagree with any aspect of the processing of personal data, you can exercise your right to lodge a complaint with The Office for Personal Data Protection  (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

——————————————————————————————————————————–

If you have not found all answers to your questions concerning personal data in the above text, or you would like us to explain some information in more detail, please email to info@firemnizalozna.cz or call +420 779 998 121. You can also contact our Data Protection Officer, who is available to answer your question either at the telephone number +420 226 296 052 or e-mail dpo@firemnizalozna.cz.