GDPR

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation [GDPR])   GEMO a.s., Company ID No.: 13642464, with its registered office at Dlouhá 562/22, 779 00 Olomouc, Lazce, incorporated in the Commercial Register kept by the Regional Court in Ostrava, Section B, Insert 11003, hereby informs, as the controller and processor of personal data, about the purposes, means and methods of processing personal data, including the disclosure of the rights of natural persons whose personal data are processed by GEMO a.s. (data subjects). The aforesaid company is part of the holding structure of the GEMO Group.   A. Categories of personal data subjects:

• employee personal data
• personal data of jobseekers
• personal data of business partners – natural persons, both governing bodies of legal entities and governing bodies – self-employed persons (all together as “business partners – natural persons”)
• personal data of employees of subcontractor companies (“employees of subcontractors”).

B. Purposes of the processing of personal data:

• preparation, execution and registration of concluded contracts
• contacting data subjects for the purpose of fulfilling contracts
• ensuring the quality of services provided to investors or clients
• fulfilling the statutory obligations of the personal data controller and processor
• tax and accounting purposes; requests from law enforcement and/or social security authorities or other administrative authorities
• debt recovery of GEMO a.s.
• protection of property and persons (CCTV systems, access system to individual construction sites)
• the controller’s and processor’s own marketing activities.

C. The legal title of the processing of personal data:

• performance of contracts – necessary for the proper execution of contracts – Article 6(1)b) of the GDPR
• consent given by the data subject
• compliance with the statutory obligations of GEMO a.s.
• the legitimate interests of GEMO a.s. to protect the health and safety of the staff.

D. Scope of personal data processed:

• identification details: academic degree, first name, surname, date of birth, birth certificate number, Company ID No., Tax ID No., gender, data from identity documents
• address details: permanent address, mailing address, registered office
• contact details: telephone number, email address
• other data: bank account number, information provided in the CVs of jobseekers (education, knowledge, work experience, marital status, etc.), video footage from CCTV systems and access systems on construction sites.

The company does not process any other data within the meaning of Article 9 of the GDPR for business partners – natural persons or employees of subcontractors.   E. Method of processing personal data: GEMO a.s. processes all personal data both manually in printed form and in electronic form in an automated manner through secure electronic systems. Only designated authorised employees may handle and process personal data.   F. Processors and recipients of personal data: With regard to specific categories of data subjects, GEMO a.s. is entitled to provide personal data to other processors and recipients for the fulfilment of statutory and contractual obligations, such as:

• construction work contractors and construction investors
• IT technology suppliers
• alternative suppliers and service providers
• banking institutions, in the case of mediation of credit financing for the purchase of real estate with the help of GEMO a.s.
• other persons involved in the conclusion and registration of contracts and related documents necessary for the business of the controller.

G. Sources of personal data: GEMO a.s. mainly obtains personal data directly from personal data subjects and, exceptionally, from third parties, in person, by telephone, or by electronic or paper mail. For the purposes for which they were published or provided, GEMO a.s. also obtains personal data from public records, registers, state administration authorities, etc.   In order to protect the people and property of GEMO a.s. and employees and visitors of GEMO a.s., some areas of the company’s premises, as well as the construction yard and individual buildings at the construction site, are monitored by a CCTV system or an attendance system at the construction sites. The monitored areas are marked with pictograms and signs. The records from the CCTV systems are kept for the necessary period of time and can only be accessed by authorised and trained employees of GEMO a.s. The records are processed solely for the purpose stated above.   H. Rights of data subjects: Each personal data subject is entitled to request from GEMO a.s. information on whether and how his/her personal data are processed, and is also entitled to request from GEMO a.s. access to his/her personal data, their rectification, supplementation or erasure, or restriction of processing, and is also entitled to object to their processing. The personal data subject is also entitled, if necessary, to lodge a complaint with the Office for Personal Data Protection at Pplk. Sochora 27, 170 00 Prague 7, phone: 234 665 111.   Where the processing of personal data is based on the consent given by the data subject, the data subject shall be entitled to withdraw the consent at any time, without prejudice to the lawfulness of the processing based on the consent given prior to that withdrawal. Consent may be revoked in writing by letter to the address of the registered office of GEMO a.s., Dlouhá 22, 779 00 Olomouc or by email to: gemo@gemo.cz. In such a case, GEMO a.s. is obliged to destroy the personal data of the data subject, unless the processing is based on another legal title.   In Olomouc, on 25 May 2018   On behalf of GEMO a.s.: Ing. Jaromír Uhýrek, m.p. Chairman of the Board of Directors