DATA PROCESSING POLICY

ONE FAMILY OFFICE a. s., Company ID No.: 19528086, with its registered office at Na Florenci 1332/23, Nové Město, 110 00 Prague 1, (the “Company”) protects all personal data processed as strictly confidential and handles them in accordance with applicable data protection regulations. The security of your personal data is a priority for the Company.

Within the meaning of the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the Company is the controller of your personal data, i.e. it collects, retains, and uses (and otherwise processes) your personal data for the performance of its business activities (the individual purposes for which personal data is processed are defined in more detail below), which consists, in particular, in the provision of services in the area of family wealth structures, investment advice, wealth management, loyalty services in the area of health and protection of personal rights, etc.

This Data Processing Policy applies to (i) the processing of personal data by the Company during your use of the Website www.onefamilyoffice.eu (the “Website”), (ii) the processing of personal data by the Company during communication with you by email or telephone, (iii) the processing of personal data by the Company in the course of the business relationship with you and our suppliers (service providers), (iv) the processing of personal data in the performance of the Company’s legal obligations, and (v) the processing of personal data that is necessary to protect the Company’s legitimate interests.

The Data Processing Policy describes the data processing purposes and methods, informs about the individual categories of personal data processed, their potential recipients, the data retention period and your rights in relation to data protection.

PURPOSE OF DATA PROCESSING

Your personal data may be processed by the Company for the following purposes:

• Contract performance, including contract negotiation (service contracts or fulfilment of clients’ requirements);
• Fulfilling legal obligations (especially obligations under accounting and tax legislation);
• Sending commercial communications, offering services and products, and targeting advertising (the Company may send commercial communications or newsletters via email; data collected during a visit to the Website may also be used for targeting advertising, further information is available HERE);
• Protection of the legitimate interest of the controllers (protection of the rights and legally protected interests of the Company, for example, identification of persons in the Company’s reception area, protection of the network against harmful conduct or protection against misuse of the Website);
• Handling requests sent via electronic forms (especially should you seek employment or other cooperation with the Company).

PERSONAL DATA PROCESSED

The Company is entitled to process the following personal data based on the purpose of the processing:

The Company performs both manual and automated data processing. The automated data processing is performed mainly for the purposes of fulfilling the contractual relationship and offering services.

DATA PROCESSING ON THE BASIS OF CONSENT

If you give the Company your consent to the processing of personal data for the purpose of sending personalised marketing communications (in these cases, basic profiling may also occur without legal implications) or for the purpose of approaching with offers of services and products of the Company’s business partners, either by email or by telephone, you acknowledge that the consent was given voluntarily and that the consent may be withdrawn at any time in writing at the Company’s address or using the link provided in the email with commercial communication. Consent is given until revoked. Failure to give consent does not affect the contract performance.

RECIPIENTS OF PERSONAL DATA

The Company will only disclose your personal data to authorised employees and cooperating lawyers or consultants or individual personal data processors contracted by the Company or other controllers, but only to the extent necessary for the fulfilment of the individual purposes of processing and on the basis of the corresponding legal title for the processing of personal data. The current list of recipients is available on request.

Given that the Company is a member of Havel & Partners Group, certain personal data may be shared, in accordance with Recital 48 of the GDPR, on the basis of legitimate interest within the Havel & Partners Group for administrative and operational purposes, and possibly also in the context of the provision of certain services (e.g. legal, tax and other advice). Please note that if Havel & Partners Group companies are vested with the appropriate legal title, they may also be entitled to share personal data within the group of companies for business support purposes. Information about members of the Havel & Partners Group of companies is available on the website www.havelpartners.cz. You can object to the sharing of personal data within a group of companies at any time by email to dpo@havelpartners.cz.

The Havel & Partners Group companies have entered into a group agreement governing their rights and responsibilities in handling personal data.

The Company is entitled, or obliged, to transfer certain personal data to law enforcement authorities or other public authorities in cases provided for by law.

PERSONAL DATA OF THIRD PARTIES

The personal data of third parties, which means personal data of employees or family members of the Company’s clients, the Company’s suppliers and other individuals involved in cooperation with the Company, or other data that the Company receives from a client or supplier in connection with the conclusion or performance of a contract, will be processed in accordance with applicable data protection legislation. This personal data will be used by the Company for the purpose of performance of contracts with clients or suppliers. The Company will process the personal data of third parties for the duration of the contractual relationship and for the period laid down by any special legal regulations. They will be retained for a longer period of time if there is a justified need to retain the data in connection with a specific case.

The client or supplier of the Company who provides personal data of third parties to the Company is responsible for the compliance with specific obligations under the GDPR (in particular the fulfilment of the information obligation). Upon request, the Company is prepared to advise the Client of its potential obligations in relation to personal data and data sharing arising from cooperation with the Company.

PERSONAL DATA RETENTION PERIOD

The Company shall process and retain your personal data for the period necessary to ensure all rights and obligations arising from the relevant contractual relationship and for the period for which the Company, as a data controller, is obliged to retain personal data under generally binding legal regulations or for which you have given the Company your consent to the processing. In other cases, the processing period is based on the purpose of the processing, which must be proportionate, or is determined by data protection legislation.

Personal data is processed by the Company based on the purpose of its processing for the period specified herein:

* The Company is entitled to process your email address within the meaning of Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services and on Amendments to Certain Acts (Act on Certain Information Society Services), as amended, for the purpose of disseminating commercial communications relating to its own services and products (e.g. in the form of an information newsletter or bulletin) provided you have not refused such dissemination.

DATA SUBJECTS RIGHTS

As a data subject, you have rights in relation to the processing of personal data which arise from the law and which you can exercise at any time. You have the right (i) of access to personal data, (ii) to rectification of inaccurate and completion of incomplete personal data, (iii) to erasure of personal data if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed or if the data are found to have been processed unlawfully, (iv) to restriction of processing of personal data, (v) to the portability of the data, (vi) to object, after which the processing of the personal data will be terminated unless it is demonstrated that there are compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, in particular if the ground is the enforcement of legal claims, and (vii) to contact the Personal Data Protection Authority.

• Right of access to personal data: If you wish to know whether the Company processes your personal data, you have the right to obtain information about whether your personal data is being processed and, if so, you also have the right to access your personal data.
• The right to rectification of inaccurate and completion of incomplete personal data: If you believe that the Company is processing inaccurate or incomplete personal data about you, you have the right to request its rectification and completion. The Company will correct or complete the data without undue delay, but always taking into account technical possibilities.
• Right to erasure: In the event that you request erasure, the Company will erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for processing your personal data, or (iv) the legal data processing obligation laid down by the European Union or national law has ceased to exist.
• The right to restriction of processing; In the event that you request a restriction of processing, the Company will make the personal data unavailable, temporarily remove or retain it or carry out other processing operations necessary for the proper exercise of the asserted right.
• Right to data portability; If you want the Company to transfer to a third party the personal data it processes about you in electronic form on the basis of a contract or given consent, you can exercise your right to data portability. If by exercising this right, you adversely affected the rights and freedoms of others, the Company would not be able to accommodate your request.
• Right to object: The right to object to the processing of personal data processed for the purposes of carrying out a task in the public interest or while exercising public authority or for the purposes of protecting the Company’s legitimate interests. If the Company fails to demonstrate that there is a compelling legitimate ground for the processing that overrides the interests or rights and freedoms of the customer, it shall terminate the processing without undue delay on the basis of the objection.

In the event of repetitive or manifestly unfounded requests for the exercise of the above rights, the Company is entitled to charge a reasonable fee for the exercise of the right in question or to refuse to act on the request. You will be updated on this procedure.

WARNING:

Further information in connection with the personal data processing is provided by the person responsible for the processing of the personal data by the Company at the following email address dpo@onefamilyoffice.cz. In exercising your rights, you may address your request in writing to the Company’s registered office or by email to dpo@onefamilyoffice.cz. The Company reserves the right to verify the identity of the data subject exercising the above rights in a reasonable manner.

The Office for Personal Data Protection monitors the protection of privacy and personal data.

address: Pplk. Sochora 27 170 00 Prague 7

Tel.: 234 665 111

web: uoou.gov.cz

This Personal Data Processing Policy is effective as of 1 January 2024 and will be updated regularly. The current version can always be found at www.onefamilyoffice.cz/en/data-processing-policy.