Information on the processing of personal data

• Document publisher and personal data manager: LabMediaServis s.r.o., Company ID 275 12 380, located at Národní 84, Pražské Předměstí, 551 01 Jaroměř, represented by Ing. Jan Krejčí and MVDr. Tomáš Krejčí, statutory representatives
• Release date: May 25, 2018
• Last update: September 12, 2022
• Availability: This document has been published on the company's website LMS www.labmediaservis.cz, or it is provided by LMS upon request.
• Purpose of the document: This document contains information for clients, business partners, and customers (data subjects) of LabMediaServis s.r.o., Company ID 275 12 380, located at Národní 84, Pražské Předměstí, 551 01 Jaroměř (hereinafter referred to as "LMS") according to Article 13 of the Regulation of the European Parliament and the Council (EU) 2016/679 of April 27, 2016, concerning the protection of individuals regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ (hereinafter referred to as "Regulation or "GDPR"), which provides an overview of the processing of their personal data by LMS.

This particularly concerns information relating to defining categories of personal data, purposes and legal bases for their processing, duration of processing, sources of personal data, main principles of processing, and also information on the rights of data subjects concerning the processing of personal data by LMS.

In this INFORMATION ON THE PROCESSING OF PERSONAL DATA, you will find answers to the following questions:

1. Does this statement concern you if you are a legal entity?
2. What personal data do we process about you or your representatives, for how long, and why?
3. Main principles of personal data processing
4. Where do we obtain your personal data and to whom do we pass it on?
5. What rights do you have in relation to the processing of personal data?

1. Does this statement concern you if you are a legal entity?

In this context, LMS would like to remind you that personal data, in accordance with the relevant legal regulations primarily enshrined in the Regulation of the European Parliament and the Council (EU) 2016/679 of April 27, 2016, concerning the protection of individuals concerning the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR"), always refers only to personal data of natural persons, excluding personal data of persons engaged in business activities, and also personal data of individuals belonging to so-called "liberal professions (collectively referred to as sole traders).

If you are a business entity (e.g., limited liability company, joint-stock company, etc.) or another legal entity (e.g., a territorial self-governing unit, contributory organization, etc.), then the protection of personal data enshrined in GDPR does not relate to data concerning the legal entity (e.g., name, Company ID, registered office address, etc.). The protection of personal data concerns only the personal data of specific natural persons who act, communicate, etc., on behalf of your legal entity, usually individuals who act as representatives of your company in contractual or technical matters (hereinafter referred to as "your representatives") and for whom we have contact information (e.g., name, surname, email, telephone contact, etc.).

If you are a legal entity, you undertake to inform your representatives of this INFORMATION ON THE PROCESSING OF PERSONAL DATA – Statement of LMS. If you are a natural person (regardless of whether you act towards LMS as a business or consumer), the protection of personal data according to GDPR applies to you.

2. What personal data do we process about you or your representatives, for how long, and why?

We would also like to assure you that we store your personal data only in a legal manner and always in accordance with GDPR, that is, only and exclusively within the scope of lawful legal titles provided for in Article 6(1) of the GDPR. LMS processes the following personal data about you or your representatives, only for the purposes, for the period, and according to the relevant legal title, as indicated for the individual personal data defined in the overview table below. The table is divided to make clear (i) which personal data of the respective data subject is involved, (ii) the purpose of processing that personal data by LMS, (iii) the legal title for processing that personal data (reference to the GDPR), and also (iv) the period for which LMS retains that personal data.

OVERVIEW TABLE OF PERSONAL DATA PROCESSING BY LMS

3. Main principles of personal data processing

When processing personal data, we always adhere to generally binding legal regulations and, in particular, comply with the GDPR. In this regard, we would also like to assure you that we adhere to binding principles applicable to the processing of personal data. These principles include:

• a) lawfulness, fairness, and transparency - this principle expresses that LMS, as a controller, must process personal data based on at least one legal reason and transparently towards the data subject. You can familiarize yourself with the legal basis for processing your personal data above in the overview table presented in Article 2 of this document;
• b) purpose limitation - it applies that LMS collects personal data only for specific, explicitly expressed, and legitimate purposes. LMS does not process personal data in a manner incompatible with these purposes. The purposes of processing your personal data can be found above in the overview table presented in Article 2 of this document;
• c) data minimization - LMS always ensures that the personal data it processes is adequate and relevant in relation to the purpose for which they are processed;
• d) accuracy - LMS ensures that the personal data it processes is stated specifically and accurately;
• e) storage limitation - we also ensure that personal data is stored in a form allowing the identification of the data subject only for as long as necessary for the purposes for which it is processed. You can familiarize yourself with the retention period of your personal data above in the overview table presented in Article 2 of this document;
• f) integrity and confidentiality - LMS always ensures proper technical and organizational security of personal data it processes. In particular, we take care to properly secure and protect your personal data against unauthorized or unlawful processing.

4. Where do we obtain your personal data and to whom do we pass it on?

LMS primarily obtains personal data directly from you, our clients, customers, or business partners, especially within mutual contractual relationships or in negotiating and communicating about these contractual relations. We obtain personal data primarily when establishing a contractual relationship and also, for example, in the administration of individual performances arising from these contracts (e.g., partial orders, provision of specific goods or services, or other fulfillments from the respective contracts).

If you are our client as a legal entity, we primarily obtain personal data about your representatives directly from you (e.g., first name, last name, email, and telephone contact for your representatives in contractual matters, etc.) or in connection with the administration of individual performances arising from these contracts (e.g., partial orders, provision of specific goods or services, or other fulfillments from the respective contracts). Some personal data about you are also obtained from publicly available sources. For example, this concerns the verification of your identification data according to public records (e.g., public register, trade register, or register of economic entities, etc.) or information obtained by checking published bank accounts and the status of (non)reliable VAT payers according to the VAT register.

We do not pass your personal data on to any third parties, except for:

• a) Situations where the law requires us to do so. In this case, we pass your personal data to state authorities, courts, and law enforcement authorities if requested in accordance with applicable law;
• b) Situations where we need to deliver documents or packages to you. In this case, we pass your contact details to the provider of delivery or postal services to the extent necessary for delivering the document;
• c) Situations where we need to protect our own legal claims. In this case, we pass your personal data to contracted legal service providers (lawyers) and possibly also to public authorities before which we assert our legal claims (especially courts and executor offices);
• d) Situations where our personal data databases are accessed by external IT specialists or external accountants, for example, during necessary service measures or for the purpose of ensuring the processing of accounting administration. However, in this case, your personal data is made available to these entities only for the purpose of providing their services, in the form of information databases where the personal data is located. All external entities are contractually obligated not to process the personal data made available to them in any way.

5. What rights do you have in relation to the processing of personal data?

The rights listed below belong to so-called data subjects, i.e., both our customers, business partners, and clients who are natural persons, and if you are a legal entity, to your representatives (all these persons collectively referred to as "data subject"). If you are a data subject, you have the following rights:

• a) Right of access - you have the right to know what data we process about you, for what purposes, for how long, where we obtain the data, to whom we pass it on, and what rights you have. The right of access is realized by LMS through this document entitled "Statement on the Processing of Personal Data." This right can be exercised under the provisions of Article 15 of the GDPR.
• b) Right of rectification - you have the right for us to correct or supplement your personal data if they are inaccurate or incomplete. This right can be exercised under the provisions of Article 16 of the GDPR.
• c) Right of erasure (also referred to as "Right to be forgotten") - you have the right for us to delete your personal data without undue delay if any of the reasons under Article 17(1) of the GDPR are fulfilled (e.g., the data is no longer necessary for the purposes for which it was collected) and at the same time none of the reasons under Article 17(3) of the GDPR justifying the continued processing by LMS apply.
• d) Right to restriction of processing - you have the right in certain cases to request that your specific personal data be marked and that those data not be subject to any further processing operations. Unlike the right of erasure, this refers to a temporary restriction of processing and not to their permanent deletion. Cases in which this right can be exercised are governed by Article 18 of the GDPR.
• e) Right to data portability - you have the right to request that we transfer your personal data, which you provided to us based on consent (in accordance with Article 6(1)(a) of the GDPR) or based on the fulfillment of a contract (according to Article 6(1)(b) of the GDPR) to you or directly to another data controller that you specify, in a structured, commonly used, and machine-readable format. However, this right only applies to personal data that we process automatically. Based on this right, we cannot always transfer all data (e.g., handwritten signature).
• f) Right to object - you have the right to object to the processing of your personal data which occurs on the legal basis of our legitimate interest (see above). More information on the rights of data subjects is available on the website of the supervisory authority, which is the Office for Personal Data Protection (https://www.uoou.cz/6-prava-subjektu-udaj/d-27276). In the case of an objection to processing, we will examine your objection, and if we find that there are no serious legitimate reasons justifying such processing, we will no longer process such personal data for that purpose.
• g) Right to lodge a complaint - exercising any of the above rights does not affect your right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).

You can exercise any of the rights mentioned above free of charge electronically by emailing krejcovska@labmediaservis.cz, or in writing through a postal service provider to our registered office address. We always ask that you specify (i) the right you are exercising (e.g., right of rectification), (ii) the reasons on which you base your right (e.g., that we have incorrect Company ID for you), and (iii) what you require (e.g., correction and indication of the correct Company ID for you).

In Jaroměř, on September 12, 2022, Ing. Jan Krejčí - Managing Director of LMS

1 According to the provisions of § 29(1) of Act No. 235/2004 Coll., on value-added tax, as amended, a tax document must contain, among other things: (a) the designation of the person who performs the service, (b) the tax identification number of the person who performs the service, (c) the designation of the person for whom the service is provided, (d) the tax identification number of the person for whom the service is provided. The designation is understood according to the provisions of § 29(4) of Act No. 235/2004 Coll., on value-added tax, as amended as (i) business name or first name, (ii) surname and (iii) registered office.

2 A data subject is understood according to the provisions of Article 4(1) of the GDPR as an identified or identifiable natural person.