Personal Data Protection at Powertica Energie a.s.

1. Fundamental information about personal data processing:

Powertica Energie a.s. (hereinafter also referred to as the "Company"), acting in the Czech Republic through his office: V celnici 1031/4, Nové Město, 110 00 Praha 1, processes personal data in accordance with the relevant generally-binding legal regulations, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as the "Regulation".

The Company's processing of personal data is based on the principles set out below:

• Systematically applying and developing a responsible approach to the personal data of natural persons.
• Ensuring and continuously improving the level of protection of personal data and the qualification of the Company's employees to process them.
• Retaining personal data solely for the required length of time, in accordance with the relevant legislation.
• Strict compliance with, in particular, (i) the lawfulness, correctness, and transparency of personal data processing, (ii) the purposeful limitation of personal data processing, (iii) data minimisation, (iv) accuracy, and (v) the integrity and confidentiality of personal data processing.
• Establishing appropriate and adequate technical and organisational measures to ensure that the Company makes sure and documents that personal data processing is always carried out in accordance with the relevant generally-binding legal regulations.
• Reviewing the Company's personal data protection system at the specified times with a view to improving and updating it and providing the necessary resources to maintain it.

2. Rights associated with personal data protection:

The data subject primarily has the following rights in relation to personal data processing:

• The right to information (Article 12 of the Regulation) - the data subject has the right to be informed in a concise, transparent, intelligible, and easily accessible manner about how their personal data are processed.
• The right of access to personal data (Article 15 of the Regulation) - the data subject has the right to obtain confirmation from the Company as to whether or not personal data concerning them are being processed. In the event that personal data are processed by the Company, the data subject has the right to access and obtain a copy of those personal data (including related information).
• The right of rectification and erasure of personal data (Articles 16 and 17 of the Regulation) - the data subject has the right to have inaccurate personal data concerning them rectified by the Company without undue delay. With regard to the purposes of processing, the data subject has the right to have incomplete personal data supplemented, even by providing an additional statement. The data subject also has the right to have personal data concerning the data subject erased by the Company without undue delay, but only in the case that one of the grounds for erasure set out in Article 17 of the Regulation applies.
• The right of restriction of processing (Article 18 of the Regulation) - the data subject has the right to have the Company restrict the processing of their personal data in any of the cases listed in Article 18 of the Regulation.
• The right of data portability (Article 20 of the Regulation) - the data subject has the right to obtain personal data concerning them that they have provided to the Company in a structured, commonly-used, and machine-readable format, and the right to transfer such data to another data controller in the cases listed in Article 20 of the Regulation.
• The right to object (Article 21 of the Regulation) - the data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f) of the Regulation, including profiling based on those provisions.
• The right to lodge a complaint with Úřad pro ochranu osobních údajů (Office for Personal Data Protection) (see contacts for the Company below).
• The right to withdraw consent to the processing of personal data at any time.

3. Additional information on the conditions and circumstances of personal data processing:

The data controller is the Company, which processes only those personal data necessary for the provision of the relevant services within the bounds of reciprocal business or other relations. This includes, in particular, the identification and contact details of the data subject concerned.
The purpose and legal basis for the processing of the personal data collected always depends on the nature of our reciprocal relationship. The primary purposes of personal data processing are mutual interactions with customers and business partners, the exercise of rights and the fulfilment of obligations under the relevant contractual relationships, the proper fulfilment of accounting and tax obligations, the recording of business contracts, and the fulfilment of other obligations arising for the Company from generally-binding legal regulations.

Any personal data obtained by the Company will only ever be retained for as long as is necessary. The criteria used to determine the period of retention of personal data depend on the nature of the relationship between the Company and the data subject concerned. We generally retain data for one calendar year as of the time at which the purpose for processing the data has passed. In many cases, however, the length of retention of the relevant personal data is directly determined by legal regulations (in particular, tax regulations, labour regulations, archiving and retention regulations, etc.). Personal data that are processed with the consent of the data subject are retained for the period of time for which the data subject's consent is validly given.

4. Contact details:

All rights relating to personal data protection and personal data processing may be exercised and all questions or comments may be made:

• electronically at the following e-mail address: e-mail
• in writing to the correspondence address: V celnici 1031/4, 110 00 Praha 1, Czech Republic

The Company shall provide a statement and, where appropriate, information on the measures taken as soon as possible, and within one month at the latest. The Company may extend the time limit by two months if required and with regard to complexity and the number of requests. The Company will inform the subject concerned of such extension, and the reasons for it, without undue delay.

Complaints regarding personal data processing may also be lodged with the competent supervisory authority, which is:

Úřad na ochranu osobních údajů, having its registered office at: Pplk. Sochora 27, 170 00 Praha 7, tel.: +420 234 665 111, website www.uoou.cz .