Information on personal data processing

What is the purpose of your personal data processing?

1. Response to your inquiry

We will only collect your personal information if you choose to disclose it, for example to contact you by e-mail, phone or in any other way that you choose to contact us, but especially through the contact form on our website www.bdoslovakia.com.

The primary purpose of processing your personal data is to respond to your inquiry and provision of tax, accounting and business advisory. Provision of personal data for realization of demand or other message submitted in a contact form in our website, or provision of personal data via e-mail is essential for us to be able to respond to you properly and in a timely manner. We will not be able to answer to your inquiry if data in the extent necessary for fulfillment are not provided. Providing personal data for the purpose of provision of tax, accounting and business advisory is essential for us to provide you with the services you require.

Legal ground for personal data processing is:

1. Act no. 40/1964 Coll. Civil Code as amended;
2. Act no. 513/1991 Coll. Commercial Code as amended;
3. Authorized interest of data controller;
4. Act no. 18/2018 Coll. on personal data processing;
5. Execution of agreement.

2. Provision of tax, accounting and other professional advisory services

We also process your personal data for the purpose of providing tax, accounting and other professional advisory services and/or statutory audit services and related consulting. We provide these services to you based on your request and your consent to the provision of the services. The provision of data is a contractual and legal requirement. A possible consequence of not providing data is a breach of legal

1. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
2. Act no. 18/2018 Coll. on personal data processing

obligations by one of the BDO companies, resp. inability to provide you with our professional consulting services.

Legal ground for personal data processing is:

1. Agreement on provision of professional services
2. Accounting, payroll, tax, audit regulations
3. Act no. 40/1964 Coll. Civil Code as amended;
4. Act no. 513/1991 Coll. Commercial Code as amended;
5. Authorized interest of data controller;
6. Act no. 18/2018 Coll. on personal data processing.

3. Marketing

If you have given your consent to the processing of personal data for marketing purposes, we will process your personal data to the extent of the consent given. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing of personal data until its revocation. The legal basis for the processing of your personal data is your consent. In special cases, the legal basis may also be the legitimate interest of the controller, which is to promote our services and inform our clients of new legal obligations that may affect them.

4. AML

We also process your personal data for the purpose of fulfilling the legal obligations of the processor in the area of the prevention and protection against money laundering and terrorist financing. The legal basis is Act no. 297/2008 Coll. on Protection against Money Laundering and Terrorist Financing and on Amendments to Certain Acts, as amended. We obtain personal data in this regard from publicly available sources and non-public registers and/or directly from the persons concerned (provided in the contract, AML questionnaire and other documents) as well as from third parties who are in a contractual, employment or other similar relationship (statutory bodies, owners, beneficial owners, etc.). Provision of data in connection with the identification of ownership and organizational structure as well as identification and verification of identification of beneficial owners of client is a legal requirement, and therefore failure to provide such data is a breach of legal obligations by the processor and therefore inability to provide our services to you.

5. Video surveillance

For security reasons, we monitor our premises through camera recordings. It is in our legitimate interest to ensure the protection of persons and property against illegal acts, especially in the prevention and clarification of robberies, thefts, vandalism or various acts. The monitored area of our premises is clearly marked with monitoring information. The record can be used for the purpose of detecting criminal offenses, identifying and investigating perpetrators, as well as for the purpose of protection against money laundering and terrorist financing, detection of illegal financial transactions, court proceedings, criminal proceedings, proceedings on offenses. Our company stores personal data in the form of videos and audio recordings for 14 days from its production. Subsequently, the personal data are automatically deleted. The legal basis is the legitimate interest of the controller in the protection of his property, financial and other interests.

6. BDO as processor of personal data

Our company can also act as a processor appointed by controller to process personal data on controller’s behalf. The processing of personal data by us takes place on the basis of a concluded agreement on the provision of professional services with an entity with which you may be in an employment, contractual or other similar relationship and an agreement on authorizing the processor to process personal data. The purpose of personal data processing is to provide accounting, tax and

• or payroll services or related professional consulting services. In this case, our company processes your personal data in the name and on behalf of the entity in which you have a certain relationship and which provides our company with your personal data. In most cases, such processing involves the

processing of general personal data; in the provision of payroll accounting, there may also be the processing of special categories of personal data (work incapacity records, etc.).

Our company processes only personal data necessary for the provision of any of the above purposes of processing the personal data of the data subjects.

What kind of institutions are your personal data shared with?

• Your personal data are processed by the software available to the data controller’s employees.
• The data controller cooperates with a variety of external entities whose interoperability is necessary for the proper provision of response to your inquiry,or provision of ordered service and share with them your personal data. Such external entities are in particular quilified external subcontractors, with which our company usually cooperates on provision of our services (mostly advocates, tax advisors, auditors, accountants etc.) or IT providers, with which we cooperate for the purpose of proper function of our web page. Our company has a contractual relationship with the above entities and they process your personal data on our behalf.
• Your personal data may also be shared with various government agencies and institutions in order to comply with legal requirements and/or obligations.
• Your personal data collected for the purpose of the direct marketing are not shared with any third parties and the solely purpose of their processing is the direct marketing of our company.

„Cookie“ on our webpage

Our company uses cookies on its webpage www.bdoslovakia.com. The collection of the cookies is conditioned to your consent. The cookies are small text documents consisting of a number of numbers and letters that are stored on your computer’s hard disk by a web browser and also can uniquely identify your computer and your IP address.

Our Company uses cookies for the following purposes:

• responsiveness,
• the ability to communicate by e-mail,
• identify the visitor and agree to the use of cookies.

You can check and/or delete cookies at your discretion - for details please visit www.aboutcookies.org. You can clear all cookies stored on your computer and set most browsers to prevent them from being stored. In this case, however, you may need to manually adjust some settings each time you visit a website, and some of the services and features of our website may not work properly.

Using Google Analytics and Google Remarketing

At webpage www.bdoslovakia.com can be used the services of the third parties such as Google Inc. Analytics and so on. For these services, the cookies are used. Using these services of the third parties we analyse visit and use of our webpage. We share the collected information about the use of our webpage with the analytical services providers to evaluate it. Even though your personal data are transferred to the third parties abroad, your personal data are always anonymized by truncating the IP address of the last three places to prevent a clear assignment to a particular individual. There is also a possibility to sign out of these analytical services by expressing a disagreement with the use of cookies on our webpage.

Social networks

Our website includes a feature that allows sharing through social media applications, such as Facebook Like and Twitter widget. These social media applications may collect and use information regarding your use of our website. The use of such functionality may require the use of cookies on your device in order to facilitate the use of their services, to display your interaction on the website, and to record data about your activity across the Internet and on our website. Any personal information you provide through such social media applications may be collected and used by other members of this

social media application, and such interactions are governed by the privacy policies of the companies providing the application in question. We do not have control over these companies and are not responsible for the use of your personal data by these companies.

Cloud solutions

Our company also uses cloud solutions for internal communication or communication with sister’s companies, or qualified service providers we cooperate with. We use these solutions primarily to increase productivity and mobility of employees and subcontractors, internal cooperation on documents and information activities of individual authorized persons. We use web portals to collaborate between our employees and partners, to share and create information. To protect the data shared within these cloud solutions, we use advanced technologies and software tools to encrypt data to maintain the protection and integrity of shared data.

Children

We understand the importance of protecting children's privacy, especially in the online environment. Our website is not specifically designed and aimed at children under 16 years of age. We never knowingly collect information about persons under 16 years of age and do not store information about them, except as part of an engagement to provide our professional services or if they were part of the inquiry submitted on our webpage.

Foreign transfer of the personal data

Your personal data will not be transferred outside the territory of the Slovak Republic. This does not apply in the case of your explicit consent to such transfer of your personal data abroad or in case of provision of ordered services abroad.

What is the time period of the personal data maintain?

Your personal data will be retained for the period necessary for the fulfilment of its purpose, resp. for the period of archiving stipulated by the Act on Archives and Registries. For further details about the retention period of your personal data, please do not hesitate to contact us.

Your personal data will be stored safely, in accordance with the security policy of the data processor and only for the time necessary to fulfil the purpose of processing. Your personal data will only be accessed by persons authorized by the data controller to process personal data that are processed by the controller in accordance with the controller's security policy.

Your personal data is backed up, in accordance with the retention policy of the data processor. Your backup data will be completely deleted as soon as it is possible in accordance with the backup rules. Personal data stored on backup sites is used to prevent security incidents, in particular to disrupt data availability as a result of a security incident. The Company is obliged to provide data backup in accordance with the security requirements of the Regulation and the Act on Personal Data Protection Act.

Your rights

You have the right to request for an access to your personal data at any time. You have the right to request a confirmation of the processing your personal data and to request a copy of your personal data.

If your personal data has changed, you can request us for an update, or completion of your personal data, personally. You have also the right to request us to have your incomplete personal data completed.

You have the right to request us for an erasure, or restriction of processing your personal data. Personal data processed on the basis of consent to process a personal data for the marketing purposes