At Direct Fondee a.s., registered office at Pod dráhou 1636/1, 170 00, Prague - Holešovice, ID No. 06691862, registered with the Municipal Court in Prague under file number B 27322, as the data controller (hereinafter referred to as „Controller“ or „we“), we care about you, our customers and potential customers (hereinafter referred to as „Data Subjects“ or „you“ and individually as a „Data Subject“), and it is important to us to protect your privacy. We would like to assure you that we treat your data with the utmost care and in accordance with all our obligations under applicable law.

Within the meaning of Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the „GDPR“), we would like to inform you of the following.

The Controller has appointed a Data Protection Officer whom you can contact at any time with your requests or queries in the following manner:

• in a letter sent to the Controller’s registered office address with the envelope marked „Attn.: Data Protection Officer“.
• via email: dpo@fondee.cz, officer Kateřina Grézlová

1. Who are we?

We are a securities dealer and, in accordance with authorisation from the Czech National Bank, we are authorised to offer and provide the following primary investment services to our customers: (i) receipt and transmission of instructions relating to investment instruments within the meaning of Section 4(2)(a) of Act No. 256/2004 Coll, Capital Market Undertakings Act, as amended (hereinafter referred to as the „CMUA“), (ii) managing the customer’s assets, which include investment instruments, on a discretionary basis under a contractual arrangement within the meaning of Section 4(2)(d) of the CMUA, and (iii) investment advisory services relating to investment instruments within the meaning of Section 4(2)(e) of the CMUA in relation to collective investment securities and investment instruments as per Section 3(1)(d) of the CMUA (all such investment services hereinafter referred to as „Activities“).

2. What personal data do we process?

We process your personal data for the purposes set out below. Personal data will only be processed to the extent necessary for the given purpose and for the time necessary to fulfil that purpose. After the original purpose has been fulfilled (e.g. processing based on a contract or market research), we may process personal data for other purposes in accordance with our legal obligations or legitimate interests.

2.1 Processing based on a contract

This mainly involves processing for the purpose of our Activities, i.e. negotiating the conclusion or amendment of the investment services contract and the performance of the investment services contract, including the handling of your potential claims and requests. We also process data based on the contract with you if you participate in various client programmes, campaigns, quizzes or competitions in relation to the performance of our obligations under those programmes, campaigns, quizzes or competitions. For this purpose, we process both your personal data and, if necessary, the data of other parties to the contractual relationship or otherwise affected parties (legal representatives, relatives, etc.). Providing your personal data is voluntary, however, without processing it we cannot offer or provide you with our services.

2.2 Processing based on the law and fulfilling legal obligations

There are a number of legal obligations associated with the provision of investment services and our Activities that we must comply with under the law. In particular, we must comply with the legal and regulatory provisions governing the provision of investment services and exercise professional care. Under the CMUA, we must obtain information about customers in order to assess the suitability or adequacy of an investment service, which we must record and archive; in some cases, as required by the Czech National Bank (hereinafter referred to as the „CNB“), we may be or are required to, share this information with the CNB. In order to comply with our legal obligations, we also record our mutual telephone conversations so that we always have an accurate record of what we talked about. The purpose of telephone communication may be in particular to provide technical and informational support to customers and potential customers. We may also record, process and subsequently evaluate the calls in order to best meet your requirements, wishes and needs.

We are also subject to general legal obligations, such as:

• legal obligations in relation to consumer protection,
• screening and implementing other measures in the context of anti-money laundering,
• preservation and archiving of documents according to legal requirements,
• administrative duties (e.g. bookkeeping, tax obligations and other administrative areas),
• obligation to cooperate with public authorities in the exercise of their powers as per legislation.

2.3 Processing based on legitimate interest

Another reason for processing personal data is to protect your or our rights and interests or the interests of other parties. In particular, the following operations fall into this category:

• improving and developing new products and services by studying your use of our services and your behaviour when using them,
• customer segmentation (monitoring of service quality and customer satisfaction, creation of business offers, recommendations and optimisation of provided services and products),
• direct marketing involving the offering of our products and services or directly related services and products to our customers,
• prevention and detection of criminal or illegal activities,
• establishing, defending and enforcing rights arising from the provision of investment services,
• internal functions necessary for our business, including at the level of the group of companies to which we belong (audit, controlling, IT operations, administration, record-keeping for accounting and taxes, etc.),
• evaluating and improving our business activities (evaluation of service quality, complaints, capacity utilisation, customer portfolio composition, efficacy of promotion, etc.),
• market research, which we conduct prior to providing investment services to the Data Subject and carrying out the Activity, by means of an online survey. The purpose of market research is not to collect the personal data of Data Subjects, but to obtain information about the Data Subject’s preliminary interest, which is subsequently related to the provision of investment services.

You can object to processing based on legitimate interests, which we will review and then assess whether the processing meets the requirements of the regulations. You can find out more about your rights in the document below.

2.4 Processing with your consent

In some cases, your consent may be required for the processing of your personal data. You give your consent for such processing in electronic form (by ticking the relevant boxes) or in writing. If consent to personal data processing is provided electronically, the record of the provision of such consent in our systems serves as decisive evidence of the provision of such consent.

2.4.1 Marketing use of data, offering business and services

We would like to contact you from time to time by phone or email with news about the activities, new products, services and exclusive offers of companies that are and will be affiliated with us in the Direct FAMILY group (esp. Direct Fidoo a.s. and Direct pojišťovna, a.s.) (hereinafter referred to as „offers“). This consent includes the transfer of personal data necessary for the creation of an offer to a company affiliated with us in the Direct FAMILY group. We do not pass on your personal data to anyone else for marketing purposes. For a current list of Direct FAMILY members and business partners, visit www.fondee.cz.

Offers may relate to products and services in the financial and banking sector, payment services, insurance, health or property protection and other similar or related areas, as well as products and services related to the activities of Direct FAMILY companies. Your personal data will be included in a database that we maintain for the purpose of this activity. The above processing of personal data includes profiling, which is used to better understand your needs and the needs of potential customers and to contact you only with offers that make sense and may be of interest to you.

Your consent for the marketing purposes detailed in this article is voluntary and free and does not affect the conclusion, performance or configuration of any contract with us or any other material consequences. You may withdraw your consent at any time, but this does not affect its validity before withdrawal. You can withdraw your consent at any time by sending an email to info@fondee.cz or, if consent was given in the Fondee app, by withdrawing consent directly in the Fondee app settings or by using the link in each individual commercial communication.

3. What data do we process?

In particular, we process the following personal data for the following purposes:

• (i) identification and address data, e.g. academic title, name, surname, date of birth, place of birth, personal number, permanent address, delivery or other contact address;
• (ii) descriptive and socio-demographic data, e.g. marital status, gender or reference code for registration with us;
• (iii) electronic contact details, e.g. (mobile) phone number and email address;
• (iv) other electronic identification and location data, e.g. IP address, location data of the device used;
• (v) all investment, transactional and user data related to the use of our services and the Fondee application, including our written communications;
• (vi) economic and financial data needed for the performance of the contract, e.g.: bank account number, payment amounts, withdrawal amounts and withdrawal history;
• (vii) other personal data provided by you in the contract or other documents, in the context of market research, client programmes, campaigns, quizzes or competitions, telephone or e-mail communications;
• (viii) details of identity documents (type and number of the presented document, validity and issue date of the presented document, issuer thereof), including copies of these documents and photographs taken by us or an authorised person to verify a match with the identity document; and
• (ix) telephone records and information from those records.

4. How do we process and protect your data?

Your personal data will be processed in a fair, lawful and transparent manner. We will process only such personal data that is adequate, relevant and limited to the necessary extent in relation to the purpose for which it is processed. The processing of personal data is carried out automatically and manually in such a way as to ensure that it is properly secured, including by means of appropriate technical or organisational measures. We also protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Automated individual decision-making is data processing that results in a decision that is made solely by computer systems, which also has substantial consequences for you (e.g. non-conclusion of a contract), and in which no humans are directly involved. It uses only automatic means (applications, software, algorithms, online calculators, etc.). Profiling means the automated processing of data for the purpose of evaluating certain personal aspects of a person (work performance, economic situation, health, behaviour, personal preferences).

Automated decision-making is often an integral part of the evaluation of an investment questionnaire before or during the provision of an investment service. The automated process allows us to provide services that are suitable or appropriate for you. This is necessary for the conclusion of the contract and the performance of our contractual and legal obligations. The automated individual decision-making we perform involves evaluating certain information about you, e.g. taking into account your income, expenses, evaluating your investment goals and your experience and knowledge. If automated decision-making would have significant consequences for you (e.g. would lead to the non-conclusion of the contract, change of the terms of the agreed service, etc.), you have the right to have such a decision reviewed, to respond to it and, if necessary, to challenge it.

We only process accurate personal data obtained in accordance with the GDPR and we are obliged to keep the personal data we process up to date. In this connection, you are obliged to notify us without delay of any change in the processed personal data and to provide us with documents proving the change (if originally provided on the basis of a document).

5. Where do we obtain personal data?

We obtain personal data:

• directly from you (in particular, in the case of negotiation and execution of an investment services agreement, through our website, the Fondee app, forms and other documents, in communication with you, etc.),
• from third parties if necessary for the performance of legal obligations or on the basis of special legal regulations, in particular from state administrative authorities, or if necessary for the performance of obligations under the contract,
• from publicly available sources, in particular public registers, lists, records or websites (e.g. insolvency register, commercial register, trade register, etc.),
• from our own activities (in particular by evaluating and analysing personal data obtained from other, previously mentioned, sources).

6. How long do we retain personal data?

The retention and archiving period of personal data depends on several factors, applied according to the specific situation in which personal data is processed. Your personal data will be processed at least for the duration of the investment services contract, its performance or its administration and thereafter for as long as the legal obligation to which we are subject or our legitimate interest continues (in particular for the duration of the limitation period). In the event of the commencement of judicial, arbitration, enforcement or other similar proceedings, for the duration of such proceedings and subsequently for the duration of the deadlines for filing of extraordinary appeals and during the proceedings on the filed extraordinary appeals.

If no contract is concluded between us, we will process the personal data we have obtained in connection with the preparation of the contract for a period of five years, unless the CNB stipulates a longer period. In the case of consent, processing continues until the consent is withdrawn, unless otherwise stated directly in the consent. You can withdraw your consent at any time and thus terminate data processing.

We process personal data exclusively for the defined purposes in accordance with the existing legal title for processing. If some data is needed for more than one reason, we apply the retention period for the purpose that expires last.

7. Who can we provide your personal data to?

Your personal data may be disclosed for the purposes of and in connection with our Activities to:

• investment service providers and other financial institutions in a contractual relationship with us,
• providers of postal and archiving services,
• marketing agencies in providing assistance with campaigns and other marketing activities,
• external printers (especially for sending correspondence),
• companies providing electronic communication services (operators of emailing and SMS solutions),
• parties who provide us with IT and programming services as well as specialised legal, accounting, financial, HR and consulting services,
• other parties, if this is necessary to ensure the proper performance of the obligations set forth by generally binding legal regulations and/or contractual obligations, or if the provision of personal data is required by law or is necessary to protect our legitimate interests,
• by law to law enforcement authorities, courts, the CNB, tax authorities, tax administrators, executors or insolvency administrators, the Czech Insurers’ Bureau and other public authorities,
• other members of the Direct FAMILY for internal administrative functions,
• with your consent, your personal data may be disclosed to other entities as appropriate.

We use processors with whom we have a processing contract and who provide sufficient guarantees for the protection of your personal data. All persons who work with us and who come into contact with your personal data in the course of their work or contractual duties are bound by confidentiality and maintain adequate standards of security of your data.

If you provide us with the personal data of other natural persons for processing when concluding or performing a contract, you are obliged to provide this information about personal data processing to these natural persons.

Your personal data may be transferred to the above companies for processing within the European Union (EU) and the European Economic Area (EEA). We do not intend to transfer your personal data to a third country (i.e. outside the EU or EEA) or to an international organisation. We would only carry out processing outside the EU/EEA if adequate safeguards are in place in accordance with the GDPR.

Should we undergo a change and transfer our business or other activities, in whole or in part, to another entity, then such transfer would include the personal data relating to those activities. The same would apply should we be legally compelled to make such changes.

8. What are your rights related to personal data processing?

You have the following rights in connection with the processing of your personal data:

Right to information

You have the right to receive information before and during processing at your request. Upon request, we will tell you whether we process your personal data and, if you request it, you will also receive information about the purposes, categories of data, recipients (categories), retention period (criteria), information about your rights (including the option of contacting a supervisory authority), the sources of the data (if they do not come from you), automated individual decision-making and the transfer of data to a third country or an international organization (and the related safeguards).

Right to access

In addition to information about processing, you have the right to a copy of the data that is processed about you. We may charge you a reasonable fee for the cost of making the second and each additional copy.

Right to rectification

We should process accurate data; you have the right to have your data corrected if it is found to be incorrect or incomplete.

Right to erasure (“right to be forgotten”)

You have the right to have your data erased, but only if there is no other existing lawful reason for processing that we can use (including protection of legitimate interests and rights). You also have the right to erasure if it turns out that the processing carried out by us was unlawful or if erasure is necessary to comply with a legal obligation to which we are subject.

Portability

You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and the right to transfer that data to another controller. You also have the right to have us transfer your personal data to another controller directly, if technically feasible. However, this only applies to automated data.

Right to object

This applies to cases of processing for reasons of public interest pursued by the controller or for the controller’s own legitimate interests, including direct marketing. You have the right to object to such processing and we are obliged to assess such processing for compliance with all rules under the regulations. In the case of direct marketing, we will always stop such processing upon objection.

Right to withdraw consent

In the case of processing based on your consent, you can withdraw your consent at any time. You can send us a request to withdraw your consent to the processing of your personal data at any time from the email address you have on file with us to the following email address info@fondee.cz or, if consent was given for an operation in the Fondee application, by withdrawing consent in the Fondee application settings or by clicking on the link in each individual commercial communication.

Right to restrict processing

You have the right to restrict the processing of your data if:

• you deny the accuracy of the data until we verify the accuracy,
• the data is not needed for the purposes of processing, but you request its processing for the establishment, exercise or defence of legal claims,
• you have raised an objection against processing, until it is verified whether our legitimate reasons outweigh your legitimate interests,
• the processing of the data was unlawful and you request the restriction of data processing instead of erasure.

Automated individual decision-making

If automated decision-making is carried out which has significant consequences for you (e.g. would lead to the non-conclusion of the contract, change of the terms of the agreed service, etc.), you have the right to have such a decision reviewed, to respond to it and, if necessary, to challenge it.

Right to apply to the supervisory authority, court

You can contact the supervisory authority, that being the Office for Personal Data Protection (registered office at Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.cz) if you believe that we are processing your personal data in breach of the GDPR, and you may also exercise your rights in the relevant court.

9. What if something changes?

We will update this information regularly and it will always be available on our website. If there is a fundamental change in the processing of personal data, we will inform you directly.