BASIC AND ESSENTIAL REQUIREMENTS FOR REQUESTS TO EXERCISE DATA SUBJECT RIGHTS IN THE FIELD OF PERSONAL DATA PROCESSING AND PROTECTION

(pursuant to Act No. 110/2019 Coll., on the Processing of Personal Data, in conjunction with the General Data Protection Regulation – GDPR)

I. Personal Data Controller

GDX Invest s.r.o., with its registered office at Nemanická 2722, České Budějovice 3, 370 10 České Budějovice, Company ID No.: 02467674, tel.: +420 722 075 630, data box ID: esnbqzs (hereinafter referred to as the “Company” or the “Controller”).

II. Contact Details

The role of Data Protection Officer for the Controller is performed by:

Martin Trávníček, MBA

Email: [email protected]

Tel.: +420 722 075 630

III. Rights of Data Subjects

• the right to withdraw consent
• the data subject’s right of access to personal data
• the right to rectification
• the right to erasure (the “right to be forgotten”)
• the right to restriction of processing
• the right to notification concerning rectification or erasure of personal data or restriction of processing
• the right to data portability
• the right to object, unless an exception is provided for by law or the GDPR
• the right relating to automated individual decision-making, including profiling
• the right to information on the origin and collection of personal data where the personal data were not provided to the Controller by the data subject.

Forms for exercising rights – objection to the processing of personal data, exercise of the right to data portability, withdrawal of consent, rectification, restriction of processing, erasure and access to personal data – are available from our employees acting on behalf of the personal data Controller.

IV. Exercising Data Subject Rights

A data subject is entitled to exercise their rights by submitting a written request:

• by personal delivery to the address of the personal data Controller
• by post to the address of the personal data Controller
• electronically to the Data Protection Officer’s email address: [email protected]
• via data box to the personal data Controller’s data box ID

V. Requirements for a Request

1. A person wishing to exercise their rights concerning personal data is required to state in a written request the relevant reasons and facts to which they object and the rights they wish to exercise.

2. Each request must contain the statutory particulars required for the submission of an application in administrative proceedings. In addition, the applicant must prove their identity, i.e. by an officially certified signature for a paper request, by a recognised electronic signature for an electronic request, or by submitting the request via a data box.

3. If a request does not meet the statutory requirements, the applicant will be requested in writing to remedy the deficiencies; if the applicant fails to do so within the specified period, the request will be rejected.

VI. Handling of Requests and Time Limits

• requests are handled free of charge within 30 days of receipt pursuant to Article 12(3) GDPR, unless otherwise provided by law. In exceptional cases, this period may be extended where an extension is necessary due to the complexity and extent of the handling required by the Controller;
• information may be provided by the Controller in writing or by other means or, if requested by the data subject, orally, provided that the identity of the data subject has been established by other means.

If an applicant repeatedly submits a request concerning the same matter, or if the request is manifestly unfounded or the data subject is not entitled to submit it, the Controller will refuse the request and, in exceptional cases, may, pursuant to Article 12(5), require the applicant to pay the administrative costs relating to the request, including where the request is refused.

VII. Remedies

• if the data subject’s request under paragraph 1 is found to be justified, the Controller will remedy the unsatisfactory situation without undue delay;
• if the Controller does not comply with the data subject’s request under paragraph 1, the data subject has the right to contact the supervisory authority directly, namely the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, in the manner stated by the Controller in the relevant document.