Privacy Statement of Kompenzo s.r.o.

I. Introduction

1. We give a special emphasis on the protection of users of our website who provide us with their personal data. This privacy statement (“Privacy Statement”) is providing you with the necessary information on how we, the company Kompenzo s.r.o., registered office at Hybernská 1033/7, Nové Město, 11000 Praha 1, Czech Republic, company ID 214 88 941 (“We”) process your personal data as the data controller pursuant to Article 4, point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).
2. Our contract details are:

Kompenzo s.r.o. Hybernská 1033/7, Nové Město, 110 00 Prague 1 ID: 21488941 e-mail: info@kompenzo.com

1. This Privacy Statement also describes any processing of personal data conducted by us and our partners representing you in these claims (“Claim partners”). The Claim partners are bound to process your personal data according to this Privacy Statement and for other purposes stated in the privacy statement of the specific Claim Partner. We are, however, not responsible for any data processing or actions conducted by these Claim partners. We do not act as joint data controllers with Claim partners and we are not liable for any damage caused by the Claim partners.
2. Identification and contact details of any Claim partners who receive your personal data will be made available to you through our website or by e-mail. Use these contact details to exercise your rights related to processing of your personal data by this Claim partner.
3. Unless specified otherwise, such as in Article IV of this Privacy Statement, any information about processing of personal data by us apply also to processing of personal data by Claim partners.
4. We are committed to protecting and preserving your privacy. This Privacy Statement sets out the basis on which any data we collect from you, or that you provide to us, will be processed by us. Please read this Privacy Statement carefully to fully understand how we process, use, disclose and secure information that you provide to us when you use our website.
5. We reserve the right to change this Privacy Statement at any given time, if you want to make sure that you are up to date with the latest changes, we advise you to view this Privacy Statement regularly. If we materially change our Privacy Statement, we will notify you of such changes by posting a notice on our website and/or contacting you at the e-mail address provided to us. Your continued use of the website will be deemed your agreement that your information may be used in accordance with the new statement. If you do not agree with the changes, please stop using our website, and notify us that you do not want your personal data to be used in accordance with the changes.
6. By accessing or using our website, you signify your acknowledgment and consent to the Privacy Statement set forth below. If you do not agree to this statement, please do not use this website.

II. Principles of the personal data protection

1. We are bound by the following principles when processing personal data:
   • Personal data must be processed fairly and in a lawful and transparent manner;
   • Personal data may only be collected for specific, explicit and legitimate purposes and may not be further processed in a way that is incompatible with those purposes;
   • Personal data may be processed only to the extent necessary in relation to the purpose in question;
   • The processing of personal data must take into account its accuracy;
   • Personal data may be kept only for the necessary period; and
   • Personal data must be processed under appropriate security.

III. Sources and scope of the processed data

1. We receive your personal data from various sources, which are in particular:
   1. when you register on our website or fill in forms on our website;
   2. when you provide information about the specific claim; and
   3. when you communicate with us or the Claim partner.
2. We use the following categories of personal data:
   1. Identification data, such as name, surname, date of birth;
   2. Contact data, such as e-mail, telephone, postal address;
   3. Financial data, such as bank connection and any sums paid;
   4. Communication data, such as history of previous contacts and data regarding your enquiry that you provided us with;
   5. Claim data, such as your previous use of any goods or services, contacts with third parties, damage incurred, contracts concluded; these data may also include data about your health, racial or ethnic origin or other special categories of data under Article 9 GDPR (“Sensitive data”) you provided us with.
3. We also process Cookies data, i.e. personal data regarding your usage of our website collected by cookies and other tracking techniques. We would like to remind you that your personal data might be automatically collected through your use of our website by cookies and other technologies. The personal data may include device information (hardware model, information about the operating system and its version, unique device identifiers, mobile network information, device storage information), location information (IP address, time zone, information about your mobile service provider), usage data (including, among others: frequency of use, areas and features of our website you visit, your use patterns generally, engagement with particular features). We may use this information to better understand, customize and improve the user experience of our website and services. See section below "Cookies” to learn more.
4. We process Sensitive data only with your express consent or if such processing is necessary for the establishment, exercise or defence of legal claims.

IV. Purposes, legal basis and duration of the processing

1. We process personal data on the basis of the following purposes:
   1. Provision of services. If you apply with specific claim, we process the Identification data, Contact data, Financial data, Communication data, Claim data and Cookies data for the purpose of the provision of services to you, which consist of initial evaluation of the claim and administering your claim. We process these personal data for the duration of the contractual relationship we have with you. For this purpose, the legal title for processing is a necessity for the performance of the contract. In case the Sensitive data are also provided, these are processed for the establishment, exercise or defence of legal claims.
   2. Transfer of data to Claim partners. If you apply with specific claim and subsequently approve the transfer to a Claim partner, we transfer your Identification data, Contact data, Financial data and Claim data to this partner, enabling the partner to represent you in such claim and administer it. We process these personal data until the end of a transfer of data to the specific Claim partner. For this purpose, the legal title for processing is a necessity for the performance of the contract. In case the Sensitive data are also provided, these are processed with your explicit consent.
   3. Protection of our rights and legitimate interests. Further, we process your Identification data, Contact data, Financial data, Communication data, Claim data and Cookies data on the basis of the legitimate interest consisting of recovery of our claims against you and/or to protect and enforce our claims. For this purpose, we process your personal data for the period of time corresponding to the statutory limitation period, generally limited to 15 years. In case the Sensitive data are also provided, these are processed for the establishment, exercise or defence of legal claims.
   4. Performance of general legal duties. We also process your Identification data, Contact data, Financial data and Claim data in accordance with the relevant advocacy acts, accounting acts or value-added tax act, as we are obliged to store those documents for a certain time period (this specific time period may differ according to applicable law in each country). If there is such a legal obligation, we store the concerned documents together with your personal data for the time period as stated by the applicable law.
   5. Promotion of our website and services. If you use the website, we also use your Identification data, Contact data, Claim data and Cookies data to promote our services and the possibility to file your claim, including sending promotional communications. The legal basis for this processing is our legitimate interest in the promotion of our activities and we process your personal data for the duration of the contractual relationship and 2 years after or for 2 years after visit of our website if you are not our customer.
   6. Operation of our website and their security (Essential Cookies). We process your Cookies data, which are necessary for the operation of the website, including presentation, their functionality and ensuring your safety. Within this purpose, we identify you as a visitor during the browsing or during repeated logins on the website. The legal basis for such processing is our legitimate interest in due functionality and operation of our website. We generally retain your personal data for up to 2 years after your visit to our website.
   7. Promotion and marketing on our website (Marketing Cookies). We process your Cookies data, which are necessary for targeting and showing our advertisement (marketing cookies), while your data may also be transferred to third parties. Within this purpose, we promote and market products and services on the website and show you marketing communication related to products and services you expressed your interest in and promote our brand through online promotion, while your data may also be transferred to third parties. The legal basis for processing here is therefore your consent, given through the Cookies Sidebar. We retain your data for the duration of your consent but in any case, no longer than 2 years from receiving your consent.
   8. Customization of website (Functional Cookies). We process your Cookies data, which are necessary for the customization of the website (functional cookies). We can then simplify browsing the website for you. For this purpose, we customize the website – location, language choices and your device to your preferences, while your data may also be transferred to third parties. The legal basis for processing here is therefore your consent, given through the Cookies sidebar. We retain your data for the duration of your consent but in any case, no longer than 2 years from receiving your consent.
   9. Analysis of visits of website (Analytics Cookies). We also process your Cookies data, which is necessary for analysis of visits to our website (analytics cookies). For this purpose, we monitor traffic on our website, optimize our website, ensure the security of your data and make it more seamless and user-friendly, while your data may also be transferred to third parties. We process your data based on your consent, which you gave to us through the Cookies Sidebar. We retain your data for the duration of your consent but in any case, no longer than 2 years from receiving your consent.
2. Your personal data may also be processed by our Claim partners for the following purposes:
   1. Representation in dispute. The Claim partner may process your Identification data, Contact data, Financial data, Communication data and Claim data for the purpose of the provision of services to you, which consist of representing you in the claim and administering your claims, including collecting any payments on your behalf, providing your personal data to the court of another party to the dispute and providing the data about status of the dispute to us. The Claim partner processes these personal data for the duration of the contractual relationship they have with you. For this purpose, the legal title for processing is a necessity for the performance of the contract. In case the Sensitive data are also provided, these are processed for the establishment, exercise or defence of legal claims.
   2. Protection of rights and legitimate interests. Further, the Claim partner may process your Identification data, Contact data, Financial data, Communication data and Claim data on the basis of the legitimate interest consisting of recovery of their claims against you and/or to protect and enforce their claims. For this purpose, they process your personal data for the period of time corresponding to the statutory limitation period, generally limited to 15 years. In case the Sensitive data are also provided, these are processed for the establishment, exercise or defence of legal claims.
   3. Performance of general legal duties. The Claim partner may also process Identification data, Contact data, Financial data and Claim data in accordance with the relevant advocacy acts, accounting acts or value-added tax, as they are obliged to store those documents for a certain time period (this specific time period may differ according to applicable law in each country). If there is such a legal obligation, they will store the concerned documents together with your personal data for the time period as stated by the applicable law.
3. There is no automatic individual decision-making by us or the Claim partner within the meaning of Article 22 GDPR

V. Disclosing of personal data

1. Where applicable, we may disclose your personal data to verified and contractually obligated external business third parties, acting as our data processors, for the above-mentioned purposes, such as our hosting providers, call centre operators and providers of marketing services. This also includes our legal advisors evaluating the claim, who act as our data processors.
2. We may also provide your data, based on your instruction, to a specific Claim partner.
3. We work with Daccs B.V., a limited liability company having its statutory seat in Amsterdam and its offices at (1082 MA), Amsterdam, at Gustav Mahlerplein 28, registered in the trade register of the Chamber of Commerce under number 83537848 (“Daccs”) a processor that provides us with marketing services. Daccs in turn cooperates with parties to perform its services, such as Google for optimising the Website. Google qualifies as a processor in the context of its services and as a data controller for specific processing operations. In addition, Meta is used to show you relevant ads. Meta qualifies as a (joint) controller for these services.
4. We also use performance-based marketing. Performance-based marketing is a fair form of advertising because the advertiser is remunerated only for actual and measurable results. To make use of this service, we submit anonymous transaction data to an affiliate network. This data includes; product descriptions, sales value, and demographic and geographical characteristics. These cannot be traced back to an individual and are only used and shared for statistical purposes. In addition to anonymous transaction data, we also provide pseudonymised transaction IDs. These transaction IDs are not further shared with other third parties and only used for validation purposes. The technical process also transmits your IP address. This address is only stored anonymised in the affiliate network's system.
5. In addition, the personal data may be provided to:
   1. the courts, other public authorities and other public bodies, where necessary for the exercise of the controller’s rights vis-à-vis the data subject or for the fulfilment of our legal obligation;
   2. law enforcement authorities, where necessary for the exercise of our rights vis-à-vis the data subject or for the fulfilment of our legal obligation;
   3. our new owners and legal advisors in the case of sale of our company or other similar transaction.
6. We may transfer personal data to a third country (a country outside the EU) or an international organization. We implement appropriate safeguards to protect such personal information. Recipients of personal data in third countries are providers of mailing services or cloud services or persons involved in negotiating contract opportunities with the controller, involved in ensuring the operation of the services and providing marketing services.
7. In this case, the data controller will adopt adequate guarantees of the protection of personal data within the meaning of Article 44 et seq. of the GDPR. Where we disclose personal information for a purpose set forth herein, we will sincerely base on the contract concluded with the data subject, we will enter a contract with the third party that describes the purpose and requires the third-party recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. The data controller is not liable towards the users for any violations of the GDPR made by this third party.
8. If such activity is presumed by the contract we entered into with you, we also may provide your personal data to the 3^rd parties who meet the definitions of such contract.

VI. Rights of the data subject

1. Under the conditions set out in the GDPR, you as the data subject shall have:

a. the right of access to your personal data pursuant to Article 15 of the GDPR;

When exercising the right of access to personal data, we will provide you with confirmation of which of your personal data we process, for which purpose, to whom the personal data has been or will be disclosed, for how long the personal data will be processed, information about your rights regarding personal data, information about the source of the personal data and information about whether automated decision-making, including profiling, takes place regarding your personal data. You can also request a copy of personal data which we process about you.

b. the right to rectification of personal data pursuant to Article 16 GDPR;

When exercising the right to rectification, you can request that we correct incorrect personal data we process about you.

c. the right to erasure of personal data pursuant to Article 17 GDPR;

If you believe that we are processing your personal data unlawfully, you have the right to ask us to delete it. We are only obliged to comply with this request in certain cases and the request will always be considered individually in relation to the category of personal data concerned and the purpose for which it is processed.

d. the right to restriction of processing personal data pursuant to Article 18 GDPR

If

• you contest the accuracy of the personal data, we will restrict the processing of your personal data until a decision is made as to whether it is correct,
• we would be processing your personal data without sufficient legal basis, but you will request a restriction on processing instead of erasure of the data,
• we no longer need your personal data for the processing purposes set out above in this notice, but you require it for the establishment, exercise, or defense of legal claims; or
• you object to the processing of the personal data, in which case we are obliged to restrict the processing of the personal data in question while we evaluate the validity of the objection;

You have the right to ask us to temporarily restrict the processing of that personal data. In this case, the personal data will not be erased, however, the processing will not take place.

e. the right to object to processing pursuant to Article 21 GDPR (in particular in the case of processing for direct marketing purposes);

If the processing of your data is based on a legitimate interest, you may object to such processing on grounds relating to your particular situation. We will then assess your request and unless we can demonstrate that we have compelling legitimate grounds for the processing which override your interests or rights and freedoms or that we need the personal data to establish, exercise or defend legal claims, we will not continue to process your personal data for that purpose.

If we process your personal data for direct marketing purposes and you object to such processing, we are obliged to comply with the objection.

An objection shall also be deemed to be an objection to processing by automated means or an objection to processing for direct marketing purposes.

f. the right to data portability pursuant to Article 20 GDPR;

When exercising the right to portability of personal data that we process on the basis of the performance of a contract or your consent, you can ask us to transfer the personal data in question. In such a case, we will provide your personal data in a structured, commonly used and machine-readable format to the entity designated by you.

g. the right to withdraw consent to the processing of personal data at any time in writing or electronically to our address or email specified in this Privacy Statement.

If we process your personal data on the basis of your consent, you are entitled to withdraw this consent at any time.

However, please note that withdrawal of consent only applies to personal data processed on this basis and does not apply to personal data that we may process on another legal basis (e.g. for the performance of a contract).

2. If you exercise a right in accordance with this Article or in accordance with other applicable legal provisions, we will inform you about the adopted measure about your personal data to every recipient who is processing such data, if the communication to the recipient is possible and/or does not require unreasonable effort.

3. If you wish to exercise your rights or to receive the relevant information, contact us via one of our contact details. When you contact us, we have to ask you to provide us with your identification information or other personal data which you have provided us earlier. The provision of such information is necessary for the verification if it is you who has actually sent the request. We will provide you with the answer no later than one month after receiving such a request, whereby we retain the right to extend this time period by two months.

4. In addition, you have the right to lodge a complaint with the competent Data Protection Authority, in particular in the Member State of your habitual residence, place of employment or place of alleged infringement, if you consider that your right to data protection has been infringed.​ In Czechia, you may contact the Czech Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, Czechia, website: https://www.uoou.cz/

VII. Voluntary provision of personal data

1. The provision of personal data shall be voluntary, but non-provision of the necessary personal data shall be incompatible with the establishment of the relevant legal relationship and the fulfilment of the rights and obligations arising therefrom.

VIII. Conditions for the security of personal data

1. We declare that we have taken all appropriate technical and organizational measures to ensure the security of personal data and the security of data storage devices and documents containing personal data.
2. We declare that only persons authorized by us have access to the personal data.
3. We would like to remind you that the transmission of information via the internet is not completely secure, and we cannot guarantee the security of data sent to us electronically on the website, and transmission of such data is therefore entirely at your own risk.

IX. Cookies

1. While using our website we may process your personal data (Cookies data) via cookies and other tracking technologies. Cookies are small text files that are stored in your web browser that allow us or a third party to recognize you. Cookies can be used to collect, store and share bits of information about your activities across websites, including our website. This also applies to other similar technologies used for this purpose.
2. We use the following cookies:
   1. Technical cookies are necessary to ensure the correct function of the website;
   2. Third-party cookies – tracking cookies, analytical/targeting cookies.
3. You may adjust the authorization or the refusal of all of the cookies or only some of the cookies. The refusal of the cookie files may have a negative influence on the functionality of the websites, including the website. You may adjust your choice regarding the cookies anytime or you may erase them from your electronic device at any time. Detailed information regarding the cookies is provided on the website of the appropriate website browser provider. Read more about the Cookies policy.

X. Links to Third party websites

1. Our website may contain links to other websites. If you visit one of these linked sites, we would like to remind you that you should review their privacy and other policies. We have no control over and are not responsible for the privacy policies or practices of such sites.

XI. Final provisions

1. By confirming acknowledgement of this Privacy Statement or signing the agreement linking to this Privacy Statement, you confirm that you have read the Privacy Statement and accept it in its entirety.
2. This Privacy Statement is current as of October 1, 2024. We are entitled to change the Privacy Statement. We will publish the new version of the Privacy Statement on our website or, where applicable, send the new version of the Privacy Statement to the you at the email address provided to us.