1. CONTENT AND PURPOSE OF THE DOCUMENT

1.1 This document contains information about the protection of personal data provided by visitors to the www.provendia.cz website, our clients and those interested in our services and products. 1.2 The purpose of this document is to inform you (data subjects) of your rights and to provide clear information about how personal data will be handled. 1.3 We appreciate the trust you place in us by providing us with your personal data, and therefore we process it in accordance with Act No. 110/2019 Coll, Data Protection Act, as amended, and Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), which came into force on 25 May 2018. 1.4 Content:

• Personal data controller – who are we and how can you contact us?
• What personal data do we process and how do we obtain it?
• For what purposes do we process personal data, for how long and what entitles us to do so?
• Your data protection rights
• How to exercise your rights

2. PERSONAL DATA CONTROLLER – WHO ARE WE AND HOW CAN YOU CONTACT US?

Provendia s.r.o., ID No.: 02233827, with its registered office at Hlavní 108, 664 31 Lelekovice, registered in the Commercial Register maintained by the Regional Court in Brno, File No. C 93623/KSBR.

Contact details:

• E-mail: info@provendia.eu
• Phone: +420 730 809 411
• Web: www.provendia.cz

3. WHAT PERSONAL DATA DO WE PROCESS AND HOW DO WE OBTAIN IT?

3.1 We process the data you provide to us. This includes completing forms on the website, registering for a user account, preparing contracts, communicating during contract execution, personal contact, telephone or email communication.

3.2 We may also process publicly available data, for example from the commercial register or social networks (Facebook, Instagram, LinkedIn).

3.3 If we need consent to process certain data, we will only process it with your consent.

3.4 The provision of personal data is voluntary but in some cases necessary for the performance of a contract or legal obligation.

3.5 Personal data processed:

• Name, surname, title
• Address
• ID, phone, e-mail
• IP address, cookies
• Information about ordered goods and services
• Photos and videos from company events

3.6 We do not process special category data (sensitive data).

4. FOR WHAT PURPOSE DO WE PROCESS PERSONAL DATA, FOR HOW LONG AND WHAT ENTITLES US TO DO SO?

4.1 Conclusion of the contract and performance of contractual obligations

• Legal basis: performance of the contract.
• Retention period: for the duration of the contract and for 5 years after its termination in accordance with applicable law.

4.2 Compliance with legal obligations

• Legal basis: legal provisions (e.g. accounting or tax laws).
• Retention period: at least 10 years according to the Accounting Act.

4.3 Legitimateinterests

• We may process personal data for the protection of rights, direct marketing and other legitimate interests.
• Legal basis: our legitimate interest.
• Retention period: for as long as the legitimate interest lasts or until objections are raised.

4.4 Processing byconsent

• If you have given us your consent, we may send you commercial communications.
• Legal basis: your consent.
• Retention period: until withdrawal of consent.

5. YOUR DATA PROTECTION RIGHTS

5.1 Right of access – you can request confirmation of whether we are processing your personal data and access it.

5.2 Right to rectification – if your data is inaccurate or incomplete, you have the right to have it rectified.

5.3 Right to erasure (“right to be forgotten”) – you can request the erasure of your data if it is no longer needed or if you withdraw your consent.

5.4 Right to restriction of processing – in certain cases you may request restriction of the processing of your data.

5.5 Right to data portability – under the terms of the GDPR, you have the right to receive your data in a portable format.

5.6 Right to object – if we process data on the basis of legitimate interest, you can object.

5.7 Right to lodge a complaint with the supervisory authority – if you believe your rights are being violated, you can contact the Data Protection Authority (https://www.uoou.cz/).

6. HOW TO EXERCISE YOUR RIGHTS

If you have any questions or wish to exercise your rights, please contact us at info@provendia.eu. We may ask you to verify your identity when you submit your application.

This document is effective from 21.2.2025. The current version is always available at www.provendia.cz.