AG TRANSPORT - PRIVACY NOTICE.docx

Introduction

AG TRANSPORT is a leading provider of international road transport services, crane and rigging services and heavy haulage transport services. AG TRANSPORT is committed to conduct its business in compliance with applicable privacy and data protection law on every stage of its activity.

This Privacy Notice explains for what purposes and how AG TRANSPORT collects personal data about data subjects, as well as how we protect the personal data and for how long we will retain it and what rights the data subjects have under the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC („GDPR”).

Purposes of the Processing

AG TRANSPORT processes the personal data in order to:

• Hire employees;
• Perform employment contracts;
• Contact current and prospecting customers, suppliers, and other persons by e-mail, telephone, fax and other means, as well as perform contracts with them;
• Comply with its legal obligations;
• Perform other activities arising from the course of business.

AG TRANSPORT employees are acquainted with the information about processing of their personal data by HR Department according to AG TRANSPORT internal procedures.

Data Controller of the Personal Data

The data controller of the personal data is the AG TRANSPORT company with whom a data subject or an entity at which a data subject is employed or works for is doing business or intends to do business or is in other relationship.

Legal Basis for the Processing

The personal data are processed on the following legal grounds:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• performance of a contract to which a data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• compliance with a legal obligation to which AG TRANSPORT is subject;
• for the purposes of the legitimate interests pursued by AG TRANSPORT - in order to ensure continuity, efficiency and security of its business activity, as well as for the establishment, exercise or defense of legal claims or for marketing purpose.

Categories of Personal data Processed

The processing of personal data includes the following:

• Standard contact data (like telephone number, e-mail address, name, title, physical address, etc.)
• Name and address of a business activity
• Account number
• Name of an employer, job position
• Fees and expenses to be reimbursed

Source of the Personal Data

When a data subject concludes a contract with AG TRANSPORT, the initial data is likely to come from this data subject. We may also receive the personal data from a data subject’s employer, a web-site or other publicly accessible sources, if such data subject’s personal data are required for a performance of a contract, submitting an offer or asking a question about particular services.

Data Recipients

Internal

Within the scope of AG TRANSPORT’s internal authorizations and on a need-to-know basis only, the personal data may be disclosed to the persons responsible for contact with customers and suppliers, e.g. finance and tax departments, as well as legal, HR, internal audit and IT.

In certain cases, if necessary for a performance of a contract or for security, compliance or other legitimate reasons, AG TRANSPORT may make the personal data available to its subsidiaries or affiliates.

External

For the above-mentioned purposes, the personal data may be disclosed to third parties such as:

• banks for payment transactions
• cloud providers for data stored in the cloud
• data service providers who are responsible for providing support to our IT, HR, enterprise management, and data infrastructure
• other professional advisors, like IT or auditing service providers

The external recipients are required to respect the confidential nature of the data and may only use them according to AG TRANSPORT’s instructions when processing personal data on behalf of it as data processors or according to the applicable law when acting as data controllers.

Security

AG TRANSPORT has applied adequate organizational and technical measures in order to ensure that the personal data are protected in accordance with the GDPR. Those measures shall be reviewed and updated where necessary. AG TRANSPORT’s employees are obliged to protect the personal data according to AG TRANSPORT’s Global Security Policy, in particular to treat them as strictly confidential and process them to the extent necessary for the performance of the above-mentioned purposes.

Transfers of the Personal Data to Third Countries

Personal data may be processed outside the European Economic Area (EEA). When processed outside the EEA, AG TRANSPORT will make sure that this cross-border data processing is protected by adequate safeguards.

The safeguards that we use to protect cross-border data processing include:

• standard contractual clauses for protection of personal data approved by the European Commission, providing appropriate and suitable safeguards for the transfer. These standardized contractual clauses provide sufficient safeguards to meet the adequacy and security requirements of the European General Data Protection Regulation. You can find the standard contractual clauses on the European Commission web-site: https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX:32010D0087; or
• certifications which demonstrate that third parties outside of the EEA process personal data in a way that is consistent with the European General Data Protection Regulation. These certifications are approved either by the European Commission, a competent supervisory authority or a competent national accreditation body in terms of General Data Protection Regulation.

Data subjects may receive the copy of the personal data transferred to the third countries at DataProtection@agtransport.cz.

The Period for Which the Personal Data Will Be Stored

As a rule, the personal data are stored during the course of a given contractual relationship with AG TRANSPORT, as well as during a term subsequent to the end of such relationship in accordance with applicable statutory retention and limitation periods and document retention policies which result, amongst others, from civil, commercial and tax law as well as corporate governance and policies. Please note that specific legal or corporate requirements may require longer retention periods, e.g. obligation to safeguard evidence in case of claims.

Personal data that we are processing based on a data subject’s consent will be kept for unlimited period of time (or until the consent is revoked), unless otherwise prescribed by applicable legal requirements and presuming that it is necessary for the purpose of processing.

Data Subject’s Rights

The data subject has at any time the right to contact AG TRANSPORT if he or she wants to exercise his/her right of access to the personal data, rectification of the personal data, erasure of the personal data, right to restriction of processing, right to data portability. The data subject has also the right to object to processing.

The data subject has the right to withdraw his/her consent to the processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The data subject also has a right to lodge a complaint with the supervisory authority.

Contact Data

Your contact at AG TRANSPORT for any further information about this Privacy Notice and your rights AG TRANSPORT Data Protection Representative at DataProtection@agtransport.cz.