The controller of your personal data is:

Company: AMC automotive, s.r.o.

Company Registration No.: 11928913

Registered Office: č.p. 19, 503 27 Radíkovice

incorporated in the Companies Register with the Regional Court in Hradec Králové, Section C, Insert No. 48365,

Contact person: Martin Kusý, e-mail: [email protected]

(hereinafter referred to only as the "Provider"),

which collects, stores and uses (and otherwise processes) your personal data for the performance of its business activities (the individual purposes for which personal data are processed are set out in greater detail below).

The Provider is not obliged to appoint a Data Protection Officer nor has it voluntarily appointed one. The Provider collects your data, has them in its possession and is responsible for their proper and lawful processing. You may exercise your rights against the Provider as set out below.

The processing of personal data is carried out in accordance with Act No. 110/2019 Coll., on the Processing of Personal Data, as amended, and at the same time in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation).

This Personal Data Protection Policy applies to all personal data collected by the Provider during your use of the Provider's website (hereinafter referred to only as the "Website") and also on the basis of the performance of a contract between you and the Provider or on the basis of a legal obligation, legitimate interest of the Provider or the consent granted to the processing of personal data through the Website or, for example, when concluding a contract for the provision of services.

The data subject is considered to be the natural person whose personal data are processed.

Your personal data may be processed by the Provider mainly for the following purposes:

• Performance of a contractual relationship (for example, when concluding a purchase or service agreement);

• Managing user accounts of data subjects (for example, when entering personal data in electronic forms available on the Website);

• Sending commercial communications and offering products and services (the Provider may send commercial communications and offer products and services by post, e-mail, SMS or telephone call);

• Handling your request as a communication related to an inquiry about goods and services offered by us;

• Accounting and tax purposes (compliance with legal obligations under accounting and tax legislation);

• Compliance with other legal obligations (other legal obligations that the Provider is to comply with include, but are not limited to - providing information to law enforcement authorities or other public authorities).

The Provider is entitled to process the following personal data according to the purpose for which it obtained them from individual data subjects:

Personal data are processed by the Provider both manually and automatically. Automated processing of personal data occurs in cases where you have given your consent to the processing of personal data for the purpose of being sent personalised marketing communications; in these cases, profiling may also occur.

The categories of personal data that are subject to processing by the controller are: identification data, contact data, transaction data.

Your personal data are made available by the Provider only to authorised employees or individual processors at the extent necessary for the fulfilment of the individual purposes of processing, or on the basis of consent to the processing of personal data.

Under certain conditions, we are then entitled to submit some of your personal data on the basis of applicable law for example to law enforcement authorities or other public authorities.

We process and store your personal data for the period necessary to ensure any and all rights and obligations arising from the relevant contractual relationship and for the period for which the Provider as a data controller is obliged to store personal data under generally binding legal regulations or for the period for which you have given us your consent to the processing. In other cases, the processing period results from the purpose of the processing or is prescribed.

We process personal data according to the purpose of their processing for the following period of time:

We only process personal data that we have received from you or obtained in communication with you on the basis of your interest in goods and services provided by us or on the basis of generally binding legal regulations.

Specifically, we obtain personal data in one of the following ways: by electronic mail (e-mail); by telephone; by written communication delivered by a postal service provider to the address of our registered office; in person at our registered office, through our contact form located on the Website.

We do not seek or process personal data about you from public sources.

When using our Website, your personal data may be processed through the use of cookies. Detailed information about cookies and other tracking technologies used on our Website can be found here. This cookie information provides details of how to refuse cookies and tracking technologies.

The controller confirms that there is no transfer of personal data to third countries.

As a data subject, you have the following rights under law, which you can exercise at any time. These are the right (i) to access your personal data, (ii) to rectification of inaccurate and false personal data, (iii) to request an explanation if you suspect that the processing of personal data violates the protection of your personal and private life or that personal data are being processed in violation of the law, (iv) to have personal data deleted if the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, or if it is established that they have been processed unlawfully, (v) to restrict the processing of personal data, (vi) to data portability, and (vii) the right to object, after which the processing of your personal data will be terminated unless it is proven that there are compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, in particular if the reason is the enforcement of possible legal claims. You also have the possibility of contacting the Data Protection Authority (www.uoou.cz), which you can lodge a complaint with.

• Right of access to your personal data: if you want to know whether the Provider is processing your personal data, you have the right to obtain information about whether your personal data are being processed and, if so, you also have the right to access your personal data. In the event of a repeated request, the Provider shall be entitled to charge a reasonable fee for a copy of the personal data provided. We will inform you of this procedure.

• Right to rectification of inaccurate and false personal data: if you feel that the Provider is processing inaccurate or false personal data about you, you have the right to request their rectification. The Provider will carry out the correction without undue delay, but always taking into account technical possibilities.

• Right to request an explanation: if you suspect that the Provider's processing of your personal data violates the protection of your personal and private life or that your personal data are being processed in violation of law, you may request an explanation from the Provider.

• Right to deletion: if you request the deletion of your personal data, the Provider shall delete such data if (i) they are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) the Provider is required to do so by law.

• Right to restrict the processing of personal data: if you are not interested in deletion, but only in the temporary restriction of processing of your personal data, you can request that the Provider restrict the processing of your personal data.

• Right to data portability: if you want the Provider to pass your personal data on to a third party, you can exercise your right to data portability. If the exercising of this right would affect the rights and freedoms of third parties, the Provider shall not be able to comply with your request.

• Right to object: you have the right to object at any time to the processing of personal data processed for the purposes of carrying out a task performed in the public interest or in the exercising of a public authority or for the purposes of protecting the legitimate interests of the Provider. If the Provider does not prove that there is a compelling legitimate reason for the processing which overrides your interests or rights and freedoms, it shall terminate the processing without undue delay on the basis of your objection.

In exercising your rights, please contact us at the address of the Provider's registered office or by email at [email protected] The Provider reserves the right to check the identity of the data subject exercising the above rights in a reasonable manner.

This Personal Data Protection Policy shall be effective from March 1, 2023.