PERSONAL DATA PROTECTION AND PROCESSING POLICY

of the company labguide s.r.o
Identification Number: 21404836
Registered office: Chudenická 1059/30, Hostivař, 102 00 Praha 10
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 401450
Contact phone: +420776020333
Contact email: info@labguide.io
Website: https://labguide.io/ (hereinafter referred to as the "Website")
(hereinafter referred to as the "Company")

Within its activities, the Company manages and processes personal data of the entities specified below. These personal data protection and processing policy (hereinafter referred to as the "Policy") inform data subjects about the circumstances of the processing of their personal data and the rights they have in relation to this processing.

1. DATA SUBJECTS, PURPOSES, SCOPE, DURATION, AND LEGAL BASIS OF PROCESSING\

A. CUSTOMERS – INDIVIDUALS
The Company, as the personal data controller, processes personal data of individual customers for the purpose, to the extent, on the legal basis, and for the following duration:
- a. Purpose: Providing services to customers in accordance with the agreement (conclusion of the agreement, provision of services, and handling of complaints).
  - Scope of data: Name, surname, email address, phone number, date of birth, address, signature, identification number and registered office if applicable, employer if applicable.
  - Legal basis: Necessity of processing personal data for the performance of the agreement.
  - Duration: For the time necessary to fulfill the contract and during the statute of limitations.
- b. Purpose: Accounting and tax purposes and compliance with archiving obligations.
  - Scope of data: Name, surname, address, identification number and registered office if applicable.
  - Legal basis: Necessity of processing for compliance with legal obligations imposed on the Company by law.
  - Duration: For the time necessary, up to 10 years, unless legal regulations stipulate longer periods.
- c. Purpose: Sending commercial communications for marketing and advertising purposes.
  - Scope of data: Name, surname, email address.
  - Legal basis: Consent.
  - Duration: For a period that is reasonably necessary, up to the revocation of consent.
- d. Purpose: Sending unsolicited commercial communications.
  - Scope of data: Name, surname, email address.
  - Legal basis: Legitimate interest (direct marketing).
  - Duration: For a period that is reasonably necessary.
- e. Purpose: Enforcement of potential claims of the Company (storage of data necessary as evidence in a lawsuit).
  - Scope of data: Name, surname, date of birth, address, signature, identification number and registered office if applicable.
  - Legal basis: Legitimate interest (direct marketing).
  - Duration: For the duration of the contract and after its termination for the duration of the statute of limitations.
B. CONTACT PERSONS OF CUSTOMERS – LEGAL ENTITIES, RECIPIENTS OF THE PROVISION OF SERVICES
The Company, as the personal data processor, processes personal data of contact persons of legal entity customers (typically a member of the statutory body or other person authorized to negotiate on the conclusion and terms of the agreement, possibly on changes to the terms of the agreement and to communicate regarding the performance of the agreement on the part of the customer and the recipients of the provision of services) for the purpose, to the extent, on the legal basis, and for the following duration:
- a. Purpose: Providing services to customers in accordance with the agreement (conclusion of the agreement, provision of services, and handling of complaints).
  - Scope of data: Name, surname, email address, phone number, employer, signature.
  - Legal basis: Necessity of processing personal data for the performance of the agreement.
  - Duration: For the time necessary to fulfill the agreement and during the statute of limitations.
- b. Purpose: Sending commercial communications for marketing and advertising purposes.
  - Scope of data: Name, surname, email address.
  - Legal basis: Consent.
  - Duration: For a period that is reasonably necessary, up to the revocation of consent.
C. WEBSITE VISITORS The Company, as the personal data controller, processes cookies concerning Website visitors. More information about cookie processing on the Website can be found here.
D. PERSON CONTACTING THE COMPANY
The Company, as the personal data controller, processes personal data of individuals who contact the Company by email or phone for the purpose, to the extent, on the legal basis, and for the following duration:
- a. Purpose: Responding to inquiries from contacting individuals.
  - Scope of data: Name, surname, email address, phone number.
  - Legal basis: Legitimate interest in providing a response.
  - Duration: As necessary to respond to the inquiry.

2. VOLUNTARY PROVISION OF DATA The data subject provides their personal data to the Company voluntarily. Failure to provide personal data may affect the Company's ability to conclude a contract or provide services based on the necessary knowledge of information about the data subject, including personal data.

3. RIGHT TO WITHDRAW CONSENT
If the processing of personal data is based on the data subject's consent, the data subject has the right to withdraw their consent at any time by sending an electronic message to fill in the e-mail address/ or through the link provided in the commercial communication. The withdrawal of consent does not affect the processing of personal data carried out by the Company on another legal basis, especially for the purpose of performing the purchase agreement, providing services, or processing based on consent until its withdrawal.

4. PROCESSORS OF PERSONAL DATA
Processors of personal data:

a. Microsoft, sendgrid
b. Microsoft

Please note, however, that due to changing entities providing certain services, it is not possible to list all current and future processors of personal data by name. The above list of processors may therefore change over time. The Company does not transfer personal data to a third country (outside the EU) or an international organization.

5. PROCESSING OF PERSONAL DATA
The Company and, where applicable, its processors process personal data manually (in electronic form) and electronically by automated means.

6. RIGHTS OF DATA SUBJECTS
The data subject has the following rights:

a. Right of access to personal data: Data subjects have the right to obtain from the Company confirmation as to whether their personal data is being processed. If so, they have the right to access this personal data and the following information:
- 1. Purposes of the processing of personal data;
- 2. Categories of personal data concerned;
- 3. Recipients or categories of recipients to whom the personal data has been or will be disclosed;
- 4. The envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- 5. The existence of the right to request from the Company rectification or erasure of personal data or restriction of processing and to object to such processing;
- 6. The right to lodge a complaint with a supervisory authority;
- 7. All available information about the source of personal data if not obtained from the data subject.
Data subjects also have the right to request a copy of the processed personal data from the Company, provided that the rights and freedoms of others are not adversely affected. For additional copies requested by the data subject, the Company may charge a reasonable fee based on administrative costs. If the data subject makes the request electronically, the information will be provided in an electronic form commonly used unless the data subject requests another method.
b. Right to rectification: Data subjects have the right to have inaccurate personal data concerning them rectified without undue delay. Taking into account the purposes of the processing, data subjects also have the right to complete incomplete personal data by providing a supplementary statement.
c. Right to erasure ("right to be forgotten"): Data subjects have the right to request the erasure of their personal data without undue delay, and the Company has the obligation to erase personal data without undue delay if one of the following reasons applies:
- 1. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- 2. The data subject withdraws consent on which the processing is based, and there is no other legal ground for the processing;
- 3. The data subject objects to the processing, and there are no overriding legitimate grounds for the processing.
- 4. The personal data has been unlawfully processed;
- 5. The personal data must be erased for compliance with a legal obligation under the law of the European Union or the Czech Republic;
- 6. The personal data has been collected in relation to the offer of information society services based on the consent of a child.
d. Right to restriction of processing: Data subjects have the right to obtain from the Company the restriction of processing in any of the following cases:
- 1. The accuracy of the personal data is contested by the data subject, for a period enabling the Company to verify the accuracy of the personal data;
- 2. The processing is unlawful, and the data subject opposes the erasure of the personal data and requests instead the restriction of their use;
- 3. The Company no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims.
e. Right to data portability: Data subjects have the right to receive the personal data concerning them, which they have provided to the Company, in a structured, commonly used, and machine-readable format and have the right to transmit this data to another Company without hindrance from the Company if:
- 1. The processing is based on consent or on a contract and
- 2. The processing is carried out by automated means.
When exercising the right to data portability, data subjects have the right to have personal data transmitted directly from one Company to another, where technically feasible. The right to data portability must not adversely affect the rights and freedoms of others.
f. Right to object: Data subjects have the right to object to the processing of personal data. If a data subject raises a justified objection to the processing for the purposes of direct marketing or profiling, the personal data will no longer be processed for these purposes. The objection will be evaluated, and the Company will subsequently inform the data subject whether the objection has been upheld, and the Company will no longer process the data, or if the objection was not justified, the processing will continue. During the resolution of the objection, processing will be restricted.
g. Right not to be subject to automated decision-making, including profiling: Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply if the automated decision-making is necessary for the conclusion or performance of a contract between the data subject and the Company or is based on the explicit consent of the data subject; however, in such cases, the data subject has the right to human intervention on the part of the Company, to express his or her point of view, and to contest the decision.
h. Right to lodge a complaint with a supervisory authority: Data subjects have the right to lodge a complaint with the supervisory authority regarding the processing of their personal data by the Company. The supervisory authority for the Czech Republic is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7.

7. FINAL PROVISIONS
The Company has not appointed a Data Protection Officer.
The Company is entitled to unilaterally amend these principles of personal data protection and processing.
This Policy take effect on 01.10.2024.