Personal Data Protection

Molecular HydroGEN Investment Group a.s.
Headquarters: Muglinovská 154/73, Muglinov, 712 00 Ostrava, ID: 09389539
Registered in the Commercial Register maintained by the Regional Court in Ostrava, B 11237
Email address: gabriela.marsalkova@h2global.group, data box: 7rsntfc, www.h2world.world,
Phone: 777 724 726 hereinafter referred to as the "controller"
Contact person for all matters concerning the processing of personal data:
Ing. Gabriela Maršálková, phone: 777 724 726, email: gabriela.marsalkova@h2global.group

The controller of personal data, i.e., the company Molecular HydroGEN Investment Group a.s., hereby informs data subjects (all individuals whose personal data it processes) that the personal data provided to it or obtained in connection with its business activities are processed in accordance with applicable legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR, hereinafter referred to as the GDPR Regulation), as well as Act No. 110/2019 Coll., on the Processing of Personal Data, as amended. We are part of the H2 group, whose members are: here

BASIC TERMS:

"Personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"Special categories of personal data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation; "Data subject" means a natural person to whom personal data relate (e.g., employees, customers, members of the controller's governing bodies, representatives of suppliers, recipients, etc.);

"Processing" means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction (this is not an exhaustive list);

"Further processing" means processing personal data for a purpose other than that for which the personal data were originally collected, e.g., further processing of publicly available data (public data from the land registry, originally collected for the purpose of maintaining land registry records, etc.); "Controller" means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller; under certain conditions, the controller may also act as a processor, or it may be, for example, an entity that provides accounting, IT services, etc., for the controller;

We inform you that we mainly process the following categories of personal data:

Ordinary data:
- Address and identification data used to identify you as a data subject and fulfill the contract (especially name, surname, permanent residence address, ID number, tax identification number, date of birth) and data enabling contact with you (phone number, email address)
- Descriptive data and banking details (bank account details for financial transactions)
- Portraits and behavior records (e.g., within CCTV systems at premises or during recordings of events organized by the controller)
- Other data necessary to fulfill the purpose

Special categories of personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health or a natural person's sex life or sexual orientation) are not processed by the controller for its customers, investors, or contractual partners. If special categories of data are processed, it is only to the extent strictly necessary, always based on a legitimate legal title, and typically for employees of the controller, e.g., in the case of a work-related injury or based on explicit consent.

Personal data are obtained directly from you (e.g., during contract negotiations, through personal meetings, emails, phone calls, chats, websites – e-shops, business cards, web forms, etc.). Alternatively, we may use publicly accessible registers, lists, and records (e.g., commercial register, trade register, land registry, public phone directory, etc.) to obtain certain data.

LEGAL GROUNDS FOR PROCESSING

Personal data can only be processed by the controller based on existing legal grounds.

Therefore, we process personal data based on the necessity for contract fulfillment, compliance with legal obligations, or legitimate interest.

For customers, investors, and contractual partners, personal data are processed because it is necessary for the performance of the contract (purchase of products and services, investment purchases) and, in some cases, based on the legitimate interest of us as controllers.

For employees, personal data are mainly processed due to the necessity of fulfilling the employment contract and legal obligations of the employer.

For representatives of corporations and statutory bodies of corporations or their employees (authorized representatives), personal data are processed to comply with the legal obligation to identify the person acting on behalf of the contracting party.

Some data are processed based on legitimate interest; however, if processing occurs for this reason (e.g., CCTV system at premises or visual and audio recordings from events), we always carefully assess and balance whether processing is truly necessary and whether the legal prerequisites are met (legitimacy is assessed before processing via so-called balance tests). The legitimate interest of the controller in operating a CCTV system is to ensure the protection of individuals' health and property.

Processing personal data of job applicants is carried out for the purpose of negotiating an employment contract or some agreements for work performed outside the employment relationship as part of the selection process. After its conclusion, data are kept for one year for record-keeping purposes and any repeated interest from the job applicant. The controller processes identification and contact data of job applicants to the extent voluntarily provided to the controller by the applicant.

PROCESSING WITH CONSENT FOR PERSONAL DATA PROCESSING

If you provide us with consent to process your personal data, whether for sending commercial communications, enabling the collection of cookies, or other purposes: We inform you that you can withdraw your consent at any time by contacting us through the details provided in this document.

Cookies are small data files stored on the buyer's device (mobile, notebook, PC, etc.) when using the controller's website. In some cases, cookies are essential; otherwise, the website would not function properly – these cookies cannot be restricted. If the buyer disagrees with the storage of essential cookies, they must leave the website (e-shop). The storage of other cookies (advertising, analytics, etc.) is optional, and the buyer can save their own cookie settings on their device. The buyer can change their cookie settings at any time through our website.

In case you provide consent for sending commercial communications, the purpose of this consent is to use your personal data, especially contact details (email address, phone number), to send commercial and marketing offers for all goods and services we provide. Granting consent is voluntary, and we do not make it conditional on anything. We inform you that you can change this consent at any time, and the sent commercial communications fully comply with the conditions for sending such communications under Act No. 480/2004 Coll., as amended. Consent can also be given concerning other members of the H2 group.

PURPOSE OF PROCESSING

The purpose of processing personal data is primarily to fulfill contractual obligations under a concluded contract or based on your order, or in connection with negotiations for concluding a contract – meaning personal data are processed so that we can conclude and then fulfill a contract (whether it is a purchase contract for goods delivery, an online purchase, service provision, or another agreement). Even when you participate in an event organized by us, by purchasing a ticket and attending the event, you conclude a contract with us.

Additionally, the purpose of processing includes actions related to or arising from fulfilling the contract, such as ensuring financial transactions, handling complaints, improving customer relationships, enhancing service quality, defending against potential claims, and, where consent is provided, processing and sending commercial communications.

As part of the H2 group, we strive to provide you with the best services possible, so processing may also be performed to improve our services (statistics, research, innovation, collaboration with other group members).

If a buyer creates a user account with the seller, the buyer acknowledges that their personal data will also be processed for the purpose of maintaining this account.

For employees, the primary purpose is also to fulfill the employment contract entered into by the employer and to comply with legal obligations concerning employees. When using CCTV recordings, the main purpose is to ensure the safety of individuals and the property of the controller. Data subjects are informed of the CCTV system with pictograms wherever it is placed.

When taking photos and visual recordings of events organized by us (e.g., training sessions, conferences, etc.), the main purpose is to ensure the safety of individuals, the property of the controller, third-party property, and the controller’s interest in documenting the event and subsequently promoting its entity, services, and goods. Data subjects are always informed in advance that photos and visual recordings are being taken and have the option to decide whether or not to participate in such events.

The purpose of processing may also include purposes stated in the consent provided by the data subject.

Personal data are processed by the controller to the extent that the respective data subject has provided to the controller, in connection with the conclusion of a contractual or other legal relationship with the controller, or to the extent that the controller has obtained to fulfill its obligations.

Additional purposes of processing may include:
- Meeting your requests
- Managing and improving the business model and relationships with customers and contractual partners
- Market research, statistics

RECIPIENTS OF PERSONAL DATA

We may pass your personal data to the RECIPIENTS of personal data, who may include, in accordance with the purpose for which the data are processed: subcontractors of services (e.g., post office), public authorities (e.g., courts, administrative bodies, offices), insurance companies, banks and payment intermediaries, or other processors of personal data – providers of IT system maintenance, external accountants, external transporters, etc.

If the relationship between any of our partners and us is assessed as joint controllership, we ensure that all conditions of data protection regulations are met with respect to you. You can always contact us as if it were a standalone controllership.

Within the H2 group, other group members may also be recipients due to the legitimate interest of the controller. Members of the group: here

RETENTION PERIOD

We retain personal data for the period necessary to fulfill legal obligations, in compliance with statutory time limits for shredding and archiving, or for reasons of the legitimate interest of the controller.

Personal data is always processed for the period necessary to ensure the rights and obligations arising from contractual relationships and applicable legal regulations or to fulfill the purposes of granted consents.

In cases where personal data is retained after the fulfillment of a contract, the data is stored based on the legitimate interest of the controller in protecting its property and interests, for the duration of statutory limitation periods as defined by law for asserting rights (especially for liability for defects in services or products or provided guarantees).

METHODS OF PROCESSING

We process personal data either ourselves or through a processor. Processing is carried out at our headquarters or operational sites by individual employees or processors. If personal data is transferred to other entities (processors) based on a valid legal basis, we have signed written contracts with them. Processing is primarily conducted through computing technology or manually in the case of paper-based personal data, adhering to all security principles for managing and processing personal data.

For protection purposes, we have implemented technical and organizational measures to ensure the protection of personal data, specifically measures to prevent unauthorized or accidental access to personal data, its alteration, destruction, or loss, unauthorized transmission, unauthorized processing, or other misuse. All entities that may have access to personal data respect your right to privacy and are required to comply with applicable legal regulations regarding personal data protection.

We hereby inform you that the controller does not engage in automated decision-making or profiling when processing personal data. Personal data is also not transferred to third countries.

Automated decision-making refers to decisions made by technological means or based on the results of technological processes without human involvement or discretion.

Profiling refers to the use of personal data to assess certain personal aspects of a person, such as estimating their work performance, economic situation, health status, personal preferences, interests, etc.

If you do not provide us with your personal contact and identification data during contract negotiations, the contract cannot be concluded as we would be unable to fulfill it. Providing your contact and identification data is therefore both a legal requirement for identifying the contractual party and a contractual requirement necessary for fulfilling the contract.

In the case of personal data processing through the operation of a camera system, you are not required to provide personal data (such as likeness and appearance records). At the entrance to monitored areas, all persons are informed that the premises are under camera surveillance. If you do not agree with this, you may choose not to enter the premises.

Regarding employees, providing personal data is a legal requirement, as the controller fulfills many statutory obligations concerning employees and also concludes an employment contract with them. If the data is not provided, the employment contract cannot be concluded.

DATA SUBJECT RIGHTS:

We hereby inform you of your rights:
As a data subject (customers, employees, and others), you have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and if so, to access that personal data.

You have the right to information about:
• the purpose of processing
• the categories of personal data concerned
• the recipients or categories of recipients to whom the personal data has been or will be disclosed
• the planned retention period for the personal data
• all available information about the source of the personal data if not obtained from the data subject
• whether automated decision-making, including profiling, is taking place.

You have the right to a copy of the processed personal data.

You also have the right to be informed. Incomplete or inaccurate personal data can be supplemented or corrected if the processed data is inaccurate or incomplete.

Under legal conditions, you have the right to have personal data deleted if:
a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) the data subject withdraws consent on which the processing was based, and there is no other legal basis for processing;
c) the data subject raises a relevant objection to the processing;
d) the personal data was unlawfully processed;
e) the personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the controller;
f) the personal data was collected in relation to the offer of information society services under Article 8(1) of the GDPR.

You have the right to have the processing of your personal data restricted in certain cases specified in Article 18 of the GDPR. The data subject has the right to have the controller restrict processing in any of the following cases:
a) the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
c) the controller no longer needs the personal data for processing purposes, but the data subject requires it for the establishment, exercise, or defense of legal claims;
d) the data subject has objected to processing pending verification of whether the controller’s legitimate grounds override those of the data subject.

You have the right to object to processing based on our legitimate interests or those of a third party. If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling related to direct marketing. If an objection to processing for direct marketing purposes is raised, personal data can no longer be processed for these purposes.

The right to data portability allows you to obtain the personal data we have collected in a standard and machine-readable format. You can then transfer this data to another controller, or, where technically feasible, request that we transfer it ourselves. You also have the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you (except for specified exceptions under GDPR).

If the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. You also have the right to lodge a complaint with the Office for Personal Data Protection. However, we are fully available to you and believe that a complaint will not be necessary.

Exercising rights, requests for information:
If you require any information regarding the processing of your personal data, you may primarily contact us at:

email: gabriela.marsalkova@h2global.group
or in writing at the address Muglinovská 154/73, Muglinov, 712 00 Ostrava

Feel free to contact us; we will address your request promptly.

Molecular HydroGEN Investment Group a.s.
Version 1.2024