PROTECTION OF CUSTOMER'S PERSONAL DATA

A.What personal data do we process?

If you use our services, we collect various types of data, such as your username and password, your contacts and other settings. If you make use of our services, we also work with your name and surname, the data about ordered services, the data about your parcels and with the data that you set in your account.

We process the following personal data:

1. identification data, which means especially the name and surname, username and password, Company ID and Tax Identification Number if you are an entrepreneur, and your function in the organization if you represent a legal entity;

2. contact data, which means the personal data enabling us to be in contact with you, especially your e-mail address, telephone number, delivery address, invoicing address and your social media contact and newsletter settings;

3. youre settings, which means the data in your account, especially saved addresses, newsletter settings, your evaluations of products and services and filled-in surveys;

4. data about ordered services, which means especially the data about transported parcels that you or your company has ordered from us, the method of payment including the account number, and data about complaints;

5. data about your website behaviour, including where you browse the website via our mobile application, especially the services that you display, the links that you click as well as the data about the device that you use to browse our website, such as the IP address and the derived location, identification of the device, its technical parameters such as the operating system and its version, the display resolution, the browser used and its version as well as the data obtained from cookies files and similar technologies for identification of the device;

6. derived data, which means the personal data derived from your settings, the data about the services that we provide you with or that you order from us, the data about your website behaviour;

7. data connected with using the call centre or visiting a branch, especially recorded phone calls with the call centre, identification of the messages that you send us, including the identifiers such as IP addresses, and recordings from our branches' camera systems.

B.Why do we process personal data and what entitles us to do so?

We process your personal data in various situations for various purposes. If you use our website, where we also make use of cookie files, we use your data especially to track the number of visits and to improve our services. If you sign up with us, we use your data for administration of your account and for provision of related functions. If you order a service from us, we use your data to handle your order, to protect our legal rights and meet our legal duties. Also, using your contacts and other data helps us to display and send our customized offers. We are entitled to process the personal data on the grounds of our preparing or performing the contract with you, meeting our legal duties, our legitimate interests, or on the grounds of your consent.

Within our activities, we process the personal data for various purposes and to various degrees, either:

1. without your consent, on the basis of our performance of the contract, of our legitimate interest or on the grounds of our meeting a legal duty; or

2. on the basis of your consent.

What kind of processing we may perform without your consent depends on the purpose that the processing in question aims to achieve and what your position towards us is: whether you are merely a visitor of our website, or you have signed up with us or ordered a service from us. We can also process your data if we have received an order to transport a parcel where you are its addressee, if you communicate with us or if you visit our branch.

B.1.If you visit our website

B.1.1. Using cookie files and other technologies

Information about using cookies and other technologies by the company Allegro Retail a.s. and about the transfer of personal data to advertising and social media is available in the Cookie Policy.

B.2.If you use our mobile application

Where you use our application, we process your personal data in the ways, to the extent and for the purposes stated in the following text:

1. If you sign up with us

   If you use our mobile application, you need to sign up with us, in which case we perform the following processings:

   1. Processing on the basis of contract performance

      If you create an account for using the WE|DO mobile application, we process your identification and contact data, your settings and data about ordered services (if you order them from us or if you are a parcel addressee), on the basis of our performing the contract with you (without your consent), in order to be able to administer your user account. The contract on which our processing relies is established by the creation of your account. For that purpose, we use the personal data for the period of existence of your account, which you can delete anytime.

   2. Processing on the basis of legitimate interest

      If you create an account for using the WE|DO mobile application, we also process your identification and contact data, your settings and data about ordered services (if you order them from us or if you are a parcel addressee) and your website behaviour data on the basis of our legitimate interest (i.e. without your consent), for the following purpose:

      • obtaining information enabling us, in the future, to improve our services for you, in order to make your shopping with us even better, especially ascertaining your satisfaction with our services, with our legitimate interest being the improvement of our services for you; and

      • providing customized offers and targeted advertisement that we can send by e-mail, push notifications via the application or a text message or using social media, or that we can communicate by telephone or other electronic devices, send them by post or display them on our website or in our mobile application, with our legitimate interest being efficient promotion of our products and services.

      In order to tailor the offer for you, we will analyze the aforementioned data and use it to obtain other derived data that we use for that purpose (unless you turn offthat option in your mobile application settings or your phone settings). Using that data, we also categorize our users into various groups, with each group receiving their own specific offer. You can turn offthat function anytime in your application settings or in your mobile phone settings.

      On the basis of our legitimate interest (i.e. without your consent), we will also use your settings for testing new functions and applications before launch, as described in the If you visit our website section. For those purposes, we use the personal data for the period of existence of your account, which you can delete anytime. You are entitled to raise an objection against those processings.

   3. Processing on the basis of your consent

      If you give us your consent when using our mobile application, we will use the application to display advertising messages for you, proceeding as described in the If you visit our website section. You can revoke your consent anytime in your mobile application settings or your phone settings.

      When using our mobile application, if you wish to display your nearest pick-up points or boxes, we will display them for you on the basis of the location derived from your IP address, as described in the If you visit our website section. If you give us your consent when using our mobile application or in your phone settings, we will use the location information acquired from your phone for exact location of your nearest pick-up points or boxes. Depending on your mobile application settings and your phone settings, this is either one-off or continuous data use. You can change the settings in your mobile application or in your phone settings anytime.

B.3.If you order a parcel transport from us

If you order a parcel transport from us, we perform the following processings:

1. Processing on the basis of contract performance

   If you order a parcel transport from us as an individual, we process, for the purpose of transporting and tracking the parcel, your identification and contact data and data about your orders.

   If you order a parcel transport from us as a representative of a legal entity, we process, for the purpose of delivering our services, your identification and contact data and the data about your ordered services; we do so on the basis of our legitimate interest consisting in the conclusion and performance of the contract with the entity that you represent.

   Our using the data for the purpose of handling your order means that we use it especially:

   • to be able to communicate with you about the transported parcel, e.g. to send you its confirmation;

   • for the purpose of the payment for the transport;

   • for the purpose of performing the service; in this connection, we may also transfer your data to our other transport and insurance partners, as described in the “Who processes your personal data and who do we transfer the data to?”section;

   • in connection with a complaint about the transport;

   • in connection with your other requests that you contact us about, e.g. via our call centre.

For that purpose, we use the personal data for the period of the transport of the parcel in question.

1. Processing on the basis of legitimate interest

   If you order a parcel transport from us, we will keep your identification and contact data and the data about ordered services on the basis of our legitimate interest (without your consent) for the purpose of protecting legal rights and of our internal records and control, with our legitimate interests being the protection of legal rights and controlling due provision of our services.

   For the purpose of protecting legal rights and of our internal records and control, we process your data for the limitation period of 3 years and for 1 year following its lapse with respect to the claims made at the end of the limitation period. Should legal, administrative or other proceedings be initiated, we process your personal data to the necessary degree for the entire period of such proceedings and for the rest of the limitation period remaining after their conclusion.

   Further, we process, on the basis of our legitimate interest (i.e. without your consent), your identification and contact data and the data about ordered services, for the purpose of sending e-mail offers, with our legitimate interest being promotion of our products and services. For that purpose, we use the personal data for the period of 6 months.

   You are entitled to raise an objection against those processings performed on the basis of our legitimate interest.

2. Processing on the basis of meeting legal duties

   We, too, are obliged to meet certain statutory duties. If we process your personal data on those very grounds, we are not obliged to obtain your consent for such a processing. On that legal basis, we process your identification and contact data and the data about ordered services, on the grounds of abiding especially by the following acts:

   • Act No. 89/2012 Sb., Civil Code,

   • Act No. 29/2000 Sb., on Postal Services,

   • Act No. 634/1992 Sb., on Protection of Consumer (where you order the transport as an individual),

   • Act No. 235/2004 Sb., on Value Added Tax,

   • Act No. 563/1991 Sb., on Accounting.

   For those purposes, we use the personal data for the period of no more than 10 years following the issue of the last document related to the service ordered by you.

C.If you or your company sign up with us or conclude a contract with us

In order for you to sign up, you need to visit our website. Consequently, the processings described in the “If you visit our website” section apply to you.

If you or your company sign up with us or conclude a contract with us on provision of services, we perform the following processings:

1. Processing on the basis of contract performance

   If you sign up with us, we process your identification and contact data, your settings and the data about your orders (if you later order transport from us), on the basis of performing the contract with you (without your consent), in order to be able to administer your client account. For that purpose, we use the personal data for the period of your being signed up with us.

   If you sign up as a representative of a legal entity, we process the same data for the same purpose, on the basis of our legitimate interest consisting in the conclusion and performance of the contract with the entity that you represent.

2. Processing on the basis of legitimate interest

   If you sign up with us, we process your identification and contact data, your settings, and the data about your orders (if you later order transport from us) and the data about your website behaviour also on the basis of our legitimate interest (i.e. without your consent), for the purpose of:

   • obtaining the information enabling us, in the future, to improve our services for you, especially ascertaining your satisfaction with our services, with our legitimate interest being the improvement of our services for you; and

   • providing offers that we can send by e-mail or a text message or using social media, that we can communicate by telephone or other electronic devices, send them by post or display them on our website, with our legitimate interest being efficient promotion of our products and services.

   For that purpose, we use the personal data for the period of your being signed up with us, and 1 year thereafter.

   You are entitled to raise an objection against that processing based on the legitimate interest.

C.2.If we have received an order to transport a parcel where you are its addressee

If we have received an order of a service and you are its addressee, we process your identification and contact data:

• on the basis or our legitimate interest, for the purpose of preparing, concluding and performing the contract with our customer, with the performance of that contract also being our legitimate interest;

• on the basis of our legitimate interest, for the purpose of transporting and tracking the parcel, with our legitimate interest being the performance of the contract with the party ordering the transport;

• on the basis of our legitimate interest, for obtaining the information enabling us, in the future, to improve our services, or information for producing our internal statistics and overviews, with our legitimate interest being the improvement of our services for our customers;

• for the purpose of meeting the legal duties especially as per the Act No. 235/2004 Sb., on Value Added Tax, and the Act No. 563/1991 Sb., on Accounting;

• the Act No. 29/2000 Sb., on Postal Services;

• for the purpose of protecting legal rights and of our internal records and control, with our legitimate interests being the protection of legal rights and controlling due provision of our services.

For preparing, concluding and performing the contract with our customer, we use your personal data for the period needed for handling the order. Upon lapse of that period, we keep the data on the basis of our legitimate interest for the purpose of protecting legal rights and of our internal records and control, for the limitation period of 3 years and for 1 year following its lapse with respect to the claims made at the end of the limitation period. Should legal, administrative or other proceedings be initiated, we process your personal data to the necessary degree for the entire period of such proceedings and for the rest of the limitation period remaining after their conclusion, with our legitimate interests being the protection of legal rights and controlling due provision of our services. For the purpose of meeting legal duties, we use the personal data for the period of no more than 10 years following the issue of the last document related to the performance of the contract, concerning your parcel, with our customer.

You are entitled to raise an objection against that processing based on the legitimate interest.

C.3.If you have joined the WE|DO Partner Pick-up and Drop-off Network

If you join, as an individual, our Partner Pick-up and Drop-off Network, we process your personal data for the purpose of transporting and tracking the parcel, your identification and contact data and the data about the ordered services that you attend to for the purposes of accepting, transporting and issuing parcels and for the purposes of performance of the contract concluded with you.

If you sign up into the Partner Pick-up and Drop-off Network as a representative of a legal entity, we process the same data for the same purposes, on the basis of our legitimate interest consisting in the conclusion and performance of the contract with the entity that you represent.

Our using the data for the purpose of providing services to our customers means that we will use it especially:

• to be able to communicate with you about the transported parcels;

• to display the parcel status information to the sender and to the addressee;

• for the purposes of charging our services;

• in connection with complaints about the transport and services;

• in connection with your other requests that you contact us about, e.g. via our call centre.

For that purpose, we use the personal data for the period of your being signed up in the WE|DO Partner Pick-up and Drop-off Network.

1. Processing on the basis of legitimate interest

   If you sign up into the WE|DO Partner Pick-up and Drop-off Network, we will keep your identification and contact data and the data about the ordered services that you attend to also on the basis of our legitimate interest (without your consent) for the purpose of protecting legal rights and of our internal records and control, with our legitimate interests being the protection of legal rights and controlling due provision of our services.

   For the purpose of protecting legal rights and of our internal records and control, we process your data for the limitation period of 3 years and for 1 year following its lapse with respect to the claims made at the end of the limitation period. Should legal, administrative or other proceedings be initiated, we process your personal data to the necessary degree for the entire period of such proceedings and for the rest of the limitation period remaining after their conclusion.

   Further, we process, on the basis of our legitimate interest (i.e. without your consent), your identification and contact data and the data about the orders that you attend to, for the purpose of sending e-mail offers, with our legitimate interest being information about new products and services. For that purpose, we use the personal data for the period of our cooperation.

   You are entitled to raise an objection against those processings performed on the basis of our legitimate interest.

2. Processing on the basis of meeting legal duties

   We, too, are obliged to meet certain statutory duties. If we process your personal data on those very grounds, we are not obliged to obtain your consent for such a processing. On that legal basis, we process your identification and contact data and the data about the ordered services that you attend to, on the grounds of abiding especially by the following acts:

   • Act No. 89/2012 Sb., the Civil Code,

   • Act No. 634/1992 Sb., on Protection of Consumer (where you order the transport as an individual),

   • Act No. 235/2004 Sb., on Value Added Tax,

   • Act No. 563/1991 Sb., on Accounting,

   • Act No. 29/2000 Sb., on Postal Services.

   For those purposes, we use the personal data for the period of up to 10 years following the issue of the last document related to the cooperation.

C.4.If you communicate with us using various channels

If you communicate with us using various channels, especially via our call centre, e-mail, chat tools and social media, we will process your identification and contact data and records of the existing communication including call recordings on the basis of our legitimate interest (i.e. without your consent) for the purpose of:

• handling your requests; if you have ordered our services from us and your request is related to the order, we can carry out that processing on the basis of performing the contract with you;

• processing your requests; if you are the parcel addressee and your request is related to the parcel, we can carry out that processing on the basis of legitimate interest;

• registering your requests in order to be able to check whether we meet them duly and timely;

• proving that we have accepted and handled your request, e.g. where you file a complaint with us;

• analyzing them for the purpose of improving the quality of our services.

For the purposes related to providing services, we can keep the data for protection of legal rights for the limitation period of 3 years and for 1 year following its lapse with respect to the claims made at the end of the limitation period. Should legal, administrative or other proceedings be initiated, we process your personal data to the necessary degree for the entire period of such proceedings and for the rest of the limitation period remaining after their conclusion. For the purpose of analyzing so as to improve the quality of our services, we keep the personal data for the period of 6 months.

You are entitled to raise an objection against the processing based on our legitimate interest.

D.Who processes your personal data and who do we transfer the data to?

In most cases, we process your data for our own purposes as its administrator. In that case, we transfer your data to our partners for the purpose of securing payment, parcel pick-up and transport and other requisites of your order. We also transfer your data to our processors, who process it according to our instructions. With your consent, we may also transfer the data to advertising networks and social media for the purpose of displaying customized advertisement on other websites.

All aforementioned personal data is processed by us as an administrator, which means that we establish the purposes, as defined above, for which we collect your personal data, determine the means of processings and are responsible for their due execution.

We may also transfer your personal data to other entities in administrator roles:

• to our partners where you are the addressee of a service for which we have received an order and the partners are involved in its performance, as described in the “If we have received an order to transport a parcel where you are its addressee” section, specifically:

  • to the partners securing transport of parcels, such as:

    Direct Parcel Distribution CZ s. r. o., Company ID: 613 29 266;

    První novinová společnost a.s., Company ID: 457 95 533;

    Raben Logistics Czech s.r.o., Company ID: 247 05 128;

    Česká pošta, s.p., Company ID: 471 14 983;

    Direct Parcel Distribution SK s. r. o., registered office at Technicka 7, 821 04 Bratislava, Slovakia;

    Slovenska posta, a.s., registered office at Partizanska cesta 9, 975 99 Banska Bystrica, Slovakia;

    WE|DO SK s.r.o., registered office at Galvaniho 6, 821 04, Bratislava, Slovakia;

    CEVA Logistics Slovakia, s.r.o., egistered office at Na Pántoch 18, 831 06 Bratislava;

    IN TIME, s.r.o., registered office at Senecka cesta 1, 900 28 Ivanka pri Dunaji, Slovakia;

    and other partners listed at our company's website.

  • to the partners securing insurance services for handling insurance events, such as:

    RENOMIA, a.s., Company ID: 483 91 301.

• on the basis of your consent, to advertising and social media, as described in the Cookie Policy

For the purpose of processing personal data, we also use services by other processors, who process the personal data solely according to our instructions and for the purposes described in the Why do we process the personal data and what entitles us to do so? section. The processors are:

1. our partners securing operation;

2. providers of cloud services and other providers of technologies and support, such as Google Ireland Limited, registered seat at Gordon House, 4 Barrow St., Dublin, Ireland, within the Google Workspace and Google Analytics services; https://policies.google.com/privacy;

3. providers of Customer Relationship Management systems such as RAYNET s.r.o., Company ID: 268 43 820, https://raynet.cz/zasady-zpracovani-osobnich-udaju/;

4. marketing tools operators, such as The Rocket Science Group LLC, registered office at 675 Ponce De Leon Ave NE Ste 5000, Atlanta, GA, 30308-2172, the United States of America, within the Mailchimp service, or Imper CZ s.r.o., Company ID: 285 47 888, within the Leady service; https://imper.cz/ochrana-osobnich-udaju/;

5. providers of SMS and communication tools, such as O2 Czech Republic a.s., Company ID: 601 93 336, T-Mobile Czech Republic a.s., Company ID: 649 49 681, and Vodafone Czech Republic a.s., Company ID: 257 88 001, where they process the personal data to arrange our communication with you.

E.What sources do we obtain personal data from?

Mostly, we obtain personal data directly from you via our website or when communicating with you. We may also obtain some other data from our partners, e.g. from banks or transport companies.

In most cases, we process the personal data that you provide to us within ordering services or when communicating with us. If you are the addressee of a parcel that we transport, we obtain your data from the party that ordered the transport. We also obtain personal data directly from you by tracking your behaviour on our website.

If you order a service from us, we may, in connection with performing a concluded contract, receive additional data about your orders from banks, our partners operating payment systems, securing instalment sales, transport partners and our pick-up points partners, e.g. the data about your account number, successful payment or delivery and takeover of goods.

F.Transferring data outside the EU

In some cases, we may also transfer your personal data to the countries that are not part of the European Economic Area.

Within transferring data to our processors, as listed in the “Who processes your personal data and who do we transfer the data to?” section, we may also transfer your data to third countries outside the European Economic Area, ones that do not ensure the corresponding degree of personal data protection. We will carry out any such transfers only where the processor in question agrees to comply with the standard contract clauses issued by the European Commission and available at: https://eur-lex.europa.eu/legal-content/CS/TXT/?uri=CELEX%3A32021D0914

G.What rights do you have when your personal data is processed?

You have a lot of rights in relation to your personal data, namely the right of access, right of correction, right to erasure, right to limitation of processing, right to raise an objection and right to lodge a complaint. Just like we have our rights and obligations when processing your personal data, you have certain rights when your personal data is processed. Your rights include:

Right of Access

Simply put, you have the right to know which data about you we process, for what purpose, for how long, where we obtain your personal data, who we transfer it to, who processes it apart from us and what your other rights related to the processing of your personal data are. You can learn all that from this “Protection of Customers' Personal Data” document. If, however, you are not certain as to which of your personal data we process, you can request our confirmation as to whether the personal data related to you is processed by us or not, and where this is the case, you have the right to gain access to that personal data. The right of access entitles you to request from us a copy of the processed personal data, the first copy being free of charge and the following ones subject to a charge.

Right of Correction

To err is human. If you learn that the personal data that we process about you is imprecise or incomplete, you have the right to our correcting or completing it without undue delay.

Right to Erasure

In certain cases, you have the right to our erasing your personal data. We will erase your personal data without undue delay where any of the following reasons applies:

• we do not need your personal data anymore for the purposes for which we have been processing it;

• you revoke your consent with the processing of personal data; the data in question must be such for the processing of which your consent is necessary and, also, we have no other reason for which we need to continue processing the data;

• you exercise your right to raise an objection against the processing (see below the “Right to Raise Objection Against Processing” section), where the personal data in question is the data that we process on the basis of our legitimate interests and where we find that we do not have any such legitimate interests anymore which would justify the processing; or

• you believe that our processing of personal data has ceased to comply with the generally binding regulations.

However, please bear in mind that even where one of these reasons applies, this does not mean that we will erase all your personal data immediately, as that right is not to apply where the processing of your personal data is still necessary for meeting our legal duty or for determining, exercising or defending our legal rights (see the “Why do we process the personal data and what entitles us to do so?” section).

Right to Limitation of Processing

Apart from the right to erasure, in some cases you can also make use of the right to the limitation of the processing of personal data. In certain cases, this right entitles you to request that your personal data be marked and that the data not be subject to any other processing operations - in this case, however, not forever (as is the case of the right to erasure) but for a limited period of time. We are obliged to limit the processing of personal data where:

• you deny that the personal data is precise, until we agree as to which data is correct;

• we process your personal data without a sufficient legal basis (e.g. beyond the scope of what we have to process) but you prefer solely limiting such data to erasing it (e.g. where you expect to provide us with such data in the future anyway);

• we do not need your personal data anymore for the aforementioned purposes of processing but you require the data for determining, exercising or defending your legal rights; or

• you raise an objection against the processing. The right to objection is described in greater detail in the “Right to Raise Objection Against Processing” chapter below. Before we ascertain whether your objection is justified, we are obliged to limit the processing of your personal data.

Right to Portability

You have the right to obtain all your personal data from us that you have provided to us yourself and that we have been processing with your consent (see the “If you grant us your consent” section) and within performance of the contract. We will provide you with your personal data in a structured, commonly used and machine-readable format. In order for us to be able to transfer, upon your request, the data easily, it can only include the data that we process in an automated manner in our electronic databases.

Right to Raise Objection Against Processing

You have the right to raise an objection against the processing of personal data pursed on the basis of our legitimate interest (see the “Why do we process the personal data and what entitles us to do so?”) section. Where marketing activities are concerned, we will cease to process your personal data automatically; in other cases, we will do so unless we have serious legitimate reasons to proceed in such processing.

Right to Make Complaint

Exercising the rights above as stated above affects in no way your right to make a complaint to the relevant supervisory authority. The right may be exercised especially where you believe that we have been processing your personal data without justification or contrary to the generally binding legal regulations. The complaint against our processing of personal data can be made to Urad pro ochranu osobni'ch udaju (Office for Personal Data Protection), registered office at Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.

H.How can the individual rights be exercised?

In all matters related to the processing of your personal data, be it a query, exercising a right, making a complaint or anything else, you can contact our Customer Care Centre at info@wedo.cz.

Alternatively, you can also send your request using the company's databox, or in writing to the company's registered office. In that event, however, your request must be appended with a certified signature.

Your request will be handled without undue delay, within one month at the latest. In exceptional cases, especially where your request is a complicated one, we are entitled to extend the deadline by two more months. In such a case, you will be of course informed of such an extension and its reasons.

I.Personal Data Protection Officer

Apart from the Customer Care Centre, you can, in all matters related to the processing of your personal data, use the services of our Personal Data Protection Officer. You can contact the Officer at dpo@wedo.cz.