GDPR

Notice to clients dated 1. 12. 2025 in the field of personal data protection

Dear client,

please allow us to inform you about how RESORT KOPŘIVNÁ a.s. (hereinafter referred to as “we” or “our company”) processes your personal data in connection with the performance of our business activities.

The purpose of this notice is to provide you with information, in particular, about what personal data we collect, how we handle it, from what sources we obtain it, for what purposes we use it, to whom we may provide it, where you can obtain information about your personal data and what your individual rights are in the field of personal data protection. When processing personal data, we follow generally binding legal regulations and personal data processing always takes place only to the extent given by the specific service and/or purpose of processing.

Please familiarize yourself with the content of this notice, and we will be happy to answer any questions you may have at our headquarters at Malá Morávka 122, 793 36 Malá Morávka, email osobniudaje@koprivna.cz and/or phone + 420 554 273 152.

Our Data Protection Officer, Ms. Ing. Jana Zimová, email: dpo@koprivna.cz, phone

+ 420 224 492 247, is also at your disposal.

I. General information

With regard to its business activities, our company is obliged to process some personal data, in particular for the purposes of fulfilling legal and contractual obligations. In this regard, we would not be able to provide you with our products/services at all without providing your personal data.

We also process your personal data beyond the scope of our obligations, namely for the purposes of caring for you and our other clients, so that we can further develop our business relationships and so that we can address you with a targeted offer of our products / services. To do this, we need to obtain your consent. With regard to the focus of our products / services, the age limit for granting valid consent to the processing of personal data will be respected without the consent of the legal representatives of the data subjects.

I.1. Principles of personal data processing

When processing your personal data, we honor and respect the highest possible standards of personal data protection and adhere in particular to the following principles:

(a) We always process your personal data for a clearly and comprehensibly specified purpose, by specified means, in a specified manner, and only for the period that is necessary in relation to the purposes of their processing; we process only accurate personal data of clients and we are assured that their processing corresponds to the specified purposes and is necessary for the fulfillment of these purposes;

(b) We protect your personal data as confidential information; therefore, we process clients’ personal data in a manner that ensures the highest possible security of such data and that prevents any unauthorized or accidental access to clients’ personal data, their alteration, destruction or loss, unauthorized transfers, their other unauthorized processing, as well as other misuse;

(c) we always inform you in a clear manner about the processing of your personal data and about your rights to accurate and complete information about the circumstances of this processing, as well as about your other related rights;

(d) in our company we have set up and maintain appropriate technical and organizational measures to ensure a level of security appropriate to all possible risks; all persons who come into contact with clients’ personal data are obliged to maintain confidentiality of information obtained in connection with the processing of such data.

II.

Information on the processing of personal data

II.1. Information about the controller

The controller of your personal data is us, i.e. RESORT KOPŘIVNÁ a.s., with its registered office at Malá Morávka 122, 793 36 Malá Morávka, Company ID: 268 64 924, registered in the Commercial Register kept by the Regional Court in Ostrava, file no. B 2908.

II.2. Purposes of processing and legal basis for processing

II.2.1. Processing of personal data without your consent

These are usually situations where you are obliged to provide us with certain personal data as a condition for us to provide you with our product/service, or where we are authorised to process your personal data obtained in another way.

(a) We are authorised by law to process your personal data without your consent for the following purposes of complying with our legal obligations, in particular:

(i) preventing damage to our company’s property;

(ii) prevention of fraudulent conduct to which our company may be exposed;

(iii) fulfillment of any obligation to identify and control the client pursuant to the Act on Certain Measures Against the Legalization of Proceeds from Crime and the Financing of Terrorism;

(iv) fulfillment of the identification obligation in relation to the client pursuant to the Act on the Residence of Foreigners;

(v) fulfillment of the identification obligation in relation to the client pursuant to the Act on Local Fees.

(b) Conclusion or performance of a contract with you.

This concerns in particular the actual implementation of a contractual relationship or other performance of a contract between our company and you. Personal data is necessary, among other things, to enable the contractual relationship to be implemented without unreasonable legal risks, including negotiations on the conclusion of a contract.

(i) protection of the rights and legally protected interests of our company, recovery of receivables, realization of collateral or other exercise of receivables, development and evolution of the services provided;

(ii) negotiations with interested parties regarding the assignment of our company’s receivables to the client or other form of transfer or transfer of receivables, including related realization, and other follow-up negotiations with third parties, in particular informing providers of related collateral, etc.;

(iii) resolution of all disputed agendas, in particular for the purposes of conducting legal or other disputes.

(d) Our legitimate interests. This applies in particular to situations where there is a contractual / customer relationship between you and our company.

II.2.2. Processing of personal data with your consent

These are situations where you voluntarily agree to us processing your personal data. Based on your consent, our company processes your personal data for the following purposes:

(a) customer care; these are activities that do not constitute the performance of a contract or other legal framework for the processing of personal data and which include the following activities:

(i) market research;

(ii) obtaining feedback on the controller’s products and services;

(iii) monitoring the behavior of clients on our company’s websites in connection with the services offered (this purpose therefore does not apply to merely obtaining information about the behavior of users visiting our company’s websites via cookies, which is described below in the article on electronic means of communication);

(b) offering products and services; this mainly concerns the dissemination of information, offering our company’s products and services, by various means (by post, electronic means including electronic mail and messages sent to mobile devices, by telephone call and via websites);

The provision of personal data for the purposes of caring for you is our contractual requirement and failure to provide it may result in the failure to conclude a contract or the failure to provide adequate care.

II.3. Scope of processed personal data of clients

Our company processes your personal data to the extent necessary to fulfill the above-mentioned purposes. We process contact data (contact addresses, telephone numbers, e-mail and fax addresses or other similar contact data) and identification data (name, surname, date of birth, permanent address, type, number and validity of the identity card; for a natural person client – entrepreneur also the ID and VAT number) and camera recordings.

II.4. Method of processing personal data

The method in which our company processes your personal data includes manual and automated processing in our company’s information systems and in physical form.

Your personal data is processed primarily by our company’s employees and, to the necessary extent, also by third parties. Before any transfer of your personal data to a third party, we will always conclude a written contract with this person, which contains the same guarantees for the processing of personal data as our company itself adheres to in accordance with its legal obligations.

II.5. Recipients of personal data

Your personal data of clients is made available in particular to our company’s employees in connection with the performance of their work duties, in which it is necessary to handle personal data of clients, but only to the extent that is necessary in each case and in compliance with all security measures.

In addition, your personal data is transferred to third parties who participate in the processing of personal data of our company’s clients, or these personal data may be made available to them for another reason in accordance with the law.

The transfer takes place in particular to:

(a) our law firm;

(b) our advisors; and

Before any transfer of your personal data to a third party, we will always conclude a written contract with this person, in which we will adjust the processing of personal data so that it contains the same guarantees for the processing of personal data that our company itself adheres to in accordance with its legal obligations.

II.7. Transfer of personal data abroad

Your personal data is processed in the Czech Republic and is not transferred to countries outside the European Union.

II.8. Duration of processing personal data

Our company processes personal data only for the period that is necessary for the purposes of their processing. We continuously assess whether there is still a need to process certain personal data for a specific purpose. If we find that they are no longer needed for any of the purposes for which they were processed, we will destroy the data. However, we have already internally evaluated the usual period of usability of personal data in relation to certain purposes of processing personal data, upon the expiry of which we particularly carefully assess the need to process the relevant personal data for the given purpose. In this context, it also applies that personal data processed for the purposes of:

Performance of the contract is processed for the duration of the contractual relationship with the client; furthermore, the relevant personal data

(b) we process the offering of products and services for the duration of the contractual relationship; furthermore, the relevant personal data is usually usable for a period of ten years;

(c) we process customer care for the duration of the contractual relationship with the client; furthermore, the relevant personal data is usually usable for a period of ten years;

(d) protection of rights and legally protected interests in the form of camera recordings; furthermore, the relevant personal data is usually usable for a period of thirty days;

(e) we process the offering of employment for a period of one year from the end of the procedure for selecting a new employee.

II.9. Right to withdraw consent

In this notice, we have explained to you the reasons why we need your personal data and that we may only process it for certain purposes with your consent. You are not obliged to grant our company your consent to the processing of your personal data and at the same time you are entitled to withdraw this consent. We would like to remind you that we are entitled to process some personal data for certain purposes without your consent. If you withdraw your consent in such a case, we will cease processing the relevant personal data for the purposes requiring the relevant consent, but we may be entitled, or even obliged, to continue to process the same personal data for other purposes (for example, we may still use your contact information to send service messages regarding your reservation, etc.).

If you wish to withdraw your consent to the processing of personal data, please contact us at our registered office at Malá Morávka 122, 793 36 Malá Morávka or by e-mail at osobniudaje@koprivna.cz.

II.10. Sources of personal data

We obtain personal data of clients in particular:

(a) from the clients themselves;

(b) from publicly available sources (public registers, records or lists);

(d) from our own activities, namely by processing and evaluating other personal data of clients;

(e) from camera recordings.

II.11. Your rights in connection with the processing of your personal data

You can exercise all your rights at our registered office at Malá Morávka 122, 793 36 Malá Morávka or by e-mail at osobniudaje@koprivna.cz, and you can also file a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).

II.11.1. The right to access means that you can at any time request our confirmation as to whether or not personal data concerning you are being processed, and if so, for what purposes, to what extent, to whom they are made available, how long we will process them, whether you have the right to rectification, erasure, restriction of processing or objection, where we obtained your personal data from and whether automated decision-making, including possible profiling, is taking place based on the processing of your personal data. You also have the right to obtain a copy of your personal data, the first provision being free of charge, and for subsequent provision we may then require reasonable compensation for administrative costs.

II.11.2. The right to rectification means that you can ask us at any time to correct or supplement your personal data if it is inaccurate or incomplete.

II.11.3. The right to erasure means that we must erase your personal data if (i) it is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) we are required to do so by law.

II.11.4. The right to restriction of processing means that until we have resolved any disputed issues regarding the processing of your personal data, we must restrict the processing of your personal data so that we can only store it and, where appropriate, use it for the purpose of establishing, exercising or defending legal claims.

II.11.5. The right to object means that you can object to the processing of your personal data that we process for direct marketing purposes or on the grounds of legitimate interest. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

III. Electronic means of communication

Our company uses numerous technologies in its business activities so that you have the most convenient access to us and our products/services. This applies in particular to services related to the use of the Internet and the use of social networks.

III.1. Social networks. You can contact us, among other things, via various social networks. We use these communication channels mainly as marketing tools; our products/services are not currently provided through them.

III.2. Cookies. When providing our products/services, we also use cookies, which are small text files that are stored on the user’s computer when our website is first loaded. These files help us to more easily identify the way visitors interact with the content of our website. This helps us to communicate more effectively with our website visitors and to target our marketing more effectively. You can delete cookies in your browser settings.

III.3. E-mail commercial communications

Based on your consent, we may send you commercial communications via e-mail, in particular information about our products, services, promotions and other marketing offers related to our business activities.

You hereby grant RESORT KOPŘIVNÁ a.s. consent to the use of your e-mail address for sending the above commercial communications in accordance with applicable legal regulations, in particular the Personal Data Protection Act and the GDPR.

IV. Final provisions

IV.1. This communication is issued for an indefinite period and comes into effect on 1 December 2025.

IV.2. We may change this communication at any time by issuing a new complete version; its current version is published on our company’s website and is also available at our headquarters.

IV.3. Unless expressly stated otherwise, all information provided here also applies to the processing of personal data of potential clients, i.e. persons with whom we have not yet established a contractual relationship but with whom we are already in contact. The information provided here also applies to the processing of personal data of other persons with whom our company is in direct contact, although we do not have a contractual relationship with them (e.g. representatives of legal entities).