PRIVACY POLICY

1. INTRODUCTORY PROVISIONS
   
   1.1. Commence, s.r.o., ID No. 28501926, with its seat at Mojmírova 1364/9, Nusle, 140 00 Prague 4, entered in the Commercial Register kept by the Prague Municipal Court in Section C, File No. 146249 (the "Operator") operates a website to present, promote, and offer its products and services (the "Platform") at the URL commence.cz and in its capacity as the data controller will process your personal data, subject to the terms set out below.
   
   1.2. The protection of your personal data is of fundamental interest to the Operator. Your personal data will be processed in accordance with the applicable laws and regulations, i.e., in particular, Regulation (EU) 2016/679 of the European Parliament and the Council, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), Act No. 110/2019 Coll., on the processing of personal data, as amended (the "Data Protection Act"), and Act No. 480/2004 Coll., on certain information society services, as amended (the "Information Society Act").
   
   
2. CATEGORIES OF PERSONAL DATA AND THEIR PROCESSING
   
   2.1.Within the meaning of GDPR and the Data Protection Act, personal data is any information relating to an identified or identifiable natural person such as their name, place of residence, e-mail address, phone number, driving license number, number of their personal ID (identity card, passport), IP address, billing or payment data.
   
   2.2. Personal data of business partners – suppliers. In the case of (both prospective and actual) business partners, the Operator will process the personal data made available in connection with the negotiation and subsequent implementation of the mutual partnership. This will include in particular the following personal data: (i) first and last name (of self-employed service providers and, in the case of legal entities, of the contact person or of the person authorized to act on the legal entity’s behalf with respect to the given contractual relationship); (ii) billing data (place of business, company registration number, VAT ID No., bank account number); (iii) contact details (e-mail address, phone number); (iv) information recorded in the contract with the business partner; (v) data on the on-going performances rendered, including amounts invoiced and paid, communication with the business partner or, as it were, their contact persons.
   
   2.3. The personal data of business partners is being processed for the purpose of (i) precontractual negotiations and the discharge of Operator’s obligations under the agreement with the business partner, including the recovery of receivables, remedies for defects, complaints management and the handling of enquiries and requests, within the meaning of Art. 6 (1) (b) GDPR; (ii) Operator’s compliance with its legal obligations e.g. in the realm of accounting, advertising regulations, the prevention of crime, etc., within the meaning of Art. 6 (1) (c) GDPR; (iii) the protection of the legitimate interests pursued by the Operator or by a third party, including the keeping of records and the discharge of administrative tasks within the meaning of Art. 6 (1) (f) GDPR. We do not require your special consent as a business partner to engage in this type of processing.
   
   2.4. Personal data of clients. In the case of prospective and actual clients, the Operator will process the personal data made available in connection with the negotiation and subsequent implementation of the services ordered (car leasing or car rental). This will include in particular the following personal data: (i) first and last name (of self-employed service providers and, in the case of legal entities, of the contact person or of the person authorized to act on the legal entity’s behalf with respect to the given contractual relationship); (ii) billing data (place of business, company registration number, VAT ID No., bank account number); (iii) contact details (e-mail address, phone number, personal ID number (identity card, passport)); (iv) information recorded in the contract with the client; (v) data on the on-going performances rendered, including amounts invoiced and paid, communication with the client or, as it were, their contact persons.
   
   2.5. The personal data of clients is being processed for the purpose of (i) precontractual negotiations and the discharge of Operator’s obligations under the agreement with the client, including the recovery of receivables, remedies for defects, complaints management and the handling of enquiries and requests, within the meaning of Art. 6 (1) (b) GDPR; (ii) Operator’s compliance with its legal obligations e.g. in the realm of accounting, advertising regulations, the prevention of crime, etc., within the meaning of Art. 6 (1) (c) GDPR; (iii) the protection of the legitimate interests pursued by the Operator or by a third party, including the keeping of records and the discharge of administrative tasks within the meaning of Art. 6 (1) (f) GDPR. We do not require your special consent as a client to engage in this type of processing.
   
   2.6. Personal data of clients who subscribed to the newsletter. In the case of clients who signed up to receive content in the form of Operator’s newsletter, the Operator will process the personal data made available in connection with the utilization of this service. This will include in particular the following personal data: (i) e-mail address; (ii) subscription commencement date and cancellation date; (iii) other data which you make voluntarily available in the course of the mutual communication (in person or over the phone or in writing or otherwise); (iv) identification of the device(s) from which you log into the service.
   
   2.7. The personal data of newsletter subscribers is being processed for the purpose of direct marketing in the form of commercial messages distributed by the Operator and containing information on the services, products, newly introduced services and products, and other, similar products and services of the Operator of the Platform, including such other purpose as stated in the declaration of consent within the meaning of Art. 6 (1) (a) GDPR (the "Consent"). This type of data processing presupposes your prior Consent.
   
   2.8. For the granting of special Consent, the Platform uses a system known as single opt-in confirmation. This means that you will only receive the newsletter if you expressed Consent with the activation of the newsletter by providing an e-mail address to which the newsletter should be sent and if you also clicked on the "SUBSCRIBE" link.
   
   2.9. Personal data of visitors to the Platform. In the case of visitors to the Platform, the Operator may process the following data: (i) the IP address from which your end-user device is accessing the Platform; (ii) information obtained with the help of cookies (or other online identifiers) such as, in particular, information on your end-user device (type of browser, browser settings, operating system), basic geographic location, information on your browsing history or usage of mobile apps, information on your personal interests, etc. For the details, please be referred to the Cookies Policy found on commence.cz.
   
   2.10. The personal data of Platform visitors is being processed for the purpose of (i) transmission of communication via an electronic communication network; (ii) providing Platform visitors with expressly requested information services within the meaning of Art. 6 (1) (f) GDPR. This data processing does not require your special consent as a visitor to the Platform.
   
   2.11. Personal data is being stored in a safe database and is being processed in electronic form using automated means. The Operator guarantees the security of the data made available to it.
   
   2.12. The personal data is not used for decision-making based purely on automated processing.
   
   
3. CONSENT AND ITS WITHDRAWAL
   
   3.1. As a client who signed up to receive content in the form of a newsletter, you have given your Consent with data processing freely and voluntarily, and you may revoke (withdraw) this Consent at any time, by way of a written request delivered (i) via e-mail to info@commence.cz or (ii) via regular mail to the address of the Operator’s registered seat; as a user of the service, you will incur no further costs or consequences of any kind.
   
   3.2. This has no bearing on the lawfulness of Consent-based processing prior to the withdrawal of Consent. The Operator accepts no liability for proper delivery of the withdrawal of Consent if you chose to send your notice of withdrawal via unsecured e-mail communication.
   
   3.3. The Operator has 30 days from the delivery of the notice of withdrawal of Consent to process such withdrawal of Consent with the distribution of the newsletter.
   
   
4. PROCESSORS AND THE DURATION OF PROCESSING
   
   4.1.The Operator in its capacity as the data controller may make use of other entities – personal data processors – to process personal data for the Operator in line with the Operator’s instructions. Aside from these processors, there exist no recipients in the Czech Republic or abroad who will have access to the processed personal data. The list of processors is publicly accessible at commence.cz.
   
   4.2. Personal data as listed above which is being processed for the purpose of performing under a contract will be processed for a proportionate period of time with a view to the purpose of processing. In determining the proportionality of the duration of processing, the Operator will take into account, in particular, the statute of limitations, the likelihood that a legal claim will be brought, standard market practice, and the likelihood and materiality of impeding risks.
   
   4.3. Personal data as listed above which is being processed for the purpose of Operator’s compliance with its duties under the law will be processed for the period of time stipulated by the relevant statutory provision.
   
   4.4. Personal data as listed above which is being processed for the purpose of protecting the legitimate interests of the Operator and of third parties will be processed for as long as the relevant legitimate interest exists.
   
   4.5. Personal data which is being processed based on the consent you gave as a client who subscribed to our newsletter will be processed up until you withdraw the said consent (unless the Operator already erased the data at an earlier point in time).
   
   
5. COOKIES
   
   5.1. In order to improve the provision of services, the website www.commence.cz, i.e., the Platform, makes use of what is known as cookies. You have the right to reject the use of cookies other than those which are indispensable for the operability of the Platform, by prohibiting them in your browser. For the details, please be referred to our Cookies Policy which can be found at www.commence.cz.
   
   
6. RIGHTS WITH RESPECT TO YOUR PERSONAL DATA
   
   6.1. The Operator processes the personal data which you personally provided upon the conclusion of a contract between you and the Operator, upon subscription of the newsletter, in the course of performance under the contract, in communication with you, and while monitoring your activities on the Platform. In justified cases (such as the enforcement of claims for performance), the Operator may also research personal data in public registers.
   
   6.2. You have a right of access to your own personal data, may demand the rectification of inaccurate data and the restriction of processing, or demand the erasure (blocking) and removal of personal data. You also have the right to object to the processing of your personal data by raising an objection with the Operator, to withdraw (revoke) your Consent with data processing at any time, and (if you believe that your rights have been infringed) to demand that the Operator make amends or to turn to the supervisory authority (Úřad pro ochranu osobních údajů) for remedies. You also have the right to portability of your personal data. Further information on individual rights can be found below:
   
   1. The right of access represents your right to demand confirmation from the Operator as to whether or not personal data concerning them is being processed. If the Operator has been processing your personal data, you may access this data along with other pertinent information.
   
   2. The right to rectification represents your right to demand that the Operator rectify inaccurate personal data; taking into account the purposes of processing, you may in certain cases moreover have the right to demand that missing personal data be completed.
   
   3. The right to erasure represents the obligation of the Operator to erase your personal data which it has been processing, on the terms set out in more detail in Art. 17 GDPR. Please note that this does not apply if the data processing is necessary:
   
   (a) for exercising the right of freedom of expression and information;
   
   (b) for compliance with a legal obligation which requires processing by EU law or Member State law to which the Operator is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Operator;
   
   (c) for reasons of public interest in the area of public health;
   
   (d) for archiving purposes in the public interest, scientific or historical research, or statistical purposes, if it is likely that the right to erasure makes it impossible or seriously impairs the achievement of the objectives of such processing; or
   
   (e) for the establishment, exercise, or defense of legal claims.
   
   4. The right to restriction represents your right to demand that the Operator restrict the processing of your personal data in the cases listed in Art. 18 GDPR.
   
   If processing has been restricted for any of the grounds available under Art. 18 GDPR, the affected personal data shall (with the exception of storage) only be processed with your consent, or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another individual or legal entity, or for reasons of important public interest of the European Union or of a Member State. The Operator must notify you in advance before lifting the restriction of processing.
   
   5. The right to portability represents your right to receive your personal data which you provided to the Operator in a structured, commonly used, machine-readable format, and to transmit that data to another controller, if
   
   (a) the processing is based on consent or on a contract; and
   
   (b) the processing is carried out by automated means.
   
   6. In exercising your right to portability, you have the right to have your personal data transmitted directly from the operator to the new controller. This provision does not apply if such direct transmission is not technically feasible. The right to portability does not apply to processing which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
   
   7. The right to object to the processing of personal data, including profiling: If you make use of this right, the Operator shall no longer process your personal data unless it can show compelling legitimate grounds for doing so, which must override your rights and interests. The Operator may process the personal data in question if this is necessary for the exercise and defense of legal claims. If an objection is brought against the processing for direct marketing purposes, there will be no further examination of whether the Operator has legitimate grounds for processing.
   
   8. If the Operator processes your personal data based on consent, you have the right to withdraw this consent at any time. However, the withdrawal of consent has no bearing on the legitimacy of personal data processing up until the moment of withdrawal.
   
   9. If you wish to exercise any of your rights, please contact the Operator at the given address. The Operator may charge a fee for processing the request, but only if the relevant legal provisions explicitly say so.
   
   
7. CONTACT DETAILS
   
   7.1. If you have any suggestions, enquiries, or unresolved issues in connection with the processing of personal data, or wish to bring a complaint, you may turn to the Operator at Mojmírova 1364/9, Nusle, 140 00 Prague 4, Czech republic (postal address), or via e-mail to: info@commence.cz
   
   7.2. If you doubt that the duties related to the processing of personal data have been observed in your case, you may also turn with your complaint to the Czech data protection authority, i.e., the Úřad pro ochranu osobních údajů, with its seat at Pplk. Sochora 27, 170 00 Prague 7, e-mail: posta@uoou.cz, URL: uoou.cz.

LIST OF CONTROLLER’S DATA PROCESSORS

Commence, s.r.o., ID No. 28501926, with its seat at Mojmírova 1364/9, Nusle, 140 00 Prague 4, entered in the Commercial Register kept by the Prague Municipal Court in Section C, File No. 146249, the operator of the Platform and the controller of your personal data, passes on your anonymized data to the following data processors (the "Processors"):

No.	PROCESSOR	ADDITIONAL INFORMATION ON THE PROCESSOR
1	Google Ireland Limited, Reg. No. 368047, with its seat at Gordon House, Barrow Street, Dublin 4, Ireland	https://policies.google.com/technologies/ads
2	Seznam.cz, a.s., ID No. 26168685, with its seat at 150 00 Prague 5 - Smíchov, Radlická 3294/10, Czech Republic	N/A
3	Adform, Wildersgade 10B, 1408 Copenhagen, Denmark	https://site.adform.com/privacy-policy-opt-out/
4	Facebook Ireland Limited, with its seat at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02 X525, Ireland	https://cs-cz.facebook.com/about/privacy

All your personal data transferred to Recipients is anonymized.
Additional information on the processing of your personal data can be found in the Privacy Policy at www.commence.cz.

Prague on 1. 4. 2025
Commence, s.r.o.
Operator of www.commence.cz