GDPR NOTIFICATION

This document describes how APS group uses the personal data that they receive about you and / or about your assets as part of, derived or used in your debt recovery activity or in the course of any other activity within which you have encountered APS. This notification is in accordance with the General Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), under which you have the right to be informed of the data that different processors have and process with respect to you and your rights in relation to these data.

1. PERSONAL DATA PROCESSING

   1. The personal data that are being processed are the following:
   2. Identification information (Name, surname);
   3. Contact information (e-mail address, postal address, phone number),
   4. Information on your utilization of our products and services, including information in your requests for products and services;
   5. Information from our personal, telephone and electronic communication with you;
   6. Information from internet browser that you use or mobile applications;
   7. Financial standing and credibility,
   8. as well as any information which the Controller processes in relation to the contract fulfilment, legal obligation and for the purposes of the Controller’s legitimate interest.
   (the Personal Data).

2. SOURCES OF THE PERSONAL DATA

   The Personal Data are being obtained directly from you.

3. PURPOSE OF PROCESSING

   The Controller processes the Personal Data for the purpose of debt recovery and offering the products and services of the Controller and its affiliated and cooperating persons/entities.

4. HOW ARE THE PERSONAL DATA PROCESSED?

   The processing of your Personal Data may be manual but also automated. However, none of the collected Personal Data are used for automated decision-making. Your Personal Data are being processed mainly by the designated employees of the Controller, but also by third parties being the processors with whom the Controller has conclude the data processing agreement which contains all necessary guarantees for the Personal Data processing.

5. WHAT ARE THE LEGAL GROUNDS FOR PROCESSING OF PERSONAL DATA?

   Legal grounds for processing of the Personal Data is set by Article 6(1) of GDPR pursuant to which the processing is lawful, if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

6. WILL WE TRANSFER PERSONAL DATA TO THE THIRD COUNTRY OR INTERNATIONAL ORGANISATION?

   We will not transfer any Personal Data to the countries outside the European Union nor European Economic Area, neither to any international organisation.

7. RIGHTS RELATING TO THE PROCESSING OF THE PERSONAL DATA

   The Controller ensures that your Personal Data are processed in secure and accurate manner. You may exercise all the rights described in this clause with the Controller.

   How can you exercise your rights?

   You may exercise each individual right via sending an email to barbora.kubikova@aps-holding.com or by calling to +420 225 375 505 eventually by sending a written request to the address of the Controller.

   A statement or information on measures adopted shall be provided to you by the Controller as soon as possible, but not later than within 1 month from receipt of the request. The Controller is entitled to extend this period by 2 months taking into account complexity of the issue and number of requests submitted. The Controller will inform you on such an extension.

   1. Right to be informed - at least about:

      1. the identity and the contact details of the Controller and of the Controller's representative;
      2. the contact details of the DPO;
      3. the purposes of the processing of the Personal Data as well as the legal basis for the processing;
      4. the legitimate interests pursued by the Controller or by a third party, if applicable;
      5. the recipients or categories of recipients of the Personal Data;
      6. if applicable, the fact that the Controller intends to transfer Personal Data to a third country or international organisation and the existence or absence of an adequacy decision by the European Commission, or reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

   2. Right of access

      You may request access to your Personal Data and obtain information what Personal Data concerning your person are being processed, and access the following information:

      1. the purposes of the processing;
      2. the categories of Personal Data concerned;
      3. the recipients or categories of recipient to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations;
      4. the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine such period;
      5. the existence of the right to request from the Controller rectification or erasure of the Personal Data or restriction of processing of the Personal Data concerning you or to object to such processing;
      6. the right to lodge a complaint with a supervisory authority;
      7. where the Personal Data are not collected from you, any available information as to their source; and
      8. the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

      The Controller shall provide a copy of the Personal Data undergoing processing. For any further requested copies, the Controller may charge a reasonable fee based on administrative costs. The DPO or other authorized person may decide that you should be asked to cover the costs or that your request can be rejected. Where the request is made by the electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form.

   3. Right to rectification

      1. You have the right to request the Controller to rectify your inaccurate Personal Data.
      2. You have also right to have your incomplete Personal Data completed, including by means of providing a supplementary statement. While executing this right, the purposes of the processing must be taken into account and the DPO shall decide whether it is appropriate or not.

   4. Right to erasure

      You have the right to ask the Controller to erasure your Personal Data. The Controller shall have the obligation to erase your Personal Data where one of the following grounds applies:

      1. the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
      2. you object to the processing and there are no overriding legitimate grounds for the processing;
      3. you revoke the consent and there is no other reason for the processing;
      4. the Personal Data have been unlawfully processed;
      5. the Personal Data have to be erased for compliance with a legal obligation in an European Union or Member State law to which the Controller is subject.

      Right to erasure shall not apply to the extent that processing is necessary for the establishment, exercise or defence of legal claims.

   5. Right to restriction of processing

      You have the right to restrict the processing where one of the following applies:

      1. you contest the accuracy of the Personal Data, for a period enabling the Controller to verify the accuracy of the Personal Data;
      2. the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of its processing instead;
      3. the Controller no longer needs the Personal Data for the purposes of the processing, but you require it for establishment, exercise or defence of legal claims;
      4. you have objected to processing pending the verification whether the legitimate grounds of the Controller override those of yours.

   6. Right to object

      You have the right to object, on grounds relating to the particular situation, at any time to processing of your Personal Data, including profiling.

      The Controller shall no longer process the Personal Data unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

   7. Right to lodge a complaint with a supervisory authority

      Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority (Czech Data Protection Authority), of the alleged infringement if you consider that the processing of the Personal Data infringes your rights.

   8. Right to portability

      In relation to the Personal Data that you have provided to the Controller and that is subject to automatized processing, you have the right to receive it in a structured, commonly used and machine-readable format and the right to transmit this Personal Data to another controller without hindrance from the Controller.

8. HOW YOU MAY CONTACT US?

   In case of any questions regarding processing of your Personal Data you may contact directly our DPO on contact details set out in clause 7 or you may contact us also in writing, via e-mail or telephone on below contact details:

   Address: APS Management Services s.r.o., Celetná 988/38, 110 00 Praha 1, CZ

   E-mail: barbora.kubikova@aps-holding.com
   Telephone: +420 225 375 484

9. GENERAL INFORMATION

   The Controller may change, amend, repeal or replace this notification any time if necessary while the updated Notification must be published at least [30] days before its effect.

   The list of affiliated and cooperating persons/entities of the Controller:

   Name of the entity: APS Holding S.A.
   Identification no.: B 201461
   Registered office: 1, rue Jean Piret, L- 2350 Luxembourg

   Name of the entity: APS Investments S.à.r.l.
   Identification no.: B219890
   Registered office: 1 rue Jean Piret, 2350 Luxembourg

   Name of the entity: APS Investment Funds S.à.r.l.
   Identification no.: B219886
   Registered office: 1 rue Jean Piret, 2350 Luxembourg

   Name of the entity: APS Delta S.A.
   Identification no.: B204416
   Registered office: 1 rue Jean Piret, 2350 Luxembourg

   Name of the entity: APS Recovery a.s.
   Identification no.: 03409422
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Management Services s.r.o.
   Identification no.: 06648746
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Finance a.s
   Identification no.: 06648576
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Real Estate s.r.o.
   Identification no.: 04474686
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS CZ & SK Services s.r.o.
   Identification no.: 02087758
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS MIP, s.r.o.
   Identification no.: 5548292
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Recovery Management s.r.o.
   Identification no.: 06627285
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS GAMMA s.r.o.
   Identification no.: 03523250
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Delta s.r.o.
   Identification no.: 04363876
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS BETA, a.s.
   Identification no.: 1788655
   Registered office: Celetná 988/38, Staré Město, 110 00 Prague 1

   Name of the entity: APS Poland S.A.
   Identification no.: 0000069272
   Registered office: Aleksandra Ostrowskiego 13D, 53-238, Wrocław

   Name of the entity: APS Recovery Greece EPE
   Identification no.: EL 800609597
   Registered office: 24 Lagoumitzi Str., PC 17671, Kallithea, Attica

   Name of the entity: APS Recovery Greece Credit and Loan Servicing S.A.
   Identification no.: 143893601000
   Registered office: 7 Paleologou St. Halandri, 152 32

   Name of the entity: APS Bulgaria E.O.O.D.
   Identification no.: 202604987
   Registered office: 81B Bulgaria blvd., office 3, 01404 Sofia

   Name of the entity: APS BETA Bulgaria E.O.O.D.
   Identification no.: 203374133
   Registered office: 81B, Bulgaria blvd.,1404 Sofia

   Name of the entity: APS Finance E.O.O.D.
   Identification no.: 202159149
   Registered office: 81B Bulgaria blvd., office 3, 01404 Sofia

   Name of the entity: APS d.o.o. Beograd
   Identification no.: 20100311
   Registered office: Kosovska 10, Beograd-Stari Grad

   Name of the entity: APS FUND BETA d.o.o. Beograd
   Identification no.: 21053007
   Registered office: Kosovska 10, Beograd-Stari Grad

   Name of the entity: Asset Portfolio Servicing Romania S.R.L
   Identification no.: 21458257
   Registered office: Bucharest, 246C Calea Floreasca, SkyTower building, 11th/12th floor

   Name of the entity: Syndre Valuations S.R.L.
   Identification no.: RO30697075
   Registered office: Bucharest, 246C Calea Floreasca, SkyTower building, 11th/12th floor

   Name of the entity: Serraghis Asset Management S.A
   Identification no.: RO15421741
   Registered office: Bucharest, 246C Calea Floreasca, SkyTower building, 11th/12th floor, Romania

   Name of the entity: Homeland Properties S.R.L.
   Identification no.: 31417793
   Registered office: Bucharest, 246C Calea Floreasca, SkyTower building, 11th/12th floor

   Name of the entity: APS Croatia d.o.o.
   Identification no.: 41275180055
   Registered office: Zagreb (Grad Zagreb) Hektorovićeva ulica 2

   Name of the entity: APS Holding Cyprus LTD.
   Identification no.: HE 356594
   Registered office: Strovolou 236, Strovolos 2048 Nicosia

   Name of the entity: APS Debt Servicing Cyprus Ltd.
   Identification no.: HE 363203
   Registered office: Amfipoleos, 20, Amfipoleos Building, 2025, Nicosia

   Name of the entity: APS Homeland Properties Cyprus Ltd.
   Identification no.: HE 375588
   Registered office: Amfipoleos, 20, Amfipoleos Building, 2025, Nicosia

   Name of the entity: APS Hungary Kft.
   Identification no.: 01-09-289270
   Registered office: 1055 Budapest, Bajcsy-Zsilinszky út 78

   Name of the entity: APS Recovery Hungary Kft.
   Identification no.: 01-09-290573
   Registered office: 1055 Budapest, Bajcsy-Zsilinszky út 78

   Name of the entity: MARK Zrt.
   Identification no.: 01-10-048253
   Registered office: 1055 Budapest, Bajcsy-Zsilinszky út 78.

   Name of the entity: MARK Ingatlan Zrt.
   Identification no.: 01-10-048516
   Registered office: 1055 Budapest, Bajcsy-Zsilinszky út 78.

   Name: APS SK Servicing, s.r.o.
   Identification number: 48319813
   Registered office: Vajnorská 100/B, 831 04 Bratislava

   Name: APS Investment, s.r.o.
   Identification number: 47164786
   Registered office: Vajnorská 100/B, 831 04 Bratislava

   List of 3rd party data processors can be provided on request.