This notice describes how APS Investments s.r.o. (the “Controller” or “APSI”) handles personal data it obtains in connection with your prospective or current business or other relationship or activity in which you come into contact with APSI. This notice complies with the General Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), according to which you have the right to be informed about the data that various processors hold and process about you and about your rights in relation to such data.
This notice does not apply to the processing of personal data of the Controller’s employees.
The following categories of personal data are processed:
(hereinafter referred to as “personal data”).
APSI may obtain personal data either directly from you or from other legitimate sources, depending on the nature of the relationship and services provided.
APSI may collect personal data from the following sources:
Where required by applicable law, APSI may collect and process copies of identification documents and other information necessary to comply with legal and regulatory obligations, including anti-money laundering and counter-terrorist financing requirements.
Personal data may be processed manually or by automated means using appropriate technical and organisational measures designed to ensure the security and confidentiality of personal data.
APSI processes personal data only where it has an appropriate legal basis under the GDPR. Depending on the nature of the relationship with you, APSI may process personal data for the following purposes and on the following legal bases:
| Purpose of processing | Categories of data subjects | Legal basis |
|---|---|---|
| Advisory on acquisition, valuation, management and recovery of receivables and other investments, including due diligence and pricing activities | Debtors, guarantors, counterparties, investors, representatives of business partners | Legitimate interest pursuant to Art. 6(1)(f) GDPR |
| Administration and performance of contracts, including investment agreements, sale and purchase agreements, supplier contracts and other commercial arrangements | Investors, buyers, suppliers, business partners | Performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR |
| Customer due diligence (KYC), anti-money laundering (AML), sanctions screening, prevention of fraud and compliance with regulatory obligations | Investors, beneficial owners, directors, authorised representatives, business partners | Compliance with legal obligations pursuant to Art. 6(1)(c) GDPR |
| Advisory on management of insolvency, bankruptcy, restructuring, enforcement and litigation proceedings, including exercise and defence of legal claims | Debtors, creditors, counterparties, legal representatives | Legitimate interest pursuant to Art. 6(1)(f) GDPR and, where applicable, compliance with legal obligations pursuant to Art. 6(1)(c) GDPR |
| Communication with investors, customers, debtors, suppliers, business partners and their representatives | Relevant individuals involved in a business relationship | Performance of a contract pursuant to Art. 6(1)(b) GDPR or legitimate interest pursuant to Art. 6(1)(f) GDPR |
| Internal administration, intra-group cooperation, risk management, compliance, audit, reporting, IT/security support and group governance activities, including sharing of personal data within the APS Holding group where necessary for these purposes | Investors, debtors, counterparties, suppliers, representatives and employees of business partners, beneficial owners and other individuals involved in APSI’s business activities. | Legitimate interest pursuant to Article 6(1)(f) GDPR; where applicable, compliance with legal obligations pursuant to Article 6(1)(c) GDPR or performance of a contract pursuant to Article 6(1)(b) GDPR. |
| Compliance with accounting, tax, corporate, regulatory and other legal requirements | Relevant individuals whose data are included in mandatory records | Compliance with legal obligations pursuant to Art. 6(1)(c) GDPR |
| Marketing communications relating to APSI products and services | Clients and prospective clients | Legitimate interest pursuant to Art. 6(1)(f) GDPR or consent pursuant to Art. 6(1)(a) GDPR, where required by law |
| Organisation of conferences, events and educational activities | Participants and invitees | Legitimate interest pursuant to Art. 6(1)(f) GDPR or consent pursuant to Art. 6(1)(a) GDPR, where required |
Where APSI relies on Article 6(1)(f) GDPR, its legitimate interests may include:
You have the right to object to processing based on legitimate interests in accordance with Article 21 GDPR.
In certain circumstances, the provision of personal data is required by law, necessary for the performance of a contract, or a prerequisite for entering into a contractual relationship with APSI. Failure to provide such personal data may result in APSI being unable to establish or maintain a business relationship, complete a transaction, comply with legal obligations, perform customer due diligence requirements or provide requested products or services.
Where the provision of personal data is voluntary, APSI will inform you accordingly.
The processing of your personal data may be carried out manually or automatically. However, none of the personal data collected is used for automatic decision-making. Your personal data is processed mainly by the designated employees of the Controller, but also by external processors (accountants, lawyers) with whom the Controller has concluded a contract for the processing of personal data, which contains all the necessary guarantees regarding the processing of personal data.
APSI primarily processes personal data within the European Economic Area (“EEA”). However, in certain circumstances, personal data may be transferred to recipients located outside the EEA, including affiliated companies, service providers, professional advisers, or counterparties involved in a transaction.
Where personal data is transferred to a country that has not been recognized by the European Commission as providing an adequate level of data protection, APSI will ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR. These safeguards may include:
APSI is committed to ensuring that personal data is processed lawfully, fairly and transparently. Subject to applicable legal requirements and limitations, you have the following rights:
You have the right to obtain confirmation as to whether APSI processes your personal data and, where this is the case, to obtain access to such personal data and information relating to the processing.
You have the right to request correction of inaccurate personal data and completion of incomplete personal data.
You have the right to request deletion of your personal data where:
You have the right to request restriction of processing under the conditions set out in Article 18 GDPR.
Where processing is based on consent or on a contract and carried out by automated means, you have the right to receive personal data you have provided to APSI in a structured, commonly used and machine-readable format and to transmit that data to another controller.
Where APSI processes personal data on the basis of its legitimate interests, you have the right to object to such processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you have the right to object at any time. In such case APSI will cease processing personal data for direct marketing purposes.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You have the right to lodge a complaint with the competent supervisory authority. In the Czech Republic this authority is:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 727/27
170 00 Prague 7
Czech Republic
APSI may disclose personal data where necessary and lawful to the following categories of recipients:
Where APSI engages a processor, APSI ensures through contractual arrangements that the processor processes personal data only in accordance with APSI’s instructions and applies appropriate technical and organisational measures to protect personal data.
APSI may share personal data with companies within the APS Group (affiliated companies) where necessary for legitimate business, administrative, operational, compliance, risk management, audit, reporting, IT, security, transaction management, KYC/AML, sanctions screening, accounting, tax, legal or governance purposes.
Such intra-group sharing may be based, depending on the relevant processing purpose, on:
APSI does not rely on consent for intra-group sharing unless consent is specifically required by applicable law for a particular processing activity. Personal data shared within the APS Group (affiliated companies) is made available only to those persons and entities that need access for the relevant purpose and is subject to appropriate confidentiality, security and data protection safeguards.
APSI retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and contractual requirements.
Retention periods may include:
Where personal data is processed on the basis of consent, it will generally be retained until consent is withdrawn or until the relevant purpose no longer exists.
Upon expiry of the applicable retention period, APSI will securely delete, anonymise or otherwise dispose of the personal data in accordance with applicable legal requirements.
If you have any questions regarding this Notice or the processing of your personal data, you may contact APSI using the following details:
Address: APS Investments s.r.o., Pobřežní 394/12, Karlín, 186 00 Prague 8, Czech Republic
E-mail: gdpr_group@aps-holding.com
APSI may amend this Notice from time to time in order to reflect changes in applicable laws, regulatory requirements or business practices.
The most recent version of this Notice will always be available on the APSI website. Material changes will be communicated through appropriate channels where required by law.