Information on personal data processing 

Pursuant to the Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (general data protection regulation; “GDPR”), we would like to inform you that: 

1. DATA CONTROLLER

The controller of your personal data in relation to brokerage/investment services provided to you and for the other purposes identified in point 3 below is WOOD & Company Financial Services a.s. with its registered office in Prague at náměstí Republiky 1079/1a, 110 00 Praha 1, the Czech Republic or its respective branch located in Warsaw, Bratislava, London, Milan or Bucharest.

The joint controllers of your personal data in relation to any marketing activities are WOOD & Company Financial Services a.s. with its registered office in Prague at náměstí Republiky 1079/1a, 110 00 Praha 1, the Czech Republic and its branches located in Warsaw, Bratislava, London, Milan and Bucharest.

WOOD & Company Financial Services a.s. with its registered office in Prague at náměstí Republiky 1079/1a, 110 00 Praha 1, the Czech Republic and its branches are jointly referred to in this information as “we”, “us” or “WOOD & Company”. For contact details of any of the WOOD & Company branches please visit our website at http://www.wood.sk/contact-us.

WOOD & Company has appointed the Data Protection Officer. The Data Protection Officer supervises the personal data processing within WOOD & Company so that it is performed in accordance with the legal regulation. You may contact the Data Protection Officer via:

• e-mail dpo@wood.com;
• a letter sent to the address of WOOD & Company.

2. CATEGORIES OF PERSONAL DATA

WOOD & Company may process your following categories of personal data:

1. identification data and contact information: forename(s), family name, surname, date and place of birth, nationality, personal identification number, personal ID card or passport number (name of document, number and series), place of residence (post code, town, street, building number, flat number, voivodship, county, municipality), registered address, telephone number, e-mail address, position (including information on any political position), business name, business address, gender, photographs, IP address, tax identification number and information on tax residence status;
2. financial and transactional data: e.g. bank account details, money transfers, assets, declared investor profile, credit history, origin of funds, debts and expenses;
3. data relating to your habits and preferences: data which relate to your interest in and use of our products and services in relation with financial and transactional data;
4. data from your interactions with us: data collected through our internet websites, our apps, our social media pages, meetings, calls, chats, emails, interviews (“Personal Data”). 
5. PURPOSES AND LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

Your Personal Data may be processed by WOOD & Company for the following purposes: 

1. to conclude a brokerage agreement or any other agreement relating to provision of investment services with you;
2. to take steps to perform the brokerage agreement or any other agreement relating to provision of investment services concluded with you;
3. to record transactions arising from agreements on the provision of brokerage or investment services and for statistical purposes;
4. to analyse customer preferences for the purpose of establishing marketing activities, in which you will be interested and for conducting marketing activities regarding services provided by WOOD & Company, especially for advertising products or services that match your needs;
5. to accept, review and respond to your complaints regarding WOOD & Company’s activities;
6. to perform the obligations imposed on the controller by the provisions of the generally applicable law, especially the Capital Market Business Act and Act on Certain Measures against Money Laundering and Terrorist Financing;
7. to perform IT management, including infrastructure management (e.g. shared platforms), business continuity and IT security;
8. to establish individual statistical models, based on the analysis of transactions, for instance in order to help define your risk score;
9. to establish aggregated statistics, tests and models for research and development, in order to improve the risk management of our group of companies or in order to improve existing products and services or create new ones;
10. to centralize your Personal Data in a database enabling representatives of WOOD & Company to have access to it on a strict need to know basis so as to allow us to involve the right level of expertise to deal with your requests and avoid unnecessary administrative duplications.

Your Personal Data will be processed on the basis of Article 6, para. 1, item a), item b), item c) and/or f) GDPR. We shall not process the Personal Data for other purposes which are inconsistent with the objectives described above unless the processing is required by law or unless WOOD & Company is authorized by you to process it.

4. SHARING PERSONAL DATA

WOOD & Company may provide Personal Data to the following third parties for the purposes specified in this document and below: 

1. entities and authorities, to which we are obliged or authorized to provide the Personal Data in order to pursue the objectives specified above and for fulfilling the obligations imposed by law. This applies, in particular to the provision of Personal Data to the supervisory authorities, courts and authorities (e.g. tax authorities and law enforcement authorities), independent external advisers (e.g. auditors) or entities providing services and other third parties. This also applies to entities and authorities which are authorized to receive the Personal Data from WOOD & Company or which are authorized to demand access to the Personal Data on the basis of the generally applicable provisions of the law;
2. companies or persons with whom WOOD & Company has concluded cooperation agreement on entrusting the performance of certain activities for WOOD & Company (“Data Processor”), including entities with which WOOD & Company has contracted for the destruction of data. Such entities will be obliged by the agreements they have concluded with WOOD & Company to apply appropriate security, as well as technical and organizational measures to protect the Personal Data and to process it exclusively in accordance with the instructions provided by WOOD & Company; 

the data processors according to this letter b) include the company Digital factory s.r.o., ID number 0698837, with its registered office at Pražákova 1008/69, Štýřice, 639 00 Brno, which operates the Signi online signing service. If you wish to sign a framework agreement for the provision of investment services (or another document, e.g. an addendum to the said agreement) online, we will provide your Personal Data in the scope of name, e-mail, telephone number, date of birth and address to Digital factory for the purpose of signing a contract (or performing another legal action) with us online. This processing is carried out in accordance with Article 6 para. 1 item b) of GDPR (processing is necessary for the implementation of pre-contractual measures). Digital factory s.r.o. will create a one-time visitor access to Signi, where you will be able to sign a contract with us with a simple electronic signature. Digital factory s.r.o. subsequently retains the transferred data as a data processor for a period of 15 years, on the basis of a legitimate interest – proof of signing the contract in the event of a dispute. If the data is already transferred to Signi, but you do not enter into a contract with us, Digital factory s.r.o. will delete the data after one month upon its transmission. More information about the processing of personal data in Digital factory s.r.o. can be found here.

• WOOD & Company’s subsidiaries and affiliates.

5. PROVISION OF PERSONAL DATA TO THIRD COUNTRIES

With respect to transfers originating from the European Economic Area (“EEA”) to the United States and other non-EEA jurisdictions, where the level of protection has not been recognised as adequate by the European Commission, we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers, as required or permitted by Articles 46 and 49 of the GDPR.

6. PERIOD OF PERSONAL DATA STORAGE

The Personal Data will be stored by WOOD & Company and/or the Processors for the period for which this is necessary for the purposes referred to in clause 3 of this information, for the purposes required in accordance with the provisions of the generally applicable law and for the purpose of defending WOOD & Company’s rights.

In accordance with the Act on Certain Measures against Money Laundering and Terrorist Financing, we keep your identification data and contact information and data and documents about your transactions (financial data and transactional data) for a period of 10 years from the execution of the transaction outside of the business relationship, or from the termination of the business relationship.

In accordance with the Capital Market Business Act, we keep records and documents related to investment services (especially data from our mutual communication, including electronic communication and recordings of telephone calls) for a period of 7 years.

If WOOD & Company processes your Personal Data for marketing activities, we store it for the duration of the contractual relationship between us, i.e. as long as you are our client.

7. RIGHTS OF DATA SUBJECTS

Depending on the objective and the grounds on which we process your data, you may be entitled to the following rights regarding Personal Data protection: 

1. right to access your Personal Data: the data subject is authorized to obtain confirmation from WOOD & Company as to whether that person’s personal data is being processed and, if so, he is authorized to obtain access to it. WOOD & Company shall provide you with a copy of the Personal Data that is being processed at your request. WOOD & Company may collect a charge at a reasonable amount arising from the administrative costs for all further copies, which you request.
2. right to rectify your Personal Data: you are entitled to correct the Personal Data which applies to you and which is incorrect. Subject to the objectives of the processing, you are entitled to request that incomplete Personal Data is supplemented, including by presenting an additional declaration.
3. right to erasure your Personal Data (“right to be forgotten”): you are entitled to demand the deletion of your Personal Data if the circumstances provided for by law take place and WOOD & Company is required to delete such Personal Data without delay.
4. right to restrict processing of your Personal Data: in such a case, WOOD & Company shall, at your request, specify that Data and it may only be processed for specified purposes.
5. right to data portability: under certain circumstances, you are entitled to receive your Personal Data in a structured, commonly used machine-readable format, which has been provided to WOOD & Company and you are entitled to send this Personal Data to another entity without obstruction by WOOD & Company.
6. right to object further processing of your Personal Data: in certain circumstances, you are entitled to file an objection to the processing of your Personal Data for reasons related to your particular situation and WOOD & Company may be required to stop processing such Personal Data.
7. the right to file a complaint with the appropriate supervisory authority, if the data processing breaches the provisions of the GDPR.
8. SOURCES OF THE PERSONAL DATA

Your Personal Data may come from

1. you or your statutory representative or principal (in the case of a power of attorney that has been provided to us), 
2. an entrepreneur, with respect to which you are the representative or beneficial owner, 
3. a party to an agreement concluded with WOOD & Company and/or 
4. from generally accessible sources, in particular from various databases and registers.

The contracting parties with which WOOD & Company has entered into an agreement pursuant to point (iii) above include Bank Identity a.s., identification number: 095 13 817, with its registered office at Smrčkova 2485/4, Libeň, 180 00 Prague 8 (“BankID”). BankID acts as a provider of identification services in accordance with the Act on Banks and may process your Personal Data, the transfer of which you have instructed in the environment of your bank. Based on your instruction, BankID may provide us with your identification data and contact information and your bank account number. We may use this information to identify you in accordance with the Act on Certain Measures against Money Laundering and Terrorist Financing. It is our duty to identify you in one of the ways permitted by law before we provide you with investment services. You can find more about the processing of personal data by BankID here.

9. REQUIREMENT TO PROVIDE DATA

You need to provide your Personal Data for WOOD & Company to enable WOOD & Company to provide to you the services or to comply by WOOD & Company with obligations referred to in point 3 of this information.

10. MISCELLANEOUS PROVISIONS

We would like to inform you of the ability to periodically update this Information in accordance with the applicable law (e.g. if we implement new systems or processes, which are related to the use of the Personal Data) and in such a case, we shall inform you accordingly of the changes that have been made.

Should you have any questions or complaints regarding Personal Data or exercising rights to privacy, please contact our data protection officer at the e-mail address dpo@wood.com.

You can also file a complaint about the processing of Personal Data directly to the Office for Personal Data Protection, with its office at Pplk. Sochora 27, 170 00 Prague 7.