Controller

The Data Controller is Astana Motors Czech, s.r.o., ID no. 22367390, with its registered seat at V celnici 1031/4, Nové Město, 110 00 Prague 1. ("AMC", "our", "we" or "controller").

Purpose of processing, scope of data processed, legal basis for processing

AMC processes the personal data set out in Annex 1 for the purposes and on the legal grounds set out in that Annex in the course of its processing activities as set out in this Privacy Notice.

Where the processing is based on your consent, the consent required for the processing is given voluntarily. You have the right to withdraw your consent at any time by sending a statement to our company by e-mail to info@astanamotors.cz provided that in this case the lawfulness of the processing prior to the withdrawal is not affected. If, however, you do not give your consent to the processing or withdraw your previously given consent, this may have the consequence that we will not be able to contact you or provide you with the requested service.

The provision of data processed for (i) the performance of the contract or prior to entering into a contract with you, and (ii) based on our legitimate interest, is voluntary, with the understanding that your failure to provide your personal data in the course of such processing may, inter alia, result in our inability to enter into or perform the relevant contract with you.

The provision of data processed pursuant to a legal obligation is mandatory, given that without collection and processing of such data, we will not be able to fulfil the obligations imposed on us by the relevant legislation.

In addition to the above, our legitimate interest in processing your personal data may also include, but is not limited to, the processing of data necessary to comply with legal obligations to which the controller is subject in the course of official proceedings, legal actions or other official proceedings, or to assert, exercise or defend legal claims.

Duration of processing

The duration of the processing is set out in Annex 1. We will delete or anonymise the processed data after the expiry of the data retention period set out in Annex 1.

We are not obliged to delete the data as described above if we have a legitimate interest in or legal obligation to keep the data for a longer period than the above retention period. Such legitimate interest may include, but is not limited to, the use of the data as evidence in legal or other official proceedings or to demonstrate compliance with legal obligations to which the controller is subject in the course of ongoing administrative, legal or other official proceedings.

In the event of a request by a court or other authority, we are obliged to send the recorded data to the court or other authority without delay.

Who has access to the personal data?

Your data may only be accessed by our selected employees within our company on a need-to-know basis.

We may transfer personal data to third parties for the following reasons:

• To members of the Astana Motors Group and our partners at Chery.

• To our suppliers, dealers and services centre operators: our company, as an importer of the Chery brand vehicles, may transfer your personal data to our following contract partners:

(i) Chery dealers (a list of CHERY dealers in the Czech Republic can be found here: info@astanamotors.cz: to settle warranty claims, warranty claims, product liability claims, to handle complaints, to provide COC (Certificate of Conformity) compliance certification, to organise test drives, to conduct vehicle recalls. If you contact us with an enquiry about a Chery vehicle, we will forward your personal data to the Chery dealer most appropriate for your needs.

(ii) Chery Service Centres (a list of CHERY service centres in the Czech Republic is available here: [INSERT[WT4] ]): in order to carry out vehicle recalls.

(iii) O&J Netherlands B.V. (The Netherlands: for warranty administration in connection with the purchase of a new car, warranty claims, warranty claims, product liability claims (claims processing, claims settlement), and for its affiliates for complaint handling, and for its contracted partners for the purpose of measuring customer satisfaction in connection with the purchase of a new car.

• Service Providers: our Company uses third party IT systems and services to support our internal processes. Our Company uses data processors in connection with the provision of customer service, the use of a complaint management system, the delivery of mail, direct marketing, the organisation of marketing campaigns for the purpose of event management, the fulfilment and follow-up of service offers in the context of contracted service, the receipt of complaints and enquiries on our social media platforms for case management. Such service providers may have access to personal data for the purposes of the system or service and pursuant to an appropriate data processing agreement between our company and the service provider.

• In order to monitor compliance with contractual obligations, we may transfer your personal data necessary for this purpose to the public body responsible for keeping the road motor vehicles register.

• If necessary, we may transfer your personal data to the authorities or courts acting in their area of competence, on the basis of a suspicion of a criminal offence or irregularity or on the basis of a request from the authorities or courts, to investigate a suspected criminal offence or irregularity or to verify compliance with the legal obligations applicable to our company, or to bring, enforce or defend legal claims, and we may also transfer your personal data to the competent authorities for the purposes of conducting recall campaigns.

In addition, in connection with litigation or disputes relating to you, we may disclose personal data relating to the subject matter of the litigation to our legal representatives.

What foreign data portability safeguards do we apply?

We process your personal data in accordance with data protection laws applicable in the Czech Republic and transfer data within the European Economic Area ("EEA"). Where we need to transfer your data to a country outside the EEA, we will do so on the basis of an adopted adequacy decision of the European Commission or, for example, on the basis of a contractual commitment that ensures that a third party with access to your personal data will provide your personal data with at least the same level of protection as it would enjoy within the EEA. In the absence of these, we will in all cases put in place appropriate safeguards to maintain the security of your data.

If you would like a description of the safeguards that we provide in relation to personal data transferred outside the EEA, or if you require further information about them, please contact us using the contact details at the end of this notice.

Your rights

You have the following rights in relation to our processing of your personal data, within the limits set out in the applicable legislation:

1.  Right of access. The right of access includes, inter alia, the following information: the purposes of the processing, the categories of personal data processed and the recipients or categories of recipients to whom or which the personal data have been or will be disclosed. You have the right to request a copy of your personal data that are subject to processing. If you request additional copies, we may charge you a reasonable fee based on administrative costs.
2.   Right to rectification: you have the right to have inaccurate personal data about you rectified at your request. Depending on the purpose of the processing, you may have the right to request that incomplete personal data be completed, including by means of a supplementary declaration.
3.  Right to erasure (right to be forgotten): you have the right to request that we erase your personal data without undue delay if certain conditions apply, such as the data no longer being necessary, you withdraw your consent, you object to the processing, the data was processed unlawfully, we must comply with a legal obligation, or the data was collected from minors. If we have made your data public, we will take reasonable steps to inform others to erase any copies. However, this right does not apply when processing is necessary for freedom of expression, legal obligations, public interest (including health), archiving or research, or legal claims.
4.  Right to restriction of processing: you have the right to request the restriction of the processing of your personal data. In such cases, the data concerned will be marked and processed only for specified purposes.
5.  The right to data portability: where the processing of your personal data is necessary for your consent or for the performance of a contract with you or for taking steps at your request prior to entering into a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, machine-readable format and the right to have that personal data transferred to another controller without our hindrance.
6.  Right to object:

   Where the processing of your personal data is necessary for the purposes of pursuing your legitimate interest(s), you have the right to object to our processing of your personal data at any time on grounds relating to your particular situation, in which case we may no longer process your personal data. Where you have the right to object and you exercise that right, we will no longer process your personal data for such purposes, unless we have legitimate grounds to continue with the processing even after you objection (e.g. our legal claims).

7.  You also have the right to lodge a complaint about the processing of your personal data with the Czech Data Protection Office (Úřad pro ochranu osobních údajů), having its seat at Pplk. Sochora 27 170 00 Prague 7, e-mail: posta@uoou.gov.cz.
8.  You have the right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal effects or significantly affects you. However, this does not apply if the decision is necessary to enter into or perform a contract with us, is authorized by law with safeguards for your rights, or is based on your explicit consent. In the first and third cases, we will ensure appropriate safeguards, including your right to human intervention, to express your views, and to challenge the decision. Such decisions will not be based on sensitive personal data unless specific legal exceptions apply and proper protections are in place. If such automated decision-making takes place, you will be provided with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Contact for data protection matters

You can exercise your rights by contacting us by sending an e-mail to info@astanamotors.cz indicating "Data Protection Request" in the subject line.