Privacy Policy

1. Data controller

As the controller of personal data (the “controller”), we process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll., on the Processing of Personal Data.

2. Data Protection Officer (DPO)

The controller is not required to appoint a data protection officer under Article 37 GDPR. The controller is not a public authority, does not process special categories of personal data on a large scale, and does not carry out systematic monitoring of individuals to an extent that would establish an obligation to appoint a DPO. A DPO has therefore not been appointed.

Please send questions about the processing of personal data to office@atavus.cz.

3. Purposes and legal bases of processing

We process your personal data exclusively for the purposes listed below and on the basis of the corresponding legal bases under Article 6 GDPR:

For the contact form, consent is used only to send materials that you voluntarily request. Subsequent pre-contractual communication initiated at your request relies on Article 6(1)(b) GDPR. Withdrawal of consent does not end processing supported by another legal basis, in particular pre-contractual steps, a legal obligation, or the protection of legal rights.

For the investor presentation, consent to the behavioural record is separate from the password itself. We obtain consent in writing before the named recipient is handed the personal access password; the sign-in gate itself does not request consent, and signing in with the password is not, by itself, consent. The password works without consent, the behavioural record only starts once consent is given. Consent can be withdrawn at any time, as easily as it was given, using the control in the footer of the presentation, or by e-mail at office@atavus.cz.

4. Categories of personal data processed

Through the contact form we process the following categories of personal data:

• Identification data: first and last name
• Contact data: e-mail address, phone number (optional)
• Communication data: selected type of inquiry and message content (optional)
• Technical records: submission date and time and IP address, used for security, abuse prevention and server logs

On the investor page invest.atavus.cz, we always process, regardless of consent to usage tracking (see below):

• Identification data: the recipient's name and e-mail linked to the access password
• Sign-in record: timestamp of using the password (when the page was opened), based on legitimate interest under Art. 6(1)(f) GDPR
• Technical device classification: device type, browser and operating system derived from the user agent at sign-in; the IP address is not stored

Where the recipient has additionally given written consent to the behavioural record, we process these detailed categories:

• Opening and context: time the presentation was opened and the page path, language version, window size (viewport) and pixel density, the referring page (origin and path only, never query parameters)
• Time and activity on the page: total time on the page and active time (tab visible and interaction within the last 30 seconds), periods of inactivity, switching away from the tab, and leaving the page
• Browsing the content: which sections and content blocks were viewed and for how long, scroll depth (current and maximum, milestones at 25/50/75/90/100%)
• Interaction with page elements: clicks on elements (the element's label and link type, e.g. e-mail, phone, PDF document, external link), downloaded documents, opening and closing expandable parts (e.g. "Sources and methodology"), interaction with charts
• Contact form: which field was focused (field name only, never its content) and whether the submission succeeded
• Copying text: only the section and the number of characters copied, never the text itself

We explicitly do not collect: individual keystrokes, content typed into fields, mouse movement trails, or screen recordings or session replays. Each record carries an exact timestamp.

We do not process any special categories of personal data within the meaning of Article 9 GDPR (health data, biometric data, political opinions, etc.).

5. Recipients and processors of personal data

We disclose your personal data only to the extent necessary and on the basis of a written data-processing agreement under Article 28 GDPR, to the following categories of recipients:

We disclose personal data to public authorities (the Czech National Bank, the Office for Personal Data Protection, courts, AML authorities) only to the extent and on the basis provided for by law.

6. Transfer of personal data to third countries

Web fonts and all static assets are self-hosted on server infrastructure in the EU, without external CDNs for these assets. Google Analytics loads only after fresh analytics consent, within the scope of Section 10. Optional Meta CAPI measurement transfers only the data described in Section 10 to Meta Platforms Ireland Limited. Its processing may involve international transfers; the conditions and safeguards are described in the Meta Privacy Policy. This measurement never starts without fresh marketing consent.

7. Retention period for personal data

After the retention period expires, personal data is securely deleted or anonymised.

8. Your rights as a data subject

As a data subject you have the following rights under GDPR:

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we process your personal data, and a copy of that data along with information on how it is processed.

Right to rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate personal data or the completion of incomplete data.

Right to erasure / the “right to be forgotten” (Art. 17 GDPR)

Subject to the statutory conditions, you have the right to have your personal data erased · in particular if you withdraw your consent or the data is no longer needed for the purpose for which it was collected.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data, for example if you contest its accuracy or the lawfulness of the processing.

Right to data portability (Art. 20 GDPR)

Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of a legitimate interest, you have the right to object. We will stop the processing unless we can demonstrate compelling legitimate grounds for continuing it.

Right to withdraw consent

You may withdraw consent to receive the requested materials at any time · without affecting the lawfulness of processing before the withdrawal · by e-mail at office@atavus.cz. Withdrawal does not affect processing based on pre-contractual steps, a legal obligation, or a legitimate interest.

You can withdraw consent to the behavioural record on the investor presentation at any time, as easily as you gave it and without affecting the lawfulness of processing before the withdrawal: using the control in the footer of the presentation on invest.atavus.cz, or by e-mail at office@atavus.cz. Withdrawing via the footer control makes the system delete the record immediately; withdrawing by e-mail means we delete it without undue delay. Once withdrawn, the behavioural record stops immediately and will not restart even on later sign-ins with the same password, until written consent is given again. We retain only the sign-in time, device type, and browser and operating system class as an operational record, and the record of granting and withdrawing consent as evidence under Article 7(1) GDPR.

Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data violates the GDPR or Act No. 110/2019 Coll., you have the right to lodge a complaint with the Office for Personal Data Protection:

Please submit any request to exercise your rights by e-mail at office@atavus.cz. We will respond to your request without undue delay, and no later than one month after receiving it.

9. Automated decision-making and profiling

For named access to the investor presentation, and only with consent, we record how the recipient browsed the presentation (Sections 3 and 4). Authorised ATAVUS team members see, in real time in the internal administration, which part of the presentation the recipient is currently reading, and a detailed timeline of their browsing, so they can prepare a personal discussion. The record is always evaluated by human staff, and no decision with legal effects or similarly significant within the meaning of Article 22 GDPR is made automatically. All decisions concerning investors are made by human staff.

10. Cookies and local storage

Only after fresh analytics consent under Article 6(1)(a) GDPR, Google Analytics 4 measures aggregate traffic on the public atavus.cz website. Google receives your IP address, browser information, a fixed page group, language, limited source category and permitted events, without referrers, URL parameters, click IDs or form contents. Analytics cookies _ga and _ga_VDPL1QYMTY expire within 180 days. Google Signals and advertising personalisation are disabled; investor and sales applications are excluded. Consent v3 requires a fresh choice, and DNT and GPC are respected. Withdrawal in Cookie settings stops further measurement and removes Google cookies, but cannot recall transferred data. The Google Privacy Policy explains processing and possible international transfers; details are in our cookie policy.

Only after fresh marketing consent under Article 6(1)(a) GDPR, we send Meta Platforms Ireland Limited your IP address, browser information, event time and type, and a fixed permitted public page path through Meta Conversions API to measure advertising. These are not anonymous data. We do not send names, emails, phone numbers, form contents, URL parameters, fragments, referrers or click IDs. You may withdraw consent in Cookie settings; withdrawal stops future transfers but cannot recall data already sent. DNT and GPC are respected. An enquiry event requires acknowledgement of local email acceptance, which does not prove delivery to the recipient's inbox. Meta processing and any international transfers are described in the Meta Privacy Policy; our cookie policy explains scope, consent validity and withdrawal.

Information on cookies and how consent is managed can be found in a separate document: Cookie Policy.

11. Changes to this Privacy Policy

This policy may be updated from time to time in line with changes in legislation or in the way personal data is processed. The date of the last update is always shown at the top of the document. In the event of a material change, we will inform you via the website or by e-mail.

12. Controller contact details

For questions about the processing of personal data or to exercise your rights, please contact: