This policy of protection of personal and sensitive data of users of Slackers app (hereinafter referred to as “Application”) regulates in accordance with Regulation (EU) No 2016/679 of the European Parliament and of the Council, on the protection of individuals with regard to the processing of personal data (hereinafter “GDPR”), the terms of protection of personal and sensitive data between the operator of the App by Luce del sole a.s., ID: 170 67 472, with its registered office in Štíbrova 1214/16, Kobylisy, 182 00 Praha 8, registered in the Commercial Register maintained by the Municipal Administration by the court in Prague, section B, insert 27223 (hereinafter referred to as the “Operator”) and the User of the Application (hereinafter referred to as “You”). The processing of your personal and sensitive data is necessary in order for you to use the Application. The mobile version of the Application is available only on condition that the processing of your personal and sensitive data is allowed. If you do not agree with any provision of this privacy and sensitive data policy, please do not use the App or provide any of your personal and sensitive data to the Operator. 2. Personal and sensitive data Personal data and sensitive data that may be processed through the Application include the following categories of data: a) Your contact details — date of birth, email address; b) Registration data in the Application — username and password to access the Application; c) Health and fitness data — age, height, weight, gender, heart rate, stress level and sleeprelated information; d) Information about physical activity and nutrition — fitness level, fitness goals, exercise types, exercise programs, number of steps, speed, distance; e) Information about third party devices and applications that you choose to link to the Application — the type, model and identifiers of third party devices and third party application identifiers; f) Information about your use of the Application — Application settings, information about the use of the App, the frequency and duration of such use; (together just “data”). The Operator will only collect, store and process your data that you voluntarily provide to the Operator in connection with the use of the Application, or which the Operator obtains with your consent by linking the Application with other web and/or mobile applications that you use. The Operator will use this information from other web or mobile applications to supplement data about your activities in the Application. The Operator will be entitled to collect, store and process also certain individual personal data collected through information systems and programs used for the operation of the Application, the transmission of which is an integral part of the use of Internet communication protocols (e.g. IP addresses).
The specific scope of data that the Operator will be able to process about you is determined by You depending on which Application you choose and activate or what activities you will carry out in the Application. Before starting data processing and establishing access to individual functions of the Application, you will be asked to give your consent to the processing of your data to the extent and for the purposes specified in the consent. Most of the Services of the App are based on data collected through third party devices. Some of the data collected (e.g. health-related data) is inherently such that we must obtain your explicit consent to collect and process it. Such consent is required separately for each service that processes such data. The sensitive data processed depends on the service you use and your device, as different services and devices may have different functions and record different data from each other.
The collection, storage and processing of your data will be carried out on the basis of your consent and in accordance with applicable law, in the following manner: a) The data will be collected, stored and processed by the Operator to the extent necessary to fulfill the purposes defined in the consent and in accordance with them. b) The data will be processed primarily in electronic form, either automatically or mechanically, possibly also manually in written form. The electronic version of the data will be stored in a secure database on the Operator's server. c) The data will be processed with the possibility of using technologies such as cookies, flash cookies, tags, etc., which allow to determine the frequency with which you visit different parts of the Application, to evaluate the preferences and activities of the user and to integrate you into different groups according to your interests and preferences, thus improving the Application and editing its content directly for you. The rules for the use of these files, including how you can consent to the use of these files or how you can opt out of their use, are available in the App. d) The Operator will take all reasonable measures to prevent accidental or unauthorized access to your data and to comply with all conditions for processing your data in accordance with the requirements of the relevant legislation. e) Only authorized personnel of the Operator and processors, developers of the Application, experts caring for the respective server and its programs, who are obliged to comply with the rules of protection and processing of personal and sensitive data will have access to the data. f) The Application may contain links to websites or mobile applications operated by third parties whose practices in the field of information and protection of personal and sensitive data may differ from the rules for the protection and processing of personal and sensitive data of the Operator. The Operator is not responsible for the information and personal data protection practices applied by such third parties.
At any time during the processing of data, you have: a) The right to request information on whether your data is being processed or not; 2 b) The right to request a copy of the data processed by the Operator and at the same time to obtain information (i) on the purposes for which the data are processed, (ii) on the data, or categories of data subject to processing, including all available information on their source, (iii) on the recipient, or categories of data recipients to whom the data are disclosed, (iv) on the period for which the data will be stored; (v) the nature of automated processing in relation to its use for decision-making, where acts or decisions are made on the basis of such processing; the content of which is an interference with your rights and legitimate interests and (vi) other information provided to you by the Operator together with a copy of the data; c) The right to request clarification and, where appropriate, correction or blocking of data if they are inaccurate, or to request supplementation of data if they are incomplete with respect to the purpose for which they are processed; d) The right to request, in certain circumstances, the erasure of the data if (i) it is no longer necessary for the purposes for which it was collected by the Operator, (ii) you withdraw your consent and there is no other legal reason for the processing, (iii) you legitimately object to the processing, (iv) the data would be processed unlawfully, or if (v) such an obligation arises for the Operator from legal regulations; e) The right for the Operator to restrict the processing of the data if (i) at the same time you ask the Operator to verify the accuracy of the data, (ii) the processing is unlawful and you request the restriction of processing instead of deleting the data, (iii) the Operator no longer needs the data, but at your request they will be retained for the purpose of determining, exercising or defending your legal claims, (iv) until your objection to processing is resolved; f) The right to obtain data from the Operator and to request that the Operator transfer these data to another personal data controller; g) The right to object to the processing of data for the purposes of direct marketing and creation of a user profile; h) The right to withdraw your consent to the processing of data. In such a case, the data will be deleted without undue delay upon receipt of the appeal, and i) The right to lodge a complaint with the Office for Personal Data Protection or a similar supervisory authority of another EU Member State, or to apply for protection in the courts of the Czech Republic or the court of the Member State of your habitual residence of the user, if you believe that the processing of the data violates the relevant legislation.
The data will be processed and stored for no longer than necessary to fulfill any purpose specified in your consent to the processing of data. If the processing purposes cease or you withdraw your consent, cancel your user account or ask the Operator to destroy your data, your data will be destroyed without undue delay. If you do not use the App in any way for 1 year, your account will be deactivated. In the event that you do not use the Application in any way for 3 years, the Operator will destroy your data. After your data is destroyed for any of the above reasons, the Operator will be able to keep the collected data only in an anonymised form, which does not allow them to be linked to your person. 3
In addition to the Operator as data controller, other entities will participate in the processing of your data in connection with the operation of the Application, the current list of which is given in the Application.
In addition to the processor, your data may also be disclosed or disclosed to: a) For other companies from the Operator group, the current list of such persons is given in the Application. In this case, data protection will be ensured in the same way as in the case of processing of the data directly by the Operator; b) Service providers who provide services to the Operator in connection with the operation of the Application; c) other bodies and public authorities, where required by law; and d) The data may also be made available in the context of the transformation of the Operator, the acquisition of the Operator, the sale of the Operator's assets or the transfer of the Operator's contracts.
The transfer of your personal data to countries outside the European Union that do not provide an adequate level of protection under the Commission Implementing Decision pursuant to Art. 45 (3) GDPR is governed by standard contractual clauses in accordance with the relevant EU Commission decision. 1 Some countries have been identified by the European Commission as providing adequate protection for your personal data. A list of these countries can be found on the website of the EU Commission.
If you have a question about this policy of protection of personal and sensitive data of the Application user or if you want to exercise any of your rights related to the processing of your data by the Operator, you can contact the Operator by email at dataprivacy@slackersapp.com. Further information can be obtained from the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, e-mail: posta@uoou.cz, phone: +420 234 665 800, where you can also file a complaint or complaint. Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for 1 the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. A list of these countries is available here: https://commission.europa.eu/law/law-topic/data- 2 protection/international-dimension-data-protection/adequacy-decisions_en 4
This policy of protection of personal and sensitive data of the User of the Application is an integral part of the Terms and Conditions of the Application, published on the Operator's website www.slackersapp.com and accessible in the Application. In connection with the further development and updating of the Application, in order to implement new technologies and working procedures in the field of protecting your personal and sensitive data, in order to comply with new legal and regulatory requirements or for any other reason, the Operator reserves the right to change or update this privacy and sensitive data policy at any time, and you will be informed of the change or update made. Unless otherwise specified in the notice of change or update, the effective effect of such change or update will take effect 7 days from the date on which you are notified of the change or update of this Privacy Policy and the Privacy Policy of the User of the Application. In the event that you do not agree to the proposed change or update, you have the right to reject the proposed change or update within this period and to terminate your obligations to which the change or update will relate in writing.