Information on Processing of Personal data of Visitors to Production Facilities and Administrative Premises of Company Tereos TTD, a.s.

Dear Visitors,

When entering /entering with a motor vehicle the production area and/or administrative premises of Tereos TTD, a.s., your personal data is processed. Therefore, in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, the “Regulation”), we would like to provide you with basic information on why we process your personal data on entry, for what purpose, and how it will be further processed.

Controller of personal data

The controller of your personal data is the company Tereos TTD, a.s., having its registered office at Palackého náměstí 1, Dobrovice 29441, ID No.: 161 93 741 (the “Controller” or the “Company”).

Contact details of the Controller are:

Telephone, email	(+420) 326 900 202 or 326 900 173 gdpr.cz@tereos.com
Correspondence address	Tereos TTD, a.s., Palackého náměstí 1, Dobrovice 29441
Website	www.tereos-ttd.com/en

If you would like to ask us about personal data protection matters, please use the above-stated contact details.

Processing of personal data at entry/entry with a motor vehicle to the Company’s premises

When entering/entering with a motor vehicle the production area and/or the administrative premises of the Company, you will be asked to present an identification card (usually an ID card or other ID - passport, driving licence), in the case of work related/business meetings, to present a service card or other document corresponding to the purpose of a visit, and to provide the following data:

1. • purpose of visit;
   • name of sending organisation;
   • first name and surname of visited person (or the office number or another similar location information within the relevant production premisses);
   • time of entry/entry with a motor vehicle to/from premisses; and
   • entry on borrowing/returning PPE (vest, helmet).

On the basis of the submitted identification card and the information provided by you (or visually verified), the following personal data is processed:

1. • first name (names) and surname;
   • type and number of the identification card;
   • information on health in the form of a declaration of infection-free status (note: this is a general declaration by a visitor that they are not suffering from diarrhoeal, infectious, or other diseases at the time of entry/entry with a motor vehicle to the Company’s premises, otherwise the visitor will not be admitted to the premises and personal data about them will not be processed; in any case, the Company does not process information about specific diseases of persons;
   • and when a motor vehicle enters the premises, its registration number (number plate).

As the premises are subject to the regime of the Prevention of Major Accidents Act and measures defined by the act, each visitor will be informed of the safety and traffic rules on the premises before entering/entering with a motor vehicle the Company’s premises and will then be asked to sign a confirmation of knowing these rules, as well as a confirmation of infection-free status, and a confirmation of the borrowing and returning protective equipment (the confirmations are signed in electronic format, the copy of a confirmation will be printed to the visitor on request).

The above-stated personal data is processed for the purposes defined below and with a reference to the relevant legal basis for processing:

1. • Ensuring protection against threats to or damage caused to the health of natural persons from infectious or other diseases in the course of carrying out an activity of epidemiological significance (food production). For this purpose, it is necessary to monitor the entry of persons into the Company’s premises and to identify these persons (name and surname, identity card, declaration of infection-free status). The legal basis for the processing of personal data in this case is the fulfilment of a legal obligation (see Article 6(1)(c) of the Regulation), which applies to the Controller on the basis of Act No. 258/2000 Coll., on the Protection of Public health and on Change to Certain Related Acts, as amended (production facilities of the Dobrovice and České Meziříčí sugar factories and the Mělník Packing Centre).
   • The fulfilment of regime measures pursuant to Act No. 224/2015 Coll., on the Prevention of Major Accidents Caused by Selected Hazardous Chemical Substances or Chemical Mixtures and on the Change to Act No. 634/2004 Coll., on Administrative Fees, as amended (the Prevention of Major Accidents Act), and Decree No. 225/2015 Coll., on the Determination of the Scope of Security Measures for the Physical Protection of Facility Classified as Group A or Group B, to prepare a plan for the physical protection of the facility or equipment, including regime measures. For this purpose, it is necessary to monitor the entry of persons into the Company’s premises and identify these persons unambiguously (name and surname, identity card, number plate). The legal basis for the processing of personal data is the fulfilment of legal obligations of the Controller (see Article 6(1)(c) of the Regulation) under the above-stated legal regulations, i.e. the Prevention of Major Accidents Act and Decree No. 225/2015 Coll. (production facilities of the Dobrovice, Kojetín, and Kolín distilleries).
   • The Company also keeps records of access of visitors to the Company’s premises for the purpose of ensuring:

Personal data processed from the presented ID card or other identification card are obtained either by a simple transcription of the copy of the data into the Company’s system by our employee or by a reading system (i.e. it will be processed electronically). The reading system is set up in such a manner that from the ID card red (or other identification card) it sends only the necessary, above-stated range of data to the Company’s system for further processing. The Controller has defined the necessary scope of the processed data in accordance with the principle of data minimisation within the meaning of Article 5(1)(c) of the Regulation. For the avoidance of doubt, we would like to point out that the retrieval of the above-stated scope of personal data for the processing by the Controller is also carried out in accordance with Act No. 269/2021 Coll., on ID Cards, and in no way constitutes the acquisition of a copy of the ID card; therefore, it cannot be equated with the above-stated acquisition.

1. • The Company also informs visitors that it operates a camera system - the system of individual cameras that are connected by metal wiring to a dedicated storage facility where they store video footage when motion is detected. The camera system is aimed at monitoring both outdoor and indoor areas. Within the indoor areas, entrances to buildings (doorways), warehouses, production and operational areas are monitored (not areas where the rights of natural persons in the area could be interfered with). Before the entrance to the monitored area itself, information about the fact that the area is monitored is visibly displayed.
   • The legal basis for this processing of personal data is the legitimate interest of the Company within the meaning of Article 6(1)(f) of the Regulation.
   • The Company’s legitimate interest in the operation of the CCTV system is the protection of the Company’s property, or that of third parties who have property there, and to ensure the safety of the life and health of persons on the Company’s premises and the Company’s interest in the proper investigation of any infringement. From a security point of view, it is also necessary to be able to check that the stay on the Company’s premises is carried out in accordance with the rules of safety and fire protection. The monitoring of outdoor areas is then focused on monitoring of technological parts, as well as areas on the borders of the premises are monitored in order to monitor unauthorised access to the premises (fencing).

Rights of visitors as personal data subjects

Every visitor (data subject) has the right under data protection regulations to request:

Access to personal data	(Article 15 of the Regulation)
Rectification/completion of data	(Article 16 of the Regulation)
Erasure of data	(if conditions of Article 17 of the Regulation are met)
Restriction of the processing of data	(if conditions of Article 18 of the Regulation are met)
Data portability	(if conditions of Article 20 of the Regulation are met)
Object of processing	(if conditions of Article 21 of the Regulation are met)

You also have the right to contact the supervisory authority, which is the Office for Personal Data Protection, having its registered office at Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.cz) with your complaint or suggestion.

Period of processing (storage) of personal data

Personal data relating to visitors will be stored by the Controller:

1. • In the case of the processing of PD for the purpose of ensuring protection against threat or damage caused to the health of natural persons by infectious or other diseases in the performance of an activity of epidemiological significance (food production) - for the period of 12 week.
   • In the case of the processing of PD for the prevention of serious accidents - for 12 weeks.
   • In the case of the processing of PD on the basis of legitimate interest for the purpose of ensuring the protection of property, the safety of persons when moving around the Company’s premises, and the protection of life and health of persons - records of entries for the period of 12 weeks.
   • CCTV images are retained for 7 days, after which the video recording is automatically deleted.

Note. The above-stated periods of the processing/retention of personal data may be extended in justified cases, for the time strictly necessary to protect the Company’s rights and legally protected interests (e.g. dealing with accidents and emergencies, recovering claims, defending against third party claims through out-of-court, judicial or enforcement proceedings, investigating infringements, dealing with insurance claims, etc.).

The recipient of the personal data may be:

1. • only the authorized persons of the Controller;
   • the competent control authorities of the public administration in the case of carrying out checks to ascertain the Company’s compliance with its legal obligations, namely the competent public health authorities, the competent regional authority, the Czech Environmental Inspectorate, etc.; and
   • in the event of an investigation of an emergency in which it is necessary to identify persons present at a certain point in time on the premises and to other entities conducting an investigation of such an event. In this case, the personal data will be disclosed to the entity conducting such an investigation, i.e. generally the Police of the Czech Republic.

The recipients of personal data are the following processors who provide security and concierge and reception services for the Controller on the basis of a contractual relationship:

1. • the company D.I.SEVEN SERVICE s.r.o., having its registered office Mikulandská 119/10, 110 00 Prague 1, ID No.: 27195571, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 103569 (the premises of the Dobrovice facility and the premises of Mělník packing centre);
   • the company BOS-PCO s.r.o., having its registered office at Za Pivovarem 611, Chrudim III, 537 01 Chrudim, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C 21270 (the premises of the České Meziříčí facility);
   • the company DIOL družstvo, having its registered office at Litovelská 1350/2a, Nová Ulice, 779 00 Olomouc, ID No.: 00031551, registered in the Commercial Register kept by the Regional Court in Ostrava, File No. DrXXIII 252 (the premises of the Kojetín distillery); and
   • the company Komplexní služby věřitelům s.r.o., having its registered office at Prokopova 164/12, Žižkov, 130 00 Prague 3, ID No.: 60466766, registered in the Commercial Register kept by the Municipal Court in Prague, File No. C26861 (the premises of the Chrudim distillery).

Personal data will not be transferred to a third country or international organisation.

More detailed information on the processing of personal data is regulated by the Company’s internal regulation entitled the “Information Memorandum on Processing of Personal Data (General) of Company Tereos TTD, a.s.”, which is available on request at the place of processing / on the Company’s website www.tereos-ttd.com.

On Dobrovice on 1 June 2022

Tereos TTD, a.s.

Ing. Martin Kolář, Ph.D.,
Chairman of the board of Directors