ALIVE APP Privacy Policy 1. Introductory Provisions 1.1. This Privacy Policy of the ALIVE APP and ALIVE Profile (the “Policy”) is intended to provide information about the processing of ALIVE APP user data and ALIVE profile user data. 1.2. The ALIVE APP mobile application (the “App”) and the user profile including the ALIVE profile user interface (the “ALIVE profile”) are established and operated by GTS ALIVE s.r.o, Commercial Reg. No. 26193272, with its registered office at Na Maninách 1092/20, Holešovice, 170 00 Prague 7, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 78560 (“GTS”). 1.3. The purpose of the App is to provide a digital pass and access to a single ALIVE profile, which will be displaying and storing issued cards, purchased insurance and other functionalities. In addition to that, if the user agrees so, relevant content will be displayed thereto, including receipt of selected commercial communication by electronic means, and as a reward the user may take advantage of the opportunity to participate in marketing events designed for news subscribers – such as consumer competitions. 1.4. The App is intended without restriction for all natural persons (the “User”), including holders of any of the ALIVE, ISIC, ISIC SCHOLAR, ITIC and IYTC cards (the “Card”) and including holders of any Card or digital card issued during their studies at an educational establishment/school/university/higher education institution (the “School”) according to the internal procedures of the School. 1.5. Users under the age of 15 do not have access to remarketing and ad serving or other marketing features. 1.6. By using the App or ALIVE profile, the User agrees and undertakes to comply with the Terms of Use of the ALIVE APP, and acknowledges and declares that they understand the information on the processing of personal data in accordance with this Policy. 2. Controller and Contacts 2.1. The personal data controller is the company GTS ALIVE s.r.o., Commercial Reg. No.: 26193272, with its registered office in Prague 7, Na Maninách 1092/20, postal code 170 00, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 78560. 2.2. The controller may by contacted: • By phone at 226 222 335, • By fax at 226 222 300, • By e-mail to legal@isic.cz, • By mail to GTS ALIVE s.r.o., Commercial Reg. No.: 26193272, Prague 7, Na Maninách 1092/20, postal code 170 00. 3. Data Protection Officer and Contacts 3.1. The Controller has appointed a Data Protection Officer – Mgr. Karel Beck. 3.2. Contacts to the Data Protection Officer: • e-mail: karel.beck@isic.cz, • Tel: + 420 226 222 325 • Mailing address: GTS ALIVE s.r.o., Data Protection Officer, Prague 7, Na Maninách 1092/20, postal code 170 00. 4. ALIVE Profile 4.1. Purpose: GTS allows you to get an overview of all your products and provides access to other functionalities according to the Terms of Use of the ALIVE Profile. The Profile is accessible via the web interface on isic.cz or via the ALIVE APP mobile application. If necessary in relation with service in question, service messages will be sent to the contacts of your choice. The purpose of the ALIVE APP is to provide a digital pass and access to a single account MY ACCOUNT, which will be displaying and storing issued cards, purchased insurance and other functionalities as set forth in the Policy. 4.2. Legal basis for data processing: performance of the contract, consent, legitimate interest. You have the right to revoke your consent with and object to data processing at any time. 4.3. Period of processing: till the profile is cancelled; processing thereafter is only admissible in case of legitimate interest as is set forth here. 4.4. Categories of personal data concerned: identification and contact details, details of the Card and details of the products used. Besides that, data on the profile activity, granted consents and selection of settings (segmentation of displayed information) are stored too. If your photo has not been stored to the database by your school, you need to upload it yourself. With regard to the purpose of the identity card, which is your identity verification, it your photograph needs to be authenticated; the process of identity authentication for this purpose is performed in accordance with this Policy. 4.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 5. Discount Search Engine and Favorite Discounts 5.1. Purpose: After logging in, you can view a list of discounts adapted to active cards. If you give your consent to GTS, we will display discounts on the map according to your location. Your search history is available to you too. In addition to that, any User logged in can send their feedback to GTS. Logged-in Users can also save discounts among their favorites. 5.2. Legal basis for data processing: performance of the contract, consent and legitimate interest. The consent may be revoked at any time. You have the right to object. 5.3. Period of processing: throughout the use of the App. Data may be deleted through set up in the telephone or through uninstallation of the App. 5.4. Categories of personal data concerned: discounts, filtering, history, information concerning the logged-in User and discounts relevant thereto, technical data. 5.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 6. Competitions and Events 6.1. Purpose: Any User who has an active ALIVE profile and who has given consent to reception of selected information (and direct marketing according to this Policy), has the opportunity to participate in competitions organized by GTS ALIVE as a reward for such consent. Participation of Card Holders in any competition is voluntary and may be terminated at any time. 6.2. Legal basis for data processing: legitimate interest in rewarding the news subscribers in the form of consumer competitions. Users may object to the legitimate interest at any time. 6.3. Period of processing: equals to the duration of the competition in question plus the following 6 months thereafter. In the event of objections or withdrawal from the competition, data processing shall be terminated immediately. If the data retention period expires or objections are filed/the competition is withdrawn from, only a limited scope of the most important documents shall be retained for the purpose of inspections by supervisory authorities as is set forth here. 6.4. Categories of personal data concerned: sign-up to the competition, competition task, identification and contact details, information on the prize and the prize awarding, related communication. 6.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 7. Product Information and Browsing 7.1. Purpose: one of the App functionalities consists in the opportunity to display the current or the past insurance of the User. Insurance policies may also be manually complemented by the User. 7.2. Legal basis for processing: performance of the contract. 7.3. Period of processing: throughout the use of the App. Data may be deleted through set up in the telephone or through uninstallation of the App. 7.4. Categories of personal data concerned: User details, insurance data and technical data. 7.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 8. Overview of Passes and their Use 8.1. Purpose: the key functionality of the App consists in the opportunity to display active Cards/Passes and their digital use. 8.2. Legal basis for processing: performance of the contract. 8.3. Period of processing: throughout the use of the App. Data may be deleted through set up in the telephone or through uninstallation of the App. 8.4. Categories of personal data concerned: User’s Cards/Passes details and technical data of the digital Pass. 8.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 9. Marketing 9.1. Purpose: In addition to that, if you give a consent in the ALIVE profile thereto ad if you are over 15 years of age, relevant content will be displayed to you, including receipt of selected commercial communication by electronic means, and as a reward you may take advantage of the opportunity to participate in marketing events designed for news subscribers – such as consumer competitions. Once you give your consent the notifications shall appear in your ALIVE profile. Marketing communications include (but not exclusively): • exclusive offers and competitions, • selected (tailor-made) commercial communications from GTS and GTS ALIVE business partners that are of interest to the User according to the continuous evaluation and updating of their Personal Data and information on their activity within the ALIVE profile, on the use of the User’s Pass/Card with GTS business partners and on the User’s preferences observed during their use of the Website and FB, performed by all and any means of communication (by mail, telephone, including the use of electronic communication), • direct marketing by direct contacting, by agreed notifications and by displaying of relevant content according to the Holder’s specified preferences and to the User’s identified activities. 9.2. Legal basis for data processing: your consent that can be revoked at any time. You have the right to object to the implementation of direct marketing. You can ask us at any time to stop sending commercial communications, in your ALIVE profile in the section “Legal documents and settings of personal data processing” and in each individual commercial communication. If you wish to revoke your consent with the processing of Personal Data for the purpose of personalized commercial communications, marketing, market research and direct marketing, you can do so in your ALIVE profile in the section “Legal documents and settings of personal data processing”. 9.3. Period of processing: indefinite period; however, never longer than until you revoke the consent or cancel the ALIVE profile. Longer retention of selected documents is possible only in order to meet legal obligations or to fulfill an established legitimate interest. 9.4. Categories of personal data concerned: identification and contact details, details of the products/services used and data about activity in the profile and App. If the User’s preferences are identified, they are retained in order to select relevant communications and displayed content. The content is displayed according to the detected activities and used products and according to other identified information about the User relevant to their interests. 9.5. Data recipients and categories of data processors: By principle, we never pass on your personal data to third parties unless necessary. In such a case, we will inform you of the necessity of such transfer. We will always inform you about passing your data on to a third party or to countries outside the EU. In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 10. Identity Verification and Uncompleted Activation 10.1. Purpose: In view of the fact that it is a priority for GTS to comply with applicable legislation and in terms of ensuring proper process of matching the Holder’s products and services in the ALIVE APP, the following procedure of double verification during the activation process is in place: • Users enter their e-mail and password to confirm the e-mail, which they must actively do via the received link, otherwise it is impossible to proceed with the activation; • Once the User’s e-mail is verified, they enter their first name, last name and date of birth to verify their age and identity and to assign the User’s (Pass/Card Holder’s) products; • If the Holder is under 15 years of age, they need to enter the e-mail of their legal guardian who will be requested to perform the confirmation – more about confirmation by parents here – it is impossible to complete activation and to for instance display digital Pass/Card without such confirmation by the legal representative; • In the event that a certified electronic photograph is not registered with the Holder, the Holder (or legal guardian thereof) shall proceed in accordance with the procedure set out here. 10.2. Legal basis for data processing: performance of the contract, specifically performing of actions prior to the contract conclusion at the request of the person concerned. 10.3. Data recipients: In order to ensure operation of all our activities, we use the following suppliers and/or categories of data processors: accountants, couriers, auditors, legal advisers, IT service providers, webmasters, marketing agencies, Pass/Card manufacturers, repository providers, companies ensuring additional benefits linked to Passes/Cards and GTS ALIVE sales representatives (natural persons). 10.4. Data retention period: the e-mail and password are stored for confirmation purposes for a maximum of 14 days; if the e-mail is not confirmed during this period, the data are safely destroyed. If the user is under 15 years of age, their data are stored for a maximum of 14 days in order to approve the activation by their legal representative; if the activation is not so approved all user data are safely destroyed. If the procedure of a User activation is properly completed and all necessary verifications and confirmations are performed, the data are stored in the manner and for the period as is set forth herein. Legitimate interests to protect rights are explained here. 10.4.1. Categories of personal data concerned: identification and contact details, log files (or documents) of approval and any related communications. 11. Legitimate Interest 11.1. Purpose: If GTS performs the above data processing then, after completion thereof, GTS collects a limited range of documents and personal data in order to protect its own rights and to defend itself against claims as well as in legal/administrative/review and other proceedings. 11.2. Range: For the above purpose, GTS only retains a limited range of documents – such as consents, records of legal acts and other legal documents. 11.3. The legal basis for data processing with this purpose is GTS’s legitimate interest in protecting its rights, demonstration of compliance and defense against supervisory authorities. You have the right to object to this legitimate interest at any time. 11.4. Period of processing: The so data collected are kept by GTS for a period of 3 years from the expiration of the processing period set for other purposes set forth in this Policy. The period shall not be terminated before commencement of a court or other proceedings and of the related time limits for appeals and remedies. 12. Rights12.1. In order to ensure a sufficient level of security of personal data processing and protection, GTS has appropriate technical and organizational measures in place that are up to date with the current development of technical means, that contribute to the security of personal data processing, and in particular prevent unauthorized access to, theft or misuse of personal data. You have the rights guaranteed in this article throughout all and any processing of your personal data.12.2. Right of access to personal data – you have the right to receive, without undue delay, from GTS the information on which of your personal data are being processed, for what purpose, who are your personal data recipients, what is the period of the data processing and about your rights.12.3. Right of rectification – you have the right to the correction of inaccurate personal data or to the completion of missing data by GTS without undue delay.12.4. Right of erasure (“right to be forgotten”) – you have the right to the deletion of your personal data by GTS without undue delay;12.5. Right to restriction of your personal data processing – if you wish to exercise this right, please contact GTS at the above contacts.12.6. Right to data portability – you have the right to obtain your personal data provided to GTS that have been processed automatically based on your consent, in a structured, commonly used and machine-readable format, the right to transfer such data to another controller and the right to get the personal data transferred directly to the other controller, if technically feasible.12.7. The right to object to the processing of personal data concerning you. GTS does not further process personal data unless it demonstrates substantial legitimate reasons for the processing that outweigh your interests, rights or freedoms, or for the determination, exercise or defense of legal claims. If your personal data are processed for direct marketing purposes, you have the right to object to the processing thereof for such purpose, including profiling, at any time. If you object to such processing, your personal data will no longer be processed for this purpose.12.8. Right to file a complaint to the supervisory authority, which is the Office for Personal Data Protection, with its office at: Pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice, www.uoou.cz.12.9. You have the right not to be a subject of any decision based solely on automated processing, including profiling, which has legal effects for you or significantly affects you in a similar way. GTS does not base any of its decisions solely on automated processing.12.10. You can request, free of charge and at any time, a partial or complete deletion or blocking of your personal data, or you can request information about your personal data retained by GTS and request the correction thereof. In order to do so, you do net need any particular form. Simply contact us at the above contacts.12.11. We will process all your requests without undue delay, in justified cases within a maximum of 30 days.12.12. If you wish to exercise your rights (as a data subject) against GTS (as a data controller) or if you have any requests, questions or complaints concerning your personal data, please contact us at contacts. 13. Final Provisions 13.1. Further information on personal data processing may be found here. 13.2. GTS is not responsible for the availability of the App, ALIVE profile and/or components thereof. 13.3. In the event that the App or the ALIVE profile contains links to third parties’ websites, GTS shall not be responsible for their content and for these links, nor for any personal data processing thereby. 13.4. This Policy is effective from 19 July 2021. GTS has the right to change the Policy with effect from the date of notification.