INFORMATION MEMORANDUM - Personal Data Processing on the website

1. INTRODUCTION

1.1 The ARETE Group (“we”, “us” or “ARETE Group”) is an investment Group which, in the course of its business activities, operates and uses the www.arete.eu website (the “Website”) to provide information about the activities of the ARETE Group, investment opportunities, employment opportunities, contact opportunities, and other information to the Website visitors. These activities also involve the processing of personal data of various persons.

1.2 The purpose of the present document is to provide information on how the personal data of website users is processed, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter the “Regulation”). In addition, this document also contains information on how the personal data of users of the ARETE Group’s social media fan pages is processed.

1.3 The information contained in this document applies in particular to website users, natural persons providing personal data to the ARETE Group and, to a reasonable extent, also to prospective users or former users. The information contained herein shall also apply mutatis mutandis to the representatives or contact persons of the users, always to the extent of the personal data corresponding to their position in relation to the ARETE Group. For simplicity, all such persons are hereinafter referred to as “Users”.

2. PERSONAL DATA PROCESSING PRINCIPLES

2.1 When processing users’ personal data, we honour and respect the highest data protection standards and particularly comply with the following principles:

(a) We process users’ personal data in a correct, lawful, and transparent manner;

(b) We collect personal data solely for specific, explicit, and legitimate purposes, and we do not further process the personal data in a manner incompatible with such purposes;

(c) The scope of the personal data processing is adequate, relevant, and restricted to the fulfilment of the stated purposes;

(d) We have adopted any and all reasonable measures so as to process solely accurate and updated personal data and so as to erase or rectify any inaccurate personal data without any delay;

(e) We store personal data for the period necessary for the purposes for which it is processed;

(f) We process personal data only in a manner that ensures its proper security, including its protection by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

3. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER AND THE DATA PROTECTION OFFICER

3.1 Personal Data Controller The Personal Data Controller is ARETE Property s.r.o.., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 04022521, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 241317, which is the website operator.

Since the website is operated for the benefit of the entire ARETE Group, ARETE Group companies other than ARETE Property s.r.o. may also be the personal data controller, depending on the circumstances and the nature of the personal data requested/provided (for example, in the case of a job advertisement, the company that posted the job advertisement is the controller). A list of the relevant ARETE Group companies is attached to this document. Upon request, we will be happy to provide you with the identity of the controller in every individual case.

If you have any questions regarding the processing of your personal data, please, contact us in person at náměstí 14. října 642/17, 150 00 Prague 5, by phone at +420 226 808 901, or by e-mail at: info@arete.eu. This applies regardless of which specific ARETE Group company is the controller of your personal data.

4. PURPOSES AND LEGAL BASIS FOR PROCESSING The ARETE

Group processes users’ personal data in the following cases:

4.1 The processing of users’ personal data is necessary for the purposes of the performance of the contract or for the implementation of measures taken prior to the conclusion of the contract or for the provision of services to users. This applies in particular to the following personal data processing instances:

(a) Processing of personal data of job applicants for the purposes of a specific selection procedure (subsequently, personal data may only be processed with consent);

(b) Informing you about the ARETE Group on social media based on your following of the ARETE Group’s fan pages.

4.2 Processing is necessary for the purposes of the legitimate interests pursued by the ARETE Group. The ARETE Group may process users’ personal data without their consent if the legitimate interests of the ARETE Group (individual Group companies) outweigh the interests or rights and freedoms of users to protect their privacy and personal data. These are the following legitimate interests of the ARETE Group:

(a) Handling of mutual communication entered through the website or other communication channels;

(b) Presenting the ARETE Group to media and communication with journalists;

(c) Ensuring the proper operation of the website, including the use of necessary cookies.

4.3 In specific cases, the ARETE Group processes personal data for purposes to which none of the aforementioned legal bases apply. In such cases, the processing is based on the user’s consent, where the user is also informed of the purposes of such processing and of the possibility to withdraw their (freely given) consent. This is the case, for example, where we want to retain the personal data of an unsuccessful job applicant in order to offer him/her other jobs, or where we use non-essential cookies (analytical or marketing cookies) and you are asked to consent to their use.

5. CATEGORIES OF PERSONAL DATA CONCERNED

5.1 The ARETE Group processes users’ personal data to the extent necessary to fulfil the aforementioned purposes. In particular, the following data is processed:

a) Users’ identification and contact details (e.g. name, surname and title, mobile phone number, email address);

b) Data provided in connection with applying for the selection procedures, including information contained in the CV;

c) Data related to the services provided, including, for example, data on ARETE Group’s social media activity;

d) Other miscellaneous personal data voluntarily provided by the user to the ARETE Group, for example, in the context of mutual communication.

6. PERSONAL DATA SOURCES

6.1 We obtain your personal data mainly from:

(a) Users on the basis of requests from users and in the context of mutual communication;

(b) Third parties authorised to handle and transfer users’ personal data to us, subject to the conditions set out;

(c) Publicly available sources, in particular from the Commercial Register, Insolvency Register, Cadastre of Real Estate, database of invalid documents of the Ministry of the Interior of the Czech Republic, database of records from the active search records of the Police of the Czech Republic, Central Register of Executions, and other publicly available registers and databases.

(d) Our own work in evaluating the data that users provide to us.

7. PERSONAL DATA PROCESSING

7.1 The personal data of users is processed mainly by employees or persons cooperating with the ARETE Group. The method, using which the ARETE Group processes users’ personal data, includes both manual and automated processing in the ARETE Group’s information systems.

8. PERSONAL DATA RECIPIENTS

8.1 Users’ personal data is transferred to third parties that cooperate with ARETE Group and are involved in the processing of users’ personal data, or the personal data may be disclosed to them for other reasons in accordance with applicable law. Due diligence is exercised to ensure an adequate level of protection for the personal data processed, in particular, a contract for the processing of personal data is concluded with third parties, which contains adequate safeguards for the processing of personal data, such as those observed by the members of the ARETE Group, in accordance with their legal obligations.

8.2 In particular, personal data may be transferred in this way in connection with the performance of legal obligations (transfer to public authorities) or in connection with the provision of services by the ARETE Group (to subcontractors of the ARETE Group) who need access to such personal data in connection with the performance of their contractual obligations to the ARETE Group;

8.3 The users’ personal data is processed exclusively in the Czech Republic or, where applicable, in the Slovak Republic.

9. PERSONAL DATA PROCESSING PERIOD

9.1 The ARETE Group processes users’ personal data only for the necessary period of time appropriate to the purpose of the processing while continuously assessing whether there is still a need to process certain personal data necessary for a particular purpose. If we discover that data is no longer required for any of the purposes, for which it has been processed, we will dispose of the data.

9.2 The personal data processing period, for the purposes of legitimate interests, is assessed on an ongoing basis within the ARETE Group and does not normally exceed 3 years.

9.3 In cases where the processing is based on consent, ARETE Group processes personal data for the duration of such consent.

10. COOKIES

10.1 Cookies are used on the website. Cookies are small text files that are stored on your computer when you visit a website. In particular, cookies allow the website to record information about your visit and may be necessary for its proper functioning, allow for tracking the website use, allow for adapting the website to one’s preferences, or allow for selecting appropriate advertising. On this basis, cookies can be divided into the following categories:

(a) Necessary Cookies

Necessary cookies are used to make the website work as intended and enable basic functions, such as displaying the page and accessing restricted parts of the website. They are usually set up in response to your actions on the site, such as filling out forms or logging in. Without these cookies, the website cannot function properly. Necessary cookies are used to ensure the proper functioning of the website, on the legal basis of the legitimate interest of ARETE Property s.r.o.

(b) Analytical Cookies

Analytical cookies help website operators understand how visitors use the website. This data is usually used to improve the website's performance and functionality. They can measure, for example, the movement on a website, its load, and the data is usually aggregated (anonymised) before its use. Analytical cookies are only used if the user consents to this within the cookie bar displayed when visiting the website.

(c) Marketing Cookies

Marketing cookies are used to track website visitors with the intention of displaying advertising that is relevant and interesting to the individual users. This results in more effective ad targeting, which is beneficial for both the advertiser and the user. They also allow, for example, prevention of advertising being shown again. Marketing cookies are only used if the user consents to this within the cookie bar displayed when visiting the website.

11. SOCIAL MEDIA

11.1 The ARETE Group uses multiple social media (Facebook, LinkedIn, Twitter, and YouTube) for its web presence to inform about its activities.

11.2 Users of these social media have the opportunity to follow the ARETE Group and, where appropriate, communicate with it via these social media. The related processing of personal data of users of such social media by the ARETE Group is similarly subject to the information set out in this document. The ARETE Group does not process the personal data provided in any way other than to handle mutual communication and inform users about the activities of the ARETE Group.

12. USERS’ RIGHTS

In particular, users have the following rights in relation to the personal data processing by the ARETE Group:

(a) Right of access their personal data. The user has the right to obtain confirmation from the controller as to whether or not the personal data concerning him/her is being processed and, if so, the right to access such personal data and other specified information. In this case, the controller shall also provide the user with a copy of the personal data processed.

(b) Right to rectification. The user also has the right to have inaccurate personal data concerning him/her rectified by the controller without undue delay. Taking into account the purposes of the processing, the user has the right to have incomplete personal data completed, including by providing an additional declaration.

(c) Right to erasure (“right to be forgotten”). The user has the right to have the controller erase the personal data relating to the user without undue delay, and the controller is obliged to erase the personal data without undue delay if one of the grounds set out in the Regulation applies and the controller is not otherwise entitled to retain the personal data.

(d) Right to restriction of processing. The user has the right to have the controller restrict the processing of his/her personal data, in particular if the user contests the accuracy of the personal data, if the user objects to the processing, and in other cases provided for in the Regulation.

(e) Right to data transferability. The user has the right to obtain from the controller the personal data relating to him/her, which he/she has provided to the controller in a structured, commonly used, and machine-readable format and transfer such data to another controller where the processing is based on consent or is carried out on the basis of a contract and by automated means.

13. RIGHT TO WITHDRAW CONSENT AND RIGHT TO OBJECT

Without prejudice in any way to the rights under the previous article 10, the ARETE Group draws particular attention to the following rights:

(a) The right to withdraw consent. In the case of consent-based processing of the user’s personal data, the user is not obliged to give his/her consent to the processing and, if he/she does, he/she is also entitled to withdraw his/her consent at any time. If the user wishes to withdraw his/her consent to the processing of personal data, he/she may contact the controller using the contact details provided above. Withdrawal of consent does not affect the processing of the user’s personal data in cases where the user’s consent is not required.

(b) Right to object. In situations where the user’s personal data is processed for the purposes of protecting the legitimate interests of the controller, the user is entitled to object to such processing. In such a case, the controller must demonstrate compelling legitimate grounds for such processing under the conditions set out in the Regulation; otherwise, the processing of the personal data shall cease.

14. RIGHT TO LODGE A COMPLAINT

If the user believes that the processing of his/her personal data by the ARETE Group violates legal provisions, in particular the Regulation, the user may address his/her complaint to the Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Prague 7, Phone: +420 234 665 111, website: https://www.uoou.cz/.

15. FINAL PROVISIONS

This Information Memorandum shall enter into force and effect as of 1 June 2022.

Annex: List of ARETE Group Members

- ARETE Property s.r.o., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 04022521, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 241317;

- ARETE INDUSTRIAL SICAV a.s., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 08031444, registered in the Commercial Register kept by the Municipal Court in Prague under File No. B 24315;

- ARETE Capital s.r.o., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 08829420, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 326019;

- ARETE RE s.r.o., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 11862327, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 355546;

- ARETE GLP s.r.o., with its registered office at náměstí 14. října 642/17, Smíchov, 150 00 Prague 5, Company ID: 11862530, registered in the Commercial Register kept by the Municipal Court in Prague under File No. C 355548;

- Arete Property SK s.r.o., with its registered office at SKY PARK OFFICES 1, Bottova 2A, 811 09 Bratislava - mestská časť Staré Mesto, Slovensko, Company ID: Regi