Information on the processing of personal data - Hanwha Advanced Materials Europe

Domů Information on the processing of personal data

Valid from 10.8.2026

At Hanwha Advanced Materials Europe s.r.o., Company ID: 28198638, with its registered office at Příborská 280, Chlebovice, 739 42 Frýdek-Místek, CZ11912634, registered in the Commercial Register maintained by the Regional Court in Ostrava under Section C, File 32401 hereinafter referred to as “Hanwha”), we pay great attention to the protection of personal data. In this document you will find information about what personal data we process about you, whether we process the data on the basis of consent or on the basis of another legal reason, for what purposes we use it, to whom we can transfer it and what rights you have in connection with the processing of your personal data.

A. WHO DETERMINES HOW PERSONAL DATA WILL BE PROCESSED?

We at Hanwha determine for what purpose and by what means your personal data will be processed and we are responsible for such processing. This role of ours arises from our position as a personal data controller (hereinafter referred to as the “Controller”).

B. WHAT PERSONAL DATA DO WE PROCESS?

B.1. Identification data

In particular, your first name, surname and all former surnames, as well as any academic or professional titles, date and place of birth, personal identification number, permanent address and/or correspondence address, place of residence, gender and nationality, as we need to know who our employee, supplier or client is, or who acts on their behalf.

B.2. Contact details

In particular, we process your telephone numbers and email addresses so that we can contact and communicate with you in connection with the performance of your employment duties, if you are our employee, or in connection with the conclusion and performance of a contract, if you are our client or supplier or act on their behalf. This category also includes the business contact details of contact persons representing our customers and suppliers (first name, surname, business email address, telephone number and job title), which we process for the purposes of business communication, managing contractual relationships and other similar activities.

B.3. Data on services and products provided

We also process your data in connection with the services and products you have ordered from us in order to maintain complete records of their proper provision and delivery.

B.4. Payment, payroll and accounting data

We process data relating to your payment methods and bank accounts, as well as information contained in invoices and other tax and accounting documents, in order to properly monitor and settle payments for the services and products provided. If you are our employee, we also process information concerning your salary and statutory contributions, the bank account number used for salary payments, information on whether you receive an old-age, disability or other pension and the type of pension concerned (as these circumstances affect the calculation of statutory contributions), as well as information concerning wage garnishments and deductions made under a wage deduction agreement.

B.5. Communication Data and Data Arising from Communications

When communicating with us through various channels, you may provide us with different types of personal data. We will process such personal data together with information about when and how the communication took place.

B.6. Employment-related data

If you are our employee, we will also process personal data necessary for the proper administration of the employment relationship and compliance with the employer’s statutory obligations. This includes, in particular, documents and information concerning your education, previous work experience, professional qualifications and language skills, as well as your marital status; information about your spouse (first name and surname) for the purpose of claiming an income tax allowance; information about your dependent children (first name, surname, date of birth and national identification number) for the purpose of claiming child tax relief; and information about any other persons dependent on you. We also process the name of your health insurance provider and information concerning your health or status as a person with a disability (ZTP/ZTP-P) to the extent necessary for compliance with the employer’s statutory obligations under the Labour Code and other employment legislation. Please note that health data constitutes a special category of personal data within the meaning of Article 9 of the GDPR and is processed exclusively on an applicable statutory basis. Furthermore, we process your clothing and footwear sizes solely for the purpose of providing personal protective equipment and workwear.

B.7. Data Relating to the Use of Our Website

When you use our website, certain data is automatically transmitted from your device as a visitor to our website. From the logs, which also record information about the activities of our website users for security purposes, we can identify the actions you have taken on the website and information entered into online forms. To ensure the optimal display of our website and services, we use information about your operating system (such as iOS or Android) and its version, as well as technical data about the devices you use to access our website (such as the type of smartphone). This enables us to continuously improve our services and adapt them to current technological capabilities.

B.8. Data Obtained from Cookies and Other Tracking Technologies

If your browser allows cookies to be stored, we collect additional information through them, such as information about the pages you visit and your user preferences. This category also includes data obtained through similar tracking technologies. Further information about our use of cookies and the collection of data relating to your online activity is available in our Cookie Policy.

B.9. Visual Recordings and Images

If you are our employee, we will also process certain images and visual representations of you, including photographs.

B.10. Visual Recordings and Images

We operate a CCTV system on the Company’s premises for the purposes of protecting property and individuals’ health and preventing unlawful conduct, and not for the purpose of monitoring employees’ work performance. As part of the operation of the CCTV system, we process visual recordings of individuals present in monitored areas. Monitored areas are always clearly marked with information signs. Access to CCTV recordings is restricted exclusively to duly authorised persons.

C. WHAT IS OUR LEGAL BASIS FOR PROCESSING PERSONAL DATA?

As part of our business activities, we process the personal data listed above for various purposes and to different extents, as described below:

C.1. Offering and ordering our services and products

In order for you to order or arrange the delivery of the services and products we offer, we need to process your personal data. For this purpose, we may process identification data, contact details (including the business contact details of our customers’ and suppliers’ contact persons), payment and accounting data, communication data and data arising from communications, and data relating to the services and products provided.

The legal basis for this processing is the performance of a contract concluded as part of this process or taking steps prior to entering into such a contract.

We retain contractual documentation relating to customers and suppliers for the duration of the contract and for 10 years following its termination. We process the contact details of customers’ contact persons on the basis of our legitimate interests for five years from the date of the last contact, and the contact details of suppliers’ contact persons for five years following the end of the business relationship.

C.2. Compliance with legal obligations imposed on us

As a company governed by Czech law, we are subject to certain statutory obligations. These typically include the obligation to record payments and maintain proper accounting documentation, comply with consumer protection requirements where applicable, and properly identify our customers. These obligations also arise from legislation governing the maintenance of employee records and the related administration of taxes and statutory contributions, in particular Act No. 262/2006 Coll., the Labour Code; Act No. 586/1992 Coll., on Income Taxes; Act No. 187/2006 Coll., on Sickness Insurance; Act No. 582/1991 Coll., on the Organisation and Implementation of Social Security; and Act No. 592/1992 Coll., on Public Health Insurance Premiums. For this purpose, we may process, in particular, identification data, contact details, payment, payroll and accounting data, communication data and data arising from communications, data relating to the services and products provided, and employment-related data, including your national identification number pursuant to Section 13c of Act No. 110/2019 Coll. We may also process health data and information concerning your status as a person with a disability (ZTP/ZTP-P) pursuant to Article 9(2)(b) of the GDPR and the applicable employment legislation.

The legal basis for this processing is compliance with our statutory obligations. We generally obtain this data directly from you when you provide it to us during the process of entering into a contract or in the course of our mutual communications.

For these purposes, we process personal data for the periods specified by the applicable legislation. The Company retains employee personnel files for the duration of the employment relationship and for 10 years following its termination; payroll records and pension insurance record sheets (ELDP) for 45 years; working time records for three years; accounting documents for five years; and tax documents for 10 years. We retain the personal data of unsuccessful job applicants for six months following the completion of the recruitment process.

C.3. Protection of our legal interests and keeping internal records

We also need personal data to properly protect our rights and legal claims and to maintain internal records concerning our customers and clients, including personal data required for debt recovery or an effective defence in the event of a dispute (i.e. to enable us, as the Controller, to properly defend ourselves in court or in out-of-court, enforcement or similar proceedings where, without the processing of such data, the protection of our rights could be compromised or rendered impossible). For this purpose, we may process identification data, contact details, payment, payroll and accounting data, employment-related data, communication data and data arising from communications, and data relating to the services and products provided.

The legal basis for this processing is our legitimate interest in protecting our rights and legal claims and maintaining records of contractual performance.

Personal data is generally retained for the duration of the applicable statutory limitation period. We retain contractual documentation relating to customers and suppliers for the duration of the contract and for 10 years following its termination. Records of business communications and other documents required for the protection of legal claims are retained for the duration of the general statutory limitation period, but no longer than 10 years from the relevant legal event.

C.4. Creation, evaluation and adaptation of processes within the HR department

If you are our employee, we also use certain personal data for the development, evaluation and adaptation of HR and remuneration systems, the preparation of employee equity participation models, the management of other strategic initiatives, the preparation of corporate presentations, the registration of employees for training events and the provision of personal protective equipment. For these purposes, we may process identification data, contact details, visual recordings and images, payment, payroll and accounting data, employment-related data (including information concerning marital status, dependants, health insurance provider, health status/disability status and clothing and footwear sizes), and communication data and data arising from communications.

The legal basis for this processing is our legitimate interest in improving the efficiency of our internal processes and developing new processes within the Company. In certain cases, you may also provide your consent to the processing of your personal data.

We retain personal data processed as part of HR processes in accordance with the Company’s personal data retention schedule: employee personnel files for the duration of the employment relationship and for 10 years following its termination; payroll records and pension insurance record sheets (ELDP) for 45 years; and working time records for three years. Where processing is based on consent, the retention period may be shortened if consent is withdrawn.

C.5. Promotion of our brand and marketing communication

We also use personal data when presenting offers for our services and products or promoting our brand and Company, including sending news and newsletters. However, we do not wish to inconvenience you with unnecessary or irrelevant communications. We therefore use the personal data collected to better understand your needs and offer suitable solutions. We may communicate with you through a wide range of channels, particularly by post and email, as well as through SMS messages, notifications and pop-up windows on our website. For these purposes, we may process, in particular, identification data, contact details, data relating to the use of our website, and data obtained from cookies and other tracking technologies.

The legal basis for this processing is our legitimate interest in promoting our brand, Company, services, products and website. In certain cases, you may also provide your consent to the processing of your personal data.

Where we process your personal data on the basis of our legitimate interests, we do so until you object to such processing or take another action from which we may reasonably conclude that you no longer wish your personal data to be processed for this purpose. You have the right to object to such processing.

Where we process your personal data on the basis of your consent, we do so until you withdraw your consent.

C.6. Operation of the Website

We process the personal data of visitors when they access or browse our website. We use cookies and other technologies that may involve the processing of personal data for the purposes specified below. Detailed information about what cookies are, which cookies and other technologies we use, and how long we process the data obtained through them is available in our Cookie Policy.

Website Operation and Security (Strictly Necessary)

The processing of personal data is necessary for the proper operation of our website, including its presentation, functionality and secure access. For this purpose, we may identify visitors when they browse or log in to our website, where such functionality is available. We therefore process data relating to the use of our website and data obtained from cookies and other tracking technologies to the extent necessary for the operation of the website (strictly necessary cookies).

The legal basis for this processing is our legitimate interest in ensuring the functionality and security of our website.

We generally retain personal data for up to two years following your visit to our website.

Website Customisation (Preferences)

The processing of personal data is necessary to remember your preferences, customise our website accordingly and provide you with a more convenient user experience. For this purpose, we customise the website based on your location, selected language or device. We therefore process data relating to the use of our website and data obtained from cookies and other tracking technologies to the extent necessary to customise the website (preference cookies).

The legal basis for processing data relating to the use of our website is our legitimate interest in customising the website according to visitors’ preferences. We generally retain your personal data for up to two years following your visit to our website.

With your consent, we also process data obtained from cookies and other tracking technologies used used to customise the website (preference cookies), and your data may also be disclosed to third parties. The legal basis for processing this data is therefore your consent, provided through the cookie banner. We retain your data for the duration of your consent, but under no circumstances for longer than two years from the date on which your consent was obtained.

Website Traffic Analysis (Statistics)

The processing of personal data is necessary to understand how visitors use our website. For this purpose, we monitor website traffic, optimise our website, safeguard the security of the website and your data, and improve the website’s performance and user-friendliness. The legal basis for processing data relating to the use of our website is our legitimate interest in collecting information about how our website is used and in its further development. We generally retain your personal data for up to two years following your visit to our website.

With your consent, we also process data obtained from cookies and other tracking technologies used to analyse traffic to our website (statistical cookies), and your data may also be disclosed to third parties. The legal basis for processing this data is therefore your consent, provided through the cookie banner. We retain your data for the duration of your consent, but under no circumstances for longer than two years from the date on which your consent was obtained.

Promotion and Marketing Through Our Website (Marketing)

The processing of your personal data is also necessary to collect information about your advertising preferences and subsequently present recommended products based on those preferences. For this purpose, we promote and sell services and products on our website, display marketing communications relating to services and products in which you have expressed an interest, and promote our brand through online advertising. The legal basis for processing data relating to the use of our website is our legitimate interest in promoting the sale of our products and services. We generally retain your personal data for up to two years following your visit to our website.

With your consent, we also process data obtained from cookies and other tracking technologies used for promotion and marketing through our website (marketing cookies), and your data may also be disclosed to third parties. The legal basis for processing this data is therefore your consent, provided through the cookie banner. We retain your data for the duration of your consent, but under no circumstances for longer than two years from the date on which your consent was obtained.

C.7. Management of Customer and Supplier Contact Persons

As part of our sales and procurement activities, we process the business contact details of our customers’ and suppliers’ contact persons (first name, surname, business email address, telephone number and job title) for the purposes of communication, the performance and administration of contractual relationships, and supplier management. We process this data as ordinary personal data relating to individuals acting in a professional or business capacity.

The legal basis for this processing is our legitimate interest in the proper performance of contractual obligations and the maintenance of business relationships within the meaning of Article 6(1)(f) of the GDPR.

We retain the contact details of customers’ contact persons for five years from the date of the last contact and the contact details of suppliers’ contact persons for five years following the end of the business relationship. We retain contractual documentation for the duration of the contract and for 10 years following its termination.

C.8. Operation of the CCTV System

We process CCTV recordings for the purposes of protecting the Company’s property and ensuring the safety of individuals on its premises. CCTV recordings are not made for the purpose of monitoring employees’ work performance. Monitored areas are always clearly marked with appropriate information signs, and access to the recordings is restricted exclusively to duly authorised persons.

The legal basis for this processing is our legitimate interest in protecting property and ensuring the safety of individuals pursuant to Article 6(1)(f) of the GDPR.

We generally retain CCTV recordings for 7 days. In the event of a security incident, the relevant recordings may be retained for as long as strictly necessary, with access remaining restricted exclusively to authorised persons.

D. FROM WHAT SOURCES DO WE OBTAIN PERSONAL DATA?

The personal data we process is obtained primarily from you, particularly during the process of entering into and performing a contract and through our mutual communications. You may also provide personal data to us in other ways, especially through our website. We may also collect personal data directly from you by monitoring your behaviour on our website.

We may obtain additional personal data from our partners who act as controllers of your personal data and provide it to us for processing in accordance with their instructions and purposes. In relation to such partners, we therefore act as a processor of personal data. In certain cases, we may also act as joint controllers with our partners.

Further information about processors and controllers of personal data is available in the section entitled “WHO PROCESSES YOUR PERSONAL DATA AND TO WHOM DO WE DISCLOSE IT?”.

E. WHO PROCESSES YOUR PERSONAL DATA AND TO WHOM DO WE DISCLOSE IT?

We process all the personal data referred to above in our capacity as the Controller. In exceptional cases, we may also process such data in our capacity as a Processor.

Where we act as the Controller, this means that we determine the purposes and means of processing your personal data, including, in particular, its collection, recording, organisation and, where applicable, disclosure, and we are responsible for ensuring that your personal data is processed properly. Where we act as a Processor, these purposes and means are determined by another party that holds your personal data in its capacity as the Controller. Such parties may include, in particular, your business partners whom you instruct to provide us with your personal data.

We may also disclose your personal data to other entities acting as controllers, for example to our partners involved in the performance of a contract with you.

We also use the services of other processors that process personal data solely in accordance with our instructions and for the purposes described above.

Such processors include:

Accounting service providers that administer the attendance system in this capacity
Auditors
Lawyers
Insolvency administrators
Enforcement officers
External IT service providers

F. WHEN WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE MEMBER STATES OF THE EUROPEAN UNION

When disclosing personal data to other controllers or to our processors referred to above, we may also transfer your personal data to third countries outside the European Union that do not provide an adequate level of personal data protection. Any such transfer will take place only if the relevant processor undertakes to comply with the Standard Contractual Clauses issued by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available on the European Commission’s website.

G. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA?

Just as we have our rights and obligations when processing your personal data, you also have certain rights when processing your personal data. These rights include::

G.1. Withdrawal of consent

Any consent we may request from you is entirely voluntary, and you are under no obligation to provide it.

However, refusing to provide or withdrawing consent for any of the purposes specified above will not affect our ability to send you commercial or marketing communications on the basis of our legitimate interests (see the purpose entitled “Promotion of Our Brand and Marketing Communications” above).

Where processing is based on your consent, you may withdraw it at any time by sending an email to hr@hanwhacz.cz or by taking any other action that clearly indicates your intention to withdraw your consent. The request must be sent from the email address we have on record for you so that we can verify your identity.

If you withdraw your consent, we will assume that you no longer wish us to process your personal data for marketing purposes, including on the basis of any marketing consent previously granted or any specific marketing consent. Any such additional marketing consent will therefore also be deemed withdrawn.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

G.2. Right of access

In simple terms, you have the right to know what personal data we process about you, for what purposes and for how long, where we obtain your personal data, to whom we disclose it, who processes it in addition to us, and what other rights you have in relation to the processing of your personal data. You can find all this information in this document. However, if you are unsure which personal data we process about you, you may ask us to confirm whether or not we process personal data concerning you and, if we do, you have the right to access that personal data. As part of your right of access, you may request a copy of the personal data being processed. We will provide the first copy free of charge, but we may charge a reasonable fee for any additional copies.

G.3. Right to rectification

If you discover that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.

G.4. Right to erasure

In certain circumstances, you have the right to have your personal data erased. We will erase your personal data without undue delay where any of the following grounds applies:

a) your personal data is no longer necessary for the purposes for which it was processed;

b) you withdraw your consent to the processing of personal data where your consent is required for such processing and there is no other legal basis for continuing to process the data;

c) you exercise your right to object to processing (see the section entitled “Right to Object to Processing” below) in relation to personal data processed on the basis of our legitimate interests, and we determine that there are no longer any legitimate grounds justifying such processing; or

d) you believe that our processing of your personal data is no longer compliant with generally binding legal regulations.

This right does not apply where the continued processing of your personal data is necessary for the purpose of “Protection of Our Legal Interests and Maintenance of Internal Records.”

G.5. Right to restriction of processing

In certain circumstances, in addition to the right to erasure, you may exercise the right to restriction of the processing of your personal data. This right allows you, in certain cases, to request that your personal data be marked and not be subject to any further processing operations. Unlike the right to erasure, however, this restriction applies only for a limited period. We are required to restrict the processing of your personal data where:

a) you contest the accuracy of your personal data, for the period necessary for us to verify its accuracy;

b) we process your personal data without a sufficient legal basis (for example, beyond the extent necessary), but you prefer the restriction of its processing to its erasure (for example, if you expect that you would provide us with the same data in the future);

c) we no longer need your personal data for the purposes specified above, but you require it for the establishment, exercise or defence of legal claims; or

d) you object to the processing, as described in further detail in the section entitled “Right to Object to Processing” below. While we assess whether your objection is justified, we are required to restrict the processing of your personal data.

G.6. Right to portability

You have the right to obtain from us all personal data that you have provided to us and that we process on the basis of your consent or for the performance of a contract. We will provide your personal data in a structured, commonly used and machine-readable format. To enable us to transfer the data in response to your request, this right applies only to personal data processed by automated means in our electronic databases.

G.7. Right to object to processing

You have the right to object to the processing of personal data carried out on the basis of our legitimate interests (see “WHAT IS OUR LEGAL BASIS FOR PROCESSING PERSONAL DATA?”). Where your personal data is processed for marketing purposes, we will cease processing it for such purposes without further assessment. In all other cases, we will cease processing your personal data unless we demonstrate compelling legitimate grounds for continuing the processing.

You may object to processing carried out for the following purposes:

a) Protection of Our Legal Interests and Maintenance of Internal Records;

b) Promotion of Our Brand and Marketing Communications; and

c) Website Operation.

G.8. Right to lodge a complaint

Exercising your rights in the manner described above does not affect your right to lodge a complaint with the competent supervisory authority. You may exercise this right, in particular, if you believe that we are processing your personal data unlawfully or in breach of generally binding legal regulations.

You may lodge a complaint concerning our processing of your personal data with the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

H. HOW CAN YOU EXERCISE YOUR RIGHTS?

For any matter relating to the processing of your personal data, whether you have a question, wish to exercise your rights, lodge a complaint or raise any other matter, you may contact our employees responsible for personal data protection, Ms Marta Kazarova or Ms Kateřina Schicklová, at hr@hanwhacz.cz. We will respond to your request without undue delay and, in any event, within one month. In exceptional circumstances, particularly due to the complexity of your request, we may extend this period by a further two months. We will inform you of any such extension and the reasons for it.