General Data Protection Policy

GENERAL DATA PROTECTION POLICY

This General Data Protection Policy ("Policy") governs the processing of your personal data during your visit to our website www.doosanskodapower.com ("Website") and during your communication with our company, whether by email, telephone, fax or social media, e.g. Facebook, LinkedIn, X, Google+, Instagram and Youtube ("Social Media").

NOTE 1: This Policy does not apply to the processing of personal data of individuals who choose to apply for employment through our online job application platform. The processing of personal data through the job application platform is governed by separate Applicant Data Protection Policy.

NOTE 2: If you would like information on how we process personal data using cookies, social plug-ins, pixels and other types of tracking technologies, you are kindly referred to our Cookie Policy.
1. IN GENERAL
1.1 Your personal data is processed and controlled by Doosan Škoda Power a.s., with registered office at Tylova 1/57, 301 00 (delivery postal code 301 28) Pilsen, The Czech Republic, Company No.: 491 93 864, registered in the Commercial Register maintained by the Regional Court in Pilsen under file No.: B 2251 (hereinafter referred to as "Company Doosan" or "we", "us", etc.). You may contact us by email at [email protected].

1.2 Any term beginning with a capital letter will be expressly defined in this Policy. Whenever possible given the context, words in the singular will be interpreted to include the plural, and vice versa.

1.3. Where reference is made to certain laws or regulations, such reference shall be deemed to include any amendment, replacement or repeal of such laws or regulations, including any related decisions of public authorities.

1.4. The Company Doosan reserves the right to modify, amend or supplement this Policy at any time at its sole discretion. Such modifications, amendments or additions will be posted on the Website.
2. CATEGORIES OF PERSONAL DATA WE PROCESS
2.1 Whenever you use our Website and Social Media, we collect:
• technical information about the device you are using, such as your IP address, browser type, geographical location and operating system,
• information about how you view the Website, such as the length of your visit, which links you click on, which pages you visit and how many times you visit a particular page.


2.2 When you complete a contact form on our Website or contact us by email, telephone, fax or Social Media, we collect:
• basic information about your identity that you provide to us, such as your name, email address, publicly available profile name from your Social Media profile, postal address, telephone number, the company you work for, your job title,
• the content of your communication and the technical details of the communication itself, such as who you are corresponding with on our side of the company, as well as the date and time of the communication,
• any other personal data you choose to provide to us.

2.3 We will receive all of the above personal data directly from you. We may receive additional information about your preferences and browsing behaviour from partners such as Google, Facebook, Yandex and AddThis/Oracle. If you require more information about what personal data these entities process about you and disclose to others, we refer you to their respective privacy policies:
• Google: https://policies.google.com/privacy?hl=en
• Facebook: https://www.facebook.com/about/privacy
• Yandex: https://yandex.com/legal/confidential/index.html
3. PURPOSES FOR PROCESSING
3.1 The Company Doosan processes your personal data in order to provide you with the information, products and services you request via the Website, email, telephone, fax or Social Media in a personalised and efficient manner.

3.2 The Company Doosan processes your personal data for marketing purposes, i.e. to provide you with targeted communications, promotional and other offers and other promotional communications from the Company Doosan and selected partners.

3.3 Unless you are a customer from whom we have received electronic contact in connection with the sale of our products and services and whom we intend to target with our own marketing materials, the Company Doosan will send you communications or promotions and other offers by email or other personal electronic communication channels if you have given your express consent to receive such communications and offers.

3.4 The Company Doosan processes your personal data in order to comply with its legal obligations or to comply with any reasonable requests from competent administrative and judicial authorities, governmental authorities or supervisory authorities, including competent data protection authorities.
Your personal data may be transferred to police or judicial authorities on the Company Doosan's own initiative as evidence or where there is reasonable suspicion that you have committed an offence or crime in connection with your registration on or use of the Website or our Social Media or in connection with other communications with us.

3.5 The Company Doosan may be required to collect and transfer your personal data to our financial institution or payment service provider to enable your financial institution and payment service provider to comply with their legal obligations, such as obligations under applicable anti-money laundering and anti-terrorist financing legislation.

3.6 The Company Doosan processes your personal data for the purpose of carrying out statistical analyses to improve our Website, products and services or to develop new products and services.

3.7. The Company Doosan may process your personal data to maintain the legitimate interests of the Company Doosan, our partners or third parties where your registration on or use of the Website, Social Media or other communication channels may be considered (a) a breach of the applicable Terms of Use or intellectual property rights or any other rights of any third party, (b) a threat to the security or integrity of the Website, Social Media or other communication channels, (c) a danger to the Website, Social Media or other communication channels or to the Company Doosan's or our subcontractors' systems due to viruses, Trojan horses, spyware, malware or any other form of malicious code, or (d) in any way deemed hateful, obscene, discriminatory, racist, defamatory, malicious, offensive or otherwise inappropriate or illegal.
4. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
4.1 The processing of your personal data under the terms of Article 3.3 is carried out by the Company Doosan on the basis of your consent. If you are our customer from whom we have received electronic contact in connection with the sale of our products and services, the legal basis for processing for this purpose is our legitimate interest.

4.2 The processing of your personal data for the purposes set out in Articles 3.4 and 3.5 is necessary for the Company Doosan to comply with its legal obligations.

4.3 The processing of your personal data for the purposes set out in Articles 3.1, 3.6 and 3.7 is necessary for the purposes of the Company Doosan's legitimate interests, which are:
• Continuous improvement of the Company Doosan's Website, Social Media, products and services to provide you with the best possible experience,
• protecting our Websites, Social Media, products and services from abuse and illegal activity,
• marketing and promotion of our products, services, brands and the overall successful commercialization of our products and services.
5. RECIPIENTS OF PERSONAL DATA
5.1 The Company Doosan does not send your personal data in identifiable form to any third party without your explicit consent. However, you acknowledge that if you use our Social Media, your personal data is also processed by the Social Media Providers.

5.2 The Company Doosan uses external processors to operate the Website and to process your personal data. These external processors are only authorised to process your personal data for the Company Doosan on the Company Doosan's express written instructions. The Company Doosan guarantees that all external processors are selected with due care and are obliged to maintain the security and integrity of your personal data.

5.3 The Company Doosan is entitled to share your personal data with other entities within the Doosan group (DOOSAN CORPORATION and DOOSAN DIGITAL INNOVATION EUROPE LIMITED). However, we will ensure that all Doosan group entities take due care to ensure that all processing of your personal data is in accordance with what is set out in this Policy.
6. LOCATION AND TRANSFER OF PERSONAL DATA
6.1 The Company Doosan processes your personal data primarily within the EU/EEA. However, in connection with the processing of your personal data for the purposes set out in Article 3 above, we may also in some cases transfer your personal data to other entities within the Company Doosan group (DOOSAN CORPORATION and DOOSAN DIGITAL INNOVATION EUROPE LIMITED) or to third parties located outside the EU/EEA.

When transferring personal data outside the EU/EEA, we ensure compliance with all legal requirements, in particular:
• the transfer takes place to a third country that provides an adequate level of protection on the basis of a decision of the European Commission,
• in the absence of a decision on the appropriate level of protection, we use standard contractual clauses approved by the European Commission,
• where it is not possible to ensure an adequate level of protection, we will require your explicit consent before transferring your personal data.

6.2 The Company Doosan may transfer anonymised or aggregated data to organisations outside the EU/EEA. If such transfers occur, the Company Doosan will ensure that safeguards are in place to ensure the security and integrity of your personal data and that any rights you may have under generally applicable law regarding your personal data are preserved.
7. OTHER PROVISIONS
7.1 The Company Doosan shall do its utmost to process only those personal data that are necessary to achieve the purposes set out in Article 3.

7.2 Your personal data is processed only for as long as necessary to achieve the purposes set out in Article 3 of this Policy or until you withdraw your consent to its processing. Please note that withdrawal of consent may result in you no longer being able to use the Website, Social Media and other communication channels in whole or in part. The Company Doosan will anonymise your personal data if it is no longer necessary for the purposes set out in Article 3, unless:
• the overriding interest of the Company Doosan, your financial institution, payment service provider or any other third party in maintaining the identifiability of your personal information; or
• a legal or regulatory obligation or a judicial or administrative decision that prevents the Company Doosan from anonymising them.

7.3 The Company Doosan will take appropriate technical and organisational measures to secure your personal data against unauthorised access or theft, as well as accidental loss, manipulation or destruction. The Company Doosan personnel or our external processors will only have access to your personal data to the extent strictly necessary and will be subject to strict confidentiality obligations. You acknowledge, however, that ensuring protection and security is based on the principle of best efforts and can never be fully guaranteed.
8. YOUR RIGHTS
8.1 You have the right to request access to all your personal data processed by the Company Doosan. The Company Doosan reserves the right to charge a reasonable fee for multiple subsequent requests for access that are manifestly unfounded and unreasonable.

8.2 You have the right to have any of your personal data that is inaccurate corrected free of charge. If a request for rectification is made, this request must be accompanied by proof of the inaccuracy of the data whose rectification is requested.

8.3 You have the right to withdraw your previously given consent to the processing of your personal data, in which case Article 8.4 shall apply.

8.4 You have the right to request that your personal data be deleted if it is no longer necessary in connection with the purposes set out in Article 3 or if you have withdrawn your consent to its processing. Please note, however, that the Company Doosan will consider a request for erasure on a weighted basis:
• the overriding interests of the Company Doosan, your financial institution, payment service provider or any other third party; or
• any legal or regulatory obligations or administrative or judicial decisions that conflict with such deletion.
Instead of erasure, you can also ask us to restrict the Company Doosan's processing of your personal data if (a) you contest the accuracy of the data, (b) the processing is illegitimate, or (c) the data is no longer needed for the purposes set out in Article 3 but is needed to defend yourself in legal proceedings.

8.5 You have the right to object to the processing of personal data by objecting to the processing if you are able to demonstrate that there are compelling legitimate grounds based on specific circumstances that justify your objection. However, if the intended processing is in the nature of direct marketing, you have the right to refuse this processing free of charge and without any justification.

8.6 You have the right to receive from us, in a structured, commonly used and machine-readable format, any personal data you have provided to us. You have the right to transfer this data to another controller of your choice. Where technically feasible, you also have the right to ask us to transfer your personal data directly to that other controller. This right can only be exercised for data that is processed by automated means and on the basis of your consent.

8.7 If you wish to make a request to exercise one or more of your rights set out above, you may send an email to [email protected]. An email requesting the exercise of a particular right will not be construed as consent to the processing of your personal data beyond what is required to process your request. This request should clearly state which right you wish to exercise and, if requested, the reasons for exercising it. The request should also be dated and signed. If reasonable doubt arises as to the identity of the applicant, the Company Doosan may request the provision of additional information necessary to confirm the identity of the data subject. If you use the contact form, the Company Doosan may ask you to confirm the request and provide proof of identity.

The Company Doosan will inform you immediately upon receipt of your request. The Company Doosan will process your request as soon as possible, but no later than thirty (30) days after receipt. This time limit may be extended by an additional two months if necessary and taking into account the complexity and number of requests.

If you have any complaint regarding the processing of your personal data by the Company Doosan, you can always contact the Company Doosan via the above email address. You are also entitled to lodge a complaint with the competent data protection authority or take legal action in court if you believe that your rights have been violated as a result of the processing of your personal data.