Privacy Notice

01Introductory provisions

This privacy notice fulfils the information obligation of Elvian Projects SE, a European company with its registered office in Prague, which is the project company of the Elvian group for energy infrastructure (development, preparation and management of projects, partnerships with distribution companies, municipalities and investors) and the operator of the projects.elvian.cz website (‘Elvian Projects’ or ‘we’). It applies to website visitors, business partners and their contact persons, representatives of public institutions and of distribution and energy companies, investors and financing institutions, applicants for cooperation and job applicants.

02Controller

Office in Ukraine

In Ukraine, the group is represented by TOV ‘Elvian Ukraine’ (EDRPOU 46302381), with its office at 7‑M Shevchenka St., Premises 201, 08293 Bucha, Kyiv Region, Ukraine. It is a separate company of the group; we transfer personal data to it only to the extent and under the conditions described in Sections 06 and 07.

03What data we process

• Contact and identification data of partners — name, position, company or institution, e-mail, telephone, and the content of our mutual communication and meetings.
• Data from project documentation — data on representatives of the contracting parties in memoranda, contracts, powers of attorney and minutes (name, position, signature and, where required for signature or verification, data from an identity document).
• Data for partner screening — publicly available data on the statutory representatives and beneficial owners of partners, to the extent necessary for sanctions and KYC screening under EU and Czech law.
• Data of applicants for employment and cooperation — CV and information provided during the selection process.
• Website operational data — server logs kept for security reasons (IP address, time and type of request).

04Website and cookies

The projects.elvian.cz website uses no cookies, analytics or marketing tools and stores no data in your browser. The website runs on an Elvian group server in the European Union. Fonts are loaded from Google Fonts — when a page loads, your IP address is technically transmitted to Google LLC; details are set out in the separate Cookies document.

05Purposes and legal bases of processing

• Negotiations on cooperation, memoranda and partnerships — Art. 6(1)(b) and (f) GDPR.
• Preparation, conclusion and performance of contracts, including works contracts, EPC contracts and joint venture agreements — Art. 6(1)(b) GDPR.
• Partner screening (EU sanctions lists, KYC, beneficial owners) — Art. 6(1)(c) and (f) GDPR.
• Compliance with legal obligations (accounting, archiving, corporate records) — Art. 6(1)(c) GDPR.
• Legitimate interests — security of systems, protection of property and defence of legal claims — Art. 6(1)(f) GDPR.
• Recruitment — Art. 6(1)(b) and (f) GDPR; longer retention only with consent under Art. 6(1)(a) GDPR.

06Recipients of personal data

We share data only to the extent necessary: with Elvian group companies — Elvian Technologies s.r.o. (implementation and technology partner for projects) and TOV ‘Elvian Ukraine’ (local representation in Ukraine); with project partners to the extent necessary for a joint project (e.g. representatives of a municipality or distribution company in a memorandum); with professional advisers (auditors, tax advisers, attorneys — always bound by confidentiality); with IT and hosting service providers bound by a contract under Art. 28 GDPR; with financing institutions when preparing project financing; and with public authorities where required by law.

07Transfers outside the EU/EEA

We process personal data primarily within the EU/EEA. Owing to our activities in Ukraine, data of partners’ contact persons and project documentation are transferred to our Ukrainian office and to Ukrainian partners. Ukraine is not a country covered by an adequacy decision; such transfers therefore take place on the basis of standard contractual clauses under Art. 46 GDPR or — for data necessary for the conclusion and performance of a contract with a partner — on the basis of the derogations under Art. 49(1)(b) and (c) GDPR. We always transfer only the minimum data necessary for the project concerned.

08Retention period

We keep data for the duration of negotiations and of the business relationship; contractual, project and accounting documentation for the statutory archiving periods and for the duration of warranties and potential claims arising from the project. Partner screening data are kept for the duration of the relationship and 5 years thereafter. Data of unsuccessful job applicants are deleted within 6 months of the end of the selection process; longer retention only with consent.

09Your rights

• Right of access (Art. 15), rectification (Art. 16) and erasure (Art. 17).
• Right to restriction of processing (Art. 18) and data portability (Art. 20).
• Right to object to processing based on legitimate interest (Art. 21).
• Right to withdraw consent (Art. 7(3)) — at any time, without retroactive effect.
• Right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ) — Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

10Security

We apply technical and organisational measures under Art. 32 GDPR — encrypted transmission (HTTPS/TLS), access control on a ‘need-to-know’ basis, backups, and confidentiality obligations of members of corporate bodies, employees and subcontractors. We will notify any personal data breach to the supervisory authority within 72 hours under Art. 33 GDPR.

11Contact