II. CLINICAL SEMINAR of the Mental Rehabilitation Centre

I hereby grant JESSENIA a.s. - Rehabilitation Hospital Beroun (ID 26752051), NH Hospital a.s. - Hospital Hořovice (ID No. 27872963) and Multiscan s.r.o. (ID No. 26476444), as Data Controllers, consent to the following to process my personal data under the conditions set out below:

1. Personal data to be processed:

• name, surname, degree
• date and place of birth
• account number
• nationality
• place of residence and contact address
• telephone and electronic contact

2. Purpose of processing personal data:

processing of applications and inclusion in the „Scholarship programme for medical staff practicing in the Rehabilitation Hospital Beroun, Hospital Hořovice and Multiscan for the current academic/school year“

3. Duration of processing of personal data:

10 years from the conclusion of the contract, unless a longer period is provided for by law. in the case of no contract, 2 years from the granting of consent.

4. Personal data may be disclosed to the following third parties:

• AKESO Holding, ID 06625258, with registered office at Okruhová 1135/44, Prague 5

5. Further information:

• the personal data of the Data Subject will be processed on the basis of his/her free consent, under the conditions set out above; the reason for providing personal data to the Data Subject is his/her interest in the data for inclusion in the „Scholarship Programme for the purpose of securing medical staff practicing their profession in the Rehabilitation Hospital Beroun, Hořovice Hospital and Multiscan for the current academic/school year“, which would not be possible without the provision of these data
• the processing of the Data Subject's personal data will not involve automated decision-making or profiling
• The controller has not entrusted any processor with the processing of personal data or appointed a representative to carry out the obligations within the meaning of the European Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation
• The Controller does not intend to transfer the Data Subject's personal data to a third country, an international organisation or to third parties other than those listed above
• The data subject has the right to withdraw his/her consent to the processing of personal data at any time, the right to request access to his/her personal data from the Controller data, to have them rectified or erased or, where appropriate, to restrict processing, and to object to processing, has the right to the portability of these data to another controller, as well as the right to lodge a complaint with the Office for Personal Data Protection if he or she considers that the Controller, in processing personal data acts in breach of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016, General Data Protection Regulation personal data.

---

Information to the data subject

Instruction on rights under Act No. 110/2019 Coll., on the processing of personal data, as amended (hereinafter referred to as „ZZOÚ“) Rehabilitation Hospital Beroun, Hospital Hořovice and Multiscan will act as Personal Data Controllers. Their scope, purpose of processing and other information are defined in the document entitled „Consent to the processing of personal data“

1.1. Information on the right of access to personal data

I have the right to ask the Controller for information about the processing of my personal data, which will be provided to me without undue delay. The content of the Personal Data Processing Record will always include a statement about:

• the purpose of processing my personal data
• the personal data or categories of personal data subject to processing
• recipients of personal data

For the provision of information, the Controller, or the Processor on behalf of the Controller, is entitled to demand a reasonable fee not exceeding the costs necessary to provide the information.

1.2 Information on other rights

If I become aware or believe that the Controller is processing my personal data in a way that is contrary to the protection of my private and personal life or contrary to the law, in particular if my personal data are inaccurate with regard to the purpose of their processing, I may:

• ask the Controller or the Processor for an explanation
• require the Administrator to remedy the condition thus created. In particular, this may involve blocking, repairing, supplementing or disposing of my personal data. If my request is found to be justified, the Controller shall immediately remedy the defective condition. If the Controller requests does not comply with the request, I may contact the Data Protection Authority.

1.3 Notice of rights under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

Information on rights under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - This Regulation 2016/679 is hereinafter referred to as the „General Data Protection Regulation“ or just „GDPR“. In particular, I am aware that:

1.3.1. under Article 13 GDPR:

• I have the right to request access to my personal data from the Controller
• I have the right to request rectification or erasure of my personal data, or restriction of processing, and to object to processing, as well as the right to data portability
• I have the right to lodge a complaint with the supervisory authority
• providing my personal data to the Controller is neither a legal nor a contractual requirement, therefore I am not obliged to provide my personal data to the Controller to provide them, and I have also been informed of the possible consequences of not providing them (see point 5 of the „Consent to the processing of personal data“)

1.3.2. under Article 15 GDPR - the right to access My personal data:

• I have the right to obtain confirmation from the Controller as to whether or not my personal data is being processed and, if so, the right to access my personal data and the following information:
  • purpose of processing
  • categories of personal data concerned
  • the recipients or categories of recipients to whom my personal data have been or will be disclosed, in particular recipients in third countries or international organisations
  • the intended period for which my personal data will be stored or, if this cannot be determined, the criteria used to determine this period
  • the existence of the right to request from the Controller the rectification or erasure of my personal data or the restriction of their processing or to object to such processing
  • the right to lodge a complaint with the supervisory authority
  • all available information about the source of my personal data, unless it has been obtained directly from me
  • whether automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR is taking place, and at least in in such cases, meaningful information concerning the procedure used as well as the significance and likely consequences of such processing for me
• I have the right to receive a copy of my personal data processed by the Controller. For additional copies, the Controller may charge me a reasonablefee based on administrative costs. If I make a request in electronic form, the information will be provided in electronic form, which is commonly used, unless I request another method

1.3.3. under Article 16 of the GDPR - the right to rectification of My personal data:

• I have the right to have my personal data deleted by the Controller without undue delay if one of the following reasons applies:
  • my personal data is no longer necessary for the purposes for which it was collected or otherwise processed
  • I have withdrawn this consent to the processing of my personal data and there is no other legal reason for the process
  • I have objected to processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for processing; or I have objected to processing pursuant to Article 21(2) of the GDPR
  • my personal data have been unlawfully processed
  • my personal data must be erased to comply with a legal obligation under the law of the European Union or its Member State to which the Controller is subject
• The above points do not apply if the processing of My Personal Data is necessary:
  • for the exercise of the right to freedom of expression and information
  • to comply with a legal obligation that requires processing under the law of the European Union or its Member State to which the Controller is subject applicable to it or for the performance of a task carried out in the public interest or in the exercise of official authority, if the Controller is entrusted with such a task
  • for reasons of public interest in the field of public health
  • for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR
  • for the establishment, exercise or defence of legal claims

1.3.4. under Article 17 of the GDPR - the right to erasure of My personal data:

• I have the right to have my personal data deleted by the Controller without undue delay if one of the following reasons applies:
  • my personal data is no longer necessary for the purposes for which it was collected or otherwise processed
  • I have withdrawn this consent to the processing of my personal data and there is no other legal reason for the process
  • I have objected to processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for processing; or I have objected to processing pursuant to Article 21(2) of the GDPR
  • my personal data have been unlawfully processed
  • my personal data must be erased to comply with a legal obligation under the law of the European Union or its Member State to which the Controller is subject
• The above points do not apply if the processing of My Personal Data is necessary:
  • for the exercise of the right to freedom of expression and information
  • to comply with a legal obligation that requires processing under the law of the European Union or its Member State to which the Controller is subject applicable to it or for the performance of a task carried out in the public interest or in the exercise of official authority, if the Controller is entrusted with such a task
  • for reasons of public interest in the field of public health
  • for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR
  • for the establishment, exercise or defence of legal claims

1.3.5. under Article 18 GDPR - the right to restrict the processing of my personal data:

• I have the right to have the Controller restrict processing in any of the following cases:
  • if I contest the accuracy of my personal data, for the time necessary for the Controller to verify the accuracy of my personal data
  • the processing is unlawful and I would refuse the erasure of my personal data and instead request a restriction on its use
  • The controller no longer needs my personal data for processing purposes, but I would require it for the establishment, exercise or defence of legal claims
  • if I object to processing pursuant to Article 21(1) of the GDPR until it is verified that the legitimate grounds of the Controller outweigh my legitimate grounds
• if the processing has been restricted in accordance with the points above, my personal data may only be processed, except for storage, with my consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State thereof

1.3.6. pursuant to Article 19 of the GDPR - notification obligation regarding the rectification or erasure of my personal data or restriction of processing:

• The controller shall notify the individual recipients to whom my personal data has been disclosed of any rectification or erasure of my personal data or restriction of processing, except where this proves impossible or requires disproportionate effort. The controller shall inform me of these recipients only if I request it

1.3.7. under Article 21 GDPR - the right to object:

• I have the right to object at any time to the processing of my personal data on grounds relating to my particular situation, on the basis of Article 6 1(f) of the GDPR, including profiling based on these provisions. The controller will no longer process my personal data if it does not demonstrate compelling legitimate grounds for the processing which override my interests or rights and freedoms or for the establishment, exercise or the defence of legal claims
• I can exercise my right to object by automated means using technical specifications

1.3.8. under Article 22 GDPR - Automated individual decision-making, including profiling:

• I have the right not to be subject to any decision based solely on automated processing, including profiling, which has has legal effects on me or significantly affects me in a similar way. This does not apply where the decision is: (a) necessary for the conclusion or performance of a contract between me and the Controller; b) permitted by the law of the European Union or a Member State thereof to which the Controller is subject; and which also provides for appropriate measures to ensure the protection of my rights and freedoms and legitimate interests; c) based on my express consent

1.3.9. under Article 34 GDPR - notification of personal data breaches:

• If a particular breach of my personal data is likely to result in a high risk to my rights and freedoms, the Controller is obliged to notify me of the breach without undue delay
• However, notification under the foregoing shall not be required if any of the following conditions are met:
  • The controller has put in place appropriate technical and organisational safeguards and these safeguards have been applied, in particular those which make the following my personal data incomprehensible to anyone not authorised to have access to it, such as encryption
  • The controller has taken subsequent measures to ensure that the high risk to my rights and freedoms referred to above is no longer likely to occur
  • it would require disproportionate effort on the part of the Controller or Processor