GDPR

GDPR POLICY

B P K, spol. s r.o. as a part of its activity, processes personal data of their employees, business
partners and others. B P K, spol. s r.o. processing of personal data is governed by the rules laid
down in the relevant legislation, particularly the rules contained in the REGULATION (EU) 2016/679
OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27th 2016 The General Data
Protection Regulation (GDPR). Our goal is to ensure the security of the personal data of
employees, business partners and other entities and prevent their misuse. That is why we
understand the GDPR not only as a mandatory statutory regulation, but also as a guide for meeting
the stated goal. In this context, we have adopted the following vision:
We protect all personal data entrusted to us within our business

We will fulfill this vision by focusing on the following measures:
1. We implement the GDPR rules as a coherent system of management documentation (this GDPR
POLICY, follow-up directives, and workflows).
2. We keep personal data of our employees only if it is necessary for HR processes and wage
administration. Employees know what information we collect and for what purpose and, if
necessary, they give their consent.
3. We collect personal data of our business partners and other natural persons (consultants,
government or self-government officials, etc.) only if it is necessary for the relevant activity
(purchasing, sales, consultancy, inspection activities, etc.). These persons are notified that we
adhere to GDPR rules.
4. We operate the CCTV (Closed Circuit Television) in accordance with established rules. We carry
out simple immediate monitoring and recording and the storage of the records for security and
technological reasons.
5. We evaluate all software products from the point of view of adhering to the GDPR rules. We
require our vendors to support compliance with these rules when they are used, including features
enabling us to fulfill the rights of data subjects (data deletion, data anonymization, etc.).
6. All other subprocesses processing personal data of natural persons are always managed so as
not to violate the GDPR rules.

This GDPR Policy is a commitment of the company's management to comply with the privacy
policy. GDPR policy is the basis for setting of partial goals in the field of personal data protection.
The employees are obliged to become acquainted with this GDPR Policy and within their
day-to-day operations to fulfill it.
This GDPR Policy is issued indefinitely and can be reviewed in terms of timeliness and efficiency at
any time.

In Prosec on June 25, 2025