Privacy Policy of the Alive App Application

1. Table of Contents

2. Introductory Provisions

2.1. The purpose of this Privacy Policy of the Alive App Application (the “Policy”) is to provide complete information about the processing of personal data of an Alive App User, including the fulfillment of any information requirements within the meaning of Articles 13 and 14 of the General Data Protection Regulation (the “GDPR”).

2.2. By using the Alive App mobile application (the “Application” or “Alive App”) or by downloading it on a device of a user (the “User”), as appropriate, you represent that you are duly acquainted with this Policy, understand its wording, and take note of any and all information.

2.3. If you have any questions prior to accepting this Policy, contact GTS Alive Group using the below contact details.

2.4. The use of Alive App shall be governed by the terms of use that are available here (here in after the “Terms of Use”).

3. Data Controller, Data Protection Officer, and Contact Details

Data controller is GTS ALIVE Group s.r.o., identification number (IČ): 09296727, with its registered office at Na Maninách 1092/20, Holešovice, 170 00 Prague 7, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, section C, entry no. 334013 (“GTS Alive Group”).

3.1. You can contact the controller using:

Telephone at +420 226 222 335
Fax at +420 226 222 300
Email at legal@gtsalive.com
Mail at GTS ALIVE Group s.r.o., identification number (IČ): 09296727, with its registered office at Prague 7, Na Maninách 1092/20, Postcode: 170 00

3.2. The controller has appointed the following Data Protection Officer (DPO): Mgr. Karel Beck, email: legal@gtsalive.com, tel.: +420 226 222 325

4. Alive App Installation

4.1. Purpose: The purpose of the Application is to provide services, and particularly to allow User authentication to gain universal access to different Alive Profiles for individual countries, display of digital Cards, and other products and services in different countries, including other services associated with individual Alive Profiles in individual countries (e.g. insurance coverage, etc.). Individual functionalities of the Application are described below. In order to select the preferred language and country settings, it will be verified whether such preferences correspond to the device settings; if this is the case, these preferences will be used as the Application settings. If the selected language and/or country preferences are not available, English will be selected without default country and language settings; the User may configure these settings afterwards. If the language of the selected country is not available, even though the Application is available in the given country, English will be selected (or another language, depending on User’s preferences).

4.2. Legal basis for the processing: performance of a contract in the form of the provision of Application services; Application services cannot be used without the processing of personal data.

4.3. Categories of personal data concerned: network identifiers, device IP address, device settings, date, time, and data required for installation.

4.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

4.5. Transfers to third countries: to be ensured only if the User activates the Alive Profile in countries outside the EU, solely to an administrator of such profile, subject to a User’s confirmation.

4.6. Period for which the personal data are stored: throughout the use of the Application; after this period only in cases specified in Article 13. If a login for Alive App is created; however, the Alive Profile is not activated, the relevant data will be deleted within 24 hours.

4.7. Source: User, User’s device.

4.8. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the conclusion of a contract for the provision of services, the provision is a necessary contractual requirement. Without the provision of personal data, it is not possible to conclude the contract or provide the services.

5. Verification of consents of individuals who are under the age limit provided for by the applicable legislation

5.1. Purpose: If User authentication is requested by a person who is under the age limit provided for by the applicable legislation (such User intends to use an information society service provided by GTS Alive Group), the processing of personal data shall only be lawful if and to the extent that such consent was given or approved by a person that exercises parental supervision over such minor. Consequently, GTS Alive Group requires that the consent be approved by a legal guardian by such User, whereas the personal data of such legal guardian shall be retained for the purpose of authenticating such person and registering such consent. Age verification shall be carried out both for the Application and the Alive Profile during the Alive Profile registration. Overview of age limits for individual countries is available here.

5.2. Legal basis for the processing: performance of a contract, compliance with a legal obligation, and legitimate interest. A parent’s consent cannot be verified without the aforementioned processing. You can object to our legitimate interest.

5.3. Categories of personal data concerned: data concerning the User and his/her legal guardian and verification of consents, including the relevant logs and network identifiers, and legal guardian’s contacts.

5.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

5.5. Period for which the personal data are stored: throughout the use of the Application; after this period only if provided for by Article 13.

6. Discount search

6.1. Purpose: to show available discounts and benefits near you; if you give your consent, we will use the location of your device for this purpose.

6.2. Legal basis for the processing: consent that may be withdrawn at any time.

6.3. Categories of personal data concerned: device location data, network identifier, data about available discounts and benefits, IP address, information about date and time of use of functionalities.

6.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

6.5. Period for which the personal data are stored: 24 hours.

6.6. Source: User, User’s device.

6.7. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the use of this service, you must give your consent to the use of the necessary data.

7. Application push notifications

7.1. Purpose: to notify you of important information and/or messages; if you give your consent in your device settings, we will use the Application notifications within your device for this purpose.

7.2. Legal basis for the processing: consent that may be withdrawn at any time.

7.3. Categories of personal data concerned: information about notification, network identifier, data about the notification contents, and associated data for ensuring the notification.

7.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

7.5. Period for which the personal data are stored: 24 hours.

7.6. Source: User, User’s device.

7.7. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the use of this service, you must give your consent to the use of the necessary data.

8. Alive Profile notifications

8.1. Purpose: to notify you of important information and/or messages; if you give your consent, we will use the Application notifications for this purpose – i.e. notifications that are linked to your Alive Profile. These messages are always sent by an administrator of the given profile; the administrator shall also act as data controller for this purpose.

8.2. Legal basis for the processing: consent that may be withdrawn at any time.

8.3. Period for which the personal data are stored: no more than one year.

8.4. Detailed information about the processing is included in the principles relating to processing of personal data of the controller in the given country – an overview is available here.

8.5. Source: User, User’s device.

8.6. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the use of this service, you must give your consent to the use of the necessary data.

9. User authentication before signing-in to the Alive Profile

9.1. Purpose: in order to sign-in to the Alive Profile of the selected country, it is first necessary to verify the identity of the person that signs-in (or email address of such person, as appropriate); this is done through the Application. In order to verify an email address, the User must confirm the relevant link. Once the authentication process is completed, the User can sign-in to different Alive Profiles in individual countries. Consequently, GTS Alive Group thus ensures identity check for the Alive Profile administrator, together with the transfer of data required to sign-in to the Alive Profile. For more information about the Alive Profile click here. The User shall set up access (Application login) using a password. The User may change his or her password in the Application settings; if the User forgets the password, it can be reset using his or her email address.

9.2. Legal basis for the processing: performance of a contract; identity cannot be verified for the purpose of signing-in to the Alive Profile without the processing of personal data.

9.3. Categories of personal data concerned: email address, password, authenticated User’s ID, network identifiers, authentication date and time, authentication verification.

9.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

9.5. Period for which the personal data are stored: personal data are stored for the period the Application login is used. If the email address verification process is not completed, the personal data used for the relevant purpose will be deleted after 24 hours. If the email address verification process is completed; however, the Alive Profile registration/sign-in is not completed, any personal data will be deleted after 24 hours from the verification. Selected data, such as logs, will be retained for the period necessary to document compliance, as foreseen in Article 13.

9.6. Source: User, User’s device.

9.7. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the use of this service and the conclusion of the contract, personal data must be provided. Without the provision of personal data, it is not possible to use the service or conclude the contract.

10. Displaying information about products, contests, and other information in the Application without signing in

10.1. Purpose: In case the email address verification process is not completed or is already invalid (more than 24 hours after the email verification), the purpose of the Application is to display information in the same manner as on a website.

10.2. Legal basis for the processing: performance of a contract; the Application cannot be used in this manner without the processing of personal data.

10.3. Categories of personal data concerned: network identifiers, IP address, language and country, information about the use of the Application, displayed information, and date and time such information is displayed.

10.4. Recipients: contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

10.5. Period for which the personal data are stored: 24 hours.

10.6. Source: User, User’s device.

10.7. Voluntary disclosure of personal data: The provision of personal data is voluntary; however, to enable the use of this service and the conclusion of the contract, personal data must be provided. Without the provision of personal data, it is not possible to use the service or conclude the contract.

11. Cookies and other similar tools

11.1. Cookies and other similar tools must be used in order to provide all functions of the Application.

11.2. These tools are also used for analytical and statistical purposes, for the development of the Application, and for marketing and displaying tailored information.

11.3. Some tools, such as Google RECAPTCHA, are used to protect the Application and to ensure security. This tool operates on the principle of a test that verifies whether the user is a human or a robot by checking whether the user can recognize and fill in certain information in an image. The data are displayed randomly and are difficult for automated programs to read; the Application and User are thus protected from these programs. The tool can then also evaluate each user’s behavior and assess whether the user is likely to be a robot or a human, without the user performing a specific action. This makes it possible to set adequate security for the Application.

11.4. The Application also uses tools for verifying photographs. These tools include Google Cloud Vision. This service is used for an initial validation of a photograph uploaded in connection with an ID. In case a User provides us with their photograph to show on their ID, we must check the photograph to ensure that the photograph shows the User, that the person in the photograph is not wearing sunglasses or headgear, that the quality of the photograph is sufficient to identify and verify the person when using the ID or that the head is not hidden, and we must perform related checks. We use the services of a supplier to check photographs, specifically Google Ireland Limited, incorporated under the laws of Ireland, identification number: 368047, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). We have entered into a contract in connection with the service, the content of which can be found here, with an overview of information about the service available here. Google Cloud Vision authentication does not check identity or process biometric personal data or other special categories of data.

11.5. Detailed information about cookies and other similar tools, including all information about the processing of personal data, is available in our Cookies Policy.

12. Contents of the Application after signing-in to the Alive Profile

12.1. Alive App allows Users to sign-in to a single profile that includes the Alive Profile user interface (the “Alive Profile”). By using the Alive Profile, you acknowledge that it is operated by another entity pursuant to Section 8.2 of the Terms of Use – GTS Alive Group s.r.o., which only provides the Application (and not the Alive Profile), shall not be responsible for the contents of such profile or related processing of personal data. With regard to its purposes, GTS Alive Group does access any data provided during the Alive Profile registration or use of other Alive Profile services.

12.2. For more information about the Alive Profile in individual countries click here.

12.3. In order to ensure that data are linked between the Application and the Alive Profile, GTS Alive Group stores information about the fact that a certain Alive Profile is active for a specific Application login. However, GTS Alive Group does not collect any data or information from the Alive Profile.

12.4. If the User switches between different Alive Profiles (in different countries) in the Application, GTS Alive Group stores information about the fact that another profile in another country was added to a specific Application login. However, once again, GTS Alive Group cannot automatically access any profile data, whereas the controller (administrator) in the relevant country shall be responsible for each profile.

12.5. Users are permanently signed in to their Alive Profiles in the Application in order to allow the use of instant functionalities. Users may sign out at any time.

13. Legitimate Interest

13.1. Purpose: In the event GTS Alive Group carries out the above processing, then, following the termination thereof, it collects limited documents and personal data in order to protect its own rights, to defend any claims made, and also to protect its rights during court/administrative/control or other proceedings.

13.2. Legal basis for the processing: legitimate interest of GTS Alive Group with a view to protect its rights, document compliance and defend itself in respect of supervisory authorities. You may object to this legitimate interest at any time.

13.3. Categories of personal data concerned: evidence of legal acts, such as granted consents, confirmations, relevant logs, submitted requests to exercise rights, etc.

13.4. Recipients: only contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

13.5. Period for which the personal data are stored: GTS Alive Group shall retain such collected data for a period of 3 years from the expiry of the processing period set down by another purpose under this Policy. The period shall not end before any initiated court or other proceedings and associated deadlines for any appeals.

13.6. Source: User.

13.7. Voluntary disclosure of personal data: The provision of personal data is typically a contractual requirement and/or a requirement for the chosen service. The use of personal data for a legitimate interest may be objected to in accordance with this Privacy Policy.

14. Compliance with Legal Obligations

14.1. Purpose: Where GTS Alive Group is required to retain certain documents under the applicable legislation, it does so for the purpose specified by such legislation. One example is the retention of documents in the area of insurance, bookkeeping, and taxes.

14.2. Legal basis for the processing: compliance with a legal obligation.

14.3. Categories of personal data concerned: only such data or documents that are to be retained under the applicable legislation.

14.4. Recipients: only contractual processors, such as accounting, tax, and legal advisors, providers of external IT and marketing services, and transport suppliers.

14.5. Period for which the personal data are stored: GTS Alive Group shall only retain such collected data for a period defined by the applicable legislation.

14.6. Source: User.

14.7. Voluntary disclosure of personal data: The provision of personal data is typically a contractual requirement and/or a requirement for the chosen service. The use of personal data for this purpose is a legal requirement and cannot be influenced by the subject.

15. Technical messages, service notifications, and messages relating to the provision of the services and the concluded contract

15.1. Purpose: If you enter into a contract with us or we provide any service to you, it is necessary in some cases to send communications relating to that contract, in connection with the concluded contract, the performance of our contractual obligations, the provision of a service or product or the exercise of rights or a claim. These necessary technical, service, as well as contract-related messages (hereinafter the “service messages”) cannot be refused as they are important communications that must be communicated in connection with the contract.

These messages may concern you if you are a User of the Application and are using an ID, using another service/product or are in the process of negotiating a contract or applying for a service.

15.2. Legal basis for the processing: The processing is necessary for the performance of a contract, to which the data subject is a party, or for the implementation of measures taken prior to the conclusion of the contract at the request of the data subject. The processing is necessary for a legitimate interest, to which the Holder may object.

15.3. Categories of personal data concerned: Information about the User and the contract/service/product used by the User; data relating to changes to the contract/Terms of Use/Privacy Policy; data relating to related communications; data relating to service messages, network and other identifiers; data relating to the delivery and opening of a network message; data relating to the use of links in a message; statistical data; data relating to the date and time of individual operations.

15.4. Recipients: Only contractually authorized processors in the form of accounting, tax, and legal advisors, external IT and marketing service providers, and transport providers.

15.5. Retention period of personal data: For the duration of the contract/service provision and longer only if a legitimate interest and/or legal obligation under this Privacy Policy so requires.

15.6. Source: User.

15.7. Voluntary disclosure of personal data: The provision of personal data is typically a contractual requirement and/or a requirement for the chosen service. The use of personal data for this purpose is a contractual requirement as well as a legitimate interest.

16. User’s Rights and Exercising Such Rights

16.1. Any processing of personal data shall respect User’s rights guaranteed by this article.

16.2. Right of access to personal data – your right to obtain from GTS Alive Group, without undue delay, information about which personal data are being processed, purpose of processing, recipients, retention period, and information about associated rights.

16.3. Right to rectification – right to obtain from GTS Alive Group, without undue delay, the rectification of inaccurate personal data or completion of any incomplete data.

16.4. Right to erasure (“right to be forgotten”) – right to obtain from GTS Alive Group, without undue delay, the erasure of your personal data.

16.5. Right to restriction of processing of your personal data – right of the User to obtain from GTS Alive Group restriction of processing, provided the requirements of Article 18 of the GDPR are met (e.g. accuracy of personal data is contested, the User has objected to processing, etc.).

16.6. Right to data portability – right to receive the personal data concerning you, which you have provided to GTS Alive Group and which are processed by automated means on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller or to have the personal data transmitted directly to another controller, where technically feasible.

16.7. Right to object to processing of personal data that concern you. GTS Alive Group shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which also includes profiling. If you object to such processing, your personal data will no longer be processed for such purposes.

16.8. Right to lodge a complaint to a supervisory authority, i.e. the Office for Protection of Personal Data (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 727/27, 170 00 Prague 7 – Holešovice, www.uoou.cz.

16.9. You have the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. GTS Alive Group does not base any of its decisions solely on automated processing.

16.10. You can request partial or complete erasure or blocking of your personal data at any time and free of charge; you can also request information about personal data concerning you that we store and apply for the rectification of such data. You can simply contact us using the above contact details.

16.11. We will handle all your requests without undue delay, but in any case no later than 30 days in duly justified cases.

16.12. If you wish to exercise your right, in your capacity of data subject, with regard to GTS Alive Group, in its capacity of controller, or if you wish to submit any requests, inquiries or complaints relating to the processing of personal data, use our contact details.

17. Final Provisions

17.1. The processing of personal data shall be governed by the laws of the Czech Republic.

17.2. This Policy is effective as of 1 May 2025.

17.3. GTS Alive Group may amend this Policy as and when necessary. Any such changes shall be effective on the date of notification or on a later date specified in the notification thereof.