Information for Persons Whose Personal Data We Process During Investigations

1. Who controls your personal data

The controller of personal data processed during investigations is Exero Group s.r.o., company ID (IČO) 09022104, registered office Žirovnická 3133/6, 106 00 Praha – Záběhlice, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 329294, acting through its Exero Claims division ("we").

We carry out investigations on assignment from our clients – insurers, claims administration companies, employers and other organisations (the "client"). However, we decide ourselves what personal data is processed during an investigation, by which methods it is obtained and how long it is kept. The client to whom we provide our findings is a separate controller for its further use of them.

2. What data we process

Depending on the assignment, mainly:

• identification and contact details (name, address, date of birth, phone, email),
• information about the insurance claim, benefit claim or sickness absence,
• information about activity observed in publicly accessible places, including photographs and video,
• information published on the internet and in public social-media profiles,
• information from public registers and records,
• statements given by you or by other people, such as witnesses.

In some cases, particularly investigations of injuries, disability and sickness absence, health data may also be processed, strictly to the extent necessary for the purpose of the assignment.

3. Purpose and legal basis

We process the data to establish and verify facts relevant to the assessment of an insurance claim, a benefit claim or compliance with obligations, and for the establishment, exercise or defence of legal claims. The legal basis is our legitimate interest and the client's legitimate interest in establishing the true facts and preventing insurance fraud (Article 6(1)(f) GDPR). We process health data only where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Before each investigation we assess whether the processing is proportionate and whether your interests or fundamental rights and freedoms override the legitimate interest.

4. Where the data comes from

We obtain data from the client, from publicly available sources (public registers and records, the internet and public social-media profiles), from our own observation in publicly accessible places, and from people who give us information, such as witnesses.

5. How we carry out investigations

We investigate in accordance with the law. We do not enter homes, intercept communications, or access private accounts or systems without authorisation, and we observe activity only in publicly accessible places. Taking part in an interview is always voluntary; we make an audio recording only with the consent of the person interviewed.

6. Who receives the data

Findings are provided only to the client who commissioned the investigation, which is a separate controller for its further use of them. Data may also be disclosed to courts or other public authorities where required by law, and to our technical service providers (hosting, email, secure portal), who are bound by contract and confidentiality. Personal data is processed within the European Union and is not transferred outside the EU.

7. How long we keep the data

We keep investigation data for the duration of the assignment and then for 3 years after it ends, unless the law requires a different period. After that, the data is securely deleted.

8. Why you may not be told in advance

If we told you about an investigation in advance, this could make it impossible or seriously impair the achievement of its objectives. In such cases we do not provide information about the specific investigation (Article 14(5)(b) GDPR) and, as an appropriate measure to protect your rights, we make this information publicly available on this page.

9. Your rights

To the extent and under the conditions set out in the GDPR, you have the right of access to your personal data, the right to rectification or erasure, the right to restriction of processing and the right to object to processing based on legitimate interest. You can exercise these rights directly with us (see contact details below); we will respond without undue delay and within one month at the latest. The right of access may be limited where it would adversely affect the rights and freedoms of others, such as witnesses or the client (Article 15(4) GDPR). If you object, we may continue processing where we demonstrate compelling legitimate grounds or where the processing is necessary for the establishment, exercise or defence of legal claims (Article 21(1) GDPR). If we have already provided our findings to the client, you may also exercise your rights with the client.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.