Data controller
The controller of personal data for the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) is Levicorpus, SE (IČO 17886571), with registered office at Opletalova 1535/4, Nové Město, 110 00 Praha 1, Czech Republic.
Contact for matters of personal data: privacy@ihpm.eu.
Data protection officer
A data protection officer is not mandatory for our processing; data-protection enquiries: privacy@ihpm.eu.
Categories of personal data
We collect and process the following categories of personal data in the course of normal business:
- Identification data: name, role, institution, professional address.
- Contact data: email address, telephone number.
- Communication data: content of written and oral communication with us.
- Compliance data: beneficial owner identification, source-of-funds documentation, sanctions screening records.
- Transaction data: specifications, custody records, certificates and documentation packs.
Purpose and legal basis
We process personal data for the following purposes:
- Performance of a contract (Art. 6 (1)(b) GDPR): preparing and fulfilling a written specification with the client.
- Legal obligation (Art. 6 (1)(c) GDPR): compliance with anti-money-laundering legislation, in particular Act No. 253/2008 Coll. and Directive (EU) 2018/843.
- Legitimate interest (Art. 6 (1)(f) GDPR): protection of the firm and its clients, fraud prevention, and the conduct of professional correspondence.
Inquiries submitted through the website contact form are processed solely to respond to the enquiry and to take any steps requested prior to a possible engagement (legal basis Art. 6 (1)(b) and (f) GDPR). No automated decision-making or profiling takes place.
Retention periods
Personal data is retained for the period required by applicable law and the legitimate interest of the firm:
- Identification and compliance data: ten years from the end of the engagement, in accordance with AML legislation.
- Communication and inquiry data: three years from last contact.
- Transaction documentation: indefinitely, for the purpose of certificate reissue.
Recipients of data
Personal data is shared only with:
- Institut für Seltene Erden in Lucerne, our certification partner, in the minimum form necessary to associate a lot with a certificate.
- Czech legal counsel and tax advisors under professional confidentiality.
- Competent authorities where required by law.
Data shared with our certification partner in Switzerland is transferred on the basis of the European Commission’s adequacy decision for Switzerland (Art. 45 GDPR), which confirms that Switzerland ensures an adequate level of data protection.
We do not sell, rent, share or analyse personal data for marketing purposes, internally or externally.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request erasure, subject to our legal retention obligations.
- Restrict or object to processing.
- Receive your data in a portable format.
- Lodge a complaint with the Office for Personal Data Protection (ÚOOÚ) of the Czech Republic.
Security
Personal data is held under reasonable technical and organisational safeguards including access control, encrypted storage of sensitive data, and a documented incident response procedure. Compliance documentation is held offline and access-controlled.
Contact
Inquiries about the handling of personal data should be addressed to privacy@ihpm.eu or to the registered office.
Filed Praha · Effective May 2026 · Reviewed annually