Principles of personal data processing in business activities

FOR CUSTOMERS, SUPPLIERS, MARKETING AND WEBSITE VISITORS

Miroslav Haas, with registered office in Petrovice u Karviné, Závada 209, 73572, IČO: 154 762 43 as a natural person, on the basis of a trade license (hereinafter referred to as the " Company "), we pay great attention to the protection of personal data. In accordance with Regulation (EU) 2016/679, on the protection of natural persons in connection with the processing of personal data (hereinafter referred to as the "Regulation" or "GDPR" ), we have therefore decided to issue these Principles of Personal Data Processing (hereinafter referred to as the " Policy ") .

The purpose of this document is primarily to provide information about what personal data the Company, as a controller, processes about natural persons in the course of business activities , in what way, for what purposes and for how long, to whom and for what reason it can transfer it, as well as to inform about what rights belong to natural persons in connection with the processing of their personal data.

This Policy applies to the processing of personal data:

• our customers and service users,
• our suppliers and business partners
• representatives of these customers (users), suppliers and business partners or their contact persons,
• those interested in our services or goods,
• persons to whom we send commercial communications
• visitors to our website.

I. ADMINISTRATOR OF PERSONAL DATA

The administrator of personal data is the Company (identification data of the Company, see above).

Contact details where you can direct your questions and requests regarding the processing of personal data:

postal address: Petrovice u Karviné, Závada 209, 73572,

email: 2xalatky@gmail.com

II. CATEGORIES OF PERSONAL DATA

Personal data is any information that relates to a natural person that the Company is able to identify.

In connection with business, the Company handles the following types (categories) of personal data [1] :

1. IDENTIFICATION AND CONTACT DATA FOR CONTRACTUAL RELATIONS

Such data are necessary for the conclusion and pln of the contract between the Company and you or the negotiation of such a contract. This is in particular your academic degree, first and last name, name, business name, date of birth, ID number, VAT number, address of permanent residence, address of registered office or place of business, signature, etc. It is also the academic degree, first and last name, function and signature of your representatives or authorized persons.

We process contact data in order to be able to contact you if necessary in connection with the contract, in particular the telephone number and e-mail address of you and your representatives or authorized persons.

2. GOODS AND SERVICES DATA AND DELIVERY DATA

We process data on what services or goods you order from us and the address where the goods are to be delivered.

3. PAYMENT DATA

We process your bank account number and your payment card details to identify your payments.

4. BILLING DATA

We process data such as your first and last name, invoicing address, data on the purchase of goods or services and their price, necessary in order to be able to bill you for goods or services and to be able to pln the obligation to keep accounts as required by law.

5. DATA FROM COMMUNICATIONS BETWEEN THE COMPANY AND THE CUSTOMER

These data are generated during communication related to the provision of services and goods between the Company and the customer. These are records of personal communication with the customer, written and electronic communication with the customer and records of telephone calls.

6. DATA OBTAINED DURING WEBSITE REGISTRATION

This is data that you enter when registering on our website, such as academic degree, first and last name, name, business name, date of birth, ID number, VAT number, address of permanent residence, address of headquarters or place of business.

7. COOKIES

We use cookies to obtain information when using the Company's website. These are records of behavior on websites obtained from cookies if cookies are enabled in the web browser. These data are processed for the operation of the Company's website, measurement of website traffic and internet advertising.

8. DATABASE OF CUSTOMERS AND SUPPLIERS

If we have already established business contact with someone, we store their identification and contact data in our database, such as academic degree, first and last name, name, business company, ID number, address of permanent residence, address of seat or place of business, telephone number and e- mail. we use this data for communication, pln of contracts, conclusion of new contracts, resolution of complaints and service.

9. DATA FOR MARKETING PURPOSES

For marketing purposes, we use the database of our existing customers, as well as the list of people who may yet become our customers. In this list, we have their academic degree, first and last name, title, business company, ID number, address of permanent residence, address of seat or place of business, telephone number and e-mail.

We send commercial communications in the form of paper correspondence, email, the Internet, mobile applications and social networks.

When it comes to sending commercial messages by electronic mail to existing customers of the Company about the same or similar products or services of the Company, it is a use of personal data for which we do not need your consent.

In other cases, this data is used on the basis of your consent to the sending of commercial communications.

III. PURPOSE AND LEGAL BASIS FOR PROCESSING

We process your data only to the extent necessary for the relevant purpose – for example, to be able to deliver goods or provide a service. There are also cases when we negotiate a new contract. The obligation to process your data is also stipulated by a number of legal regulations, e.g. the Act on Accounting, VAT, Income Taxes, etc.

The scope of the processed data depends on the purpose of the processing. For some purposes, it is possible to process data directly on the basis of a contract, the legitimate interest of the Company or on the basis of the law, for others only on the basis of your consent. We do not need your consent to process personal data for the purpose pln the contract, pln of legal obligations and for the legitimate interests of the Company. Personal data for these activities are processed to the extent necessary for pln of these purposes and for the time necessary to achieve them. Personal data are then deleted or anonymized.

In particular, it concerns the following purposes and legal bases of processing divided by individual categories of personal data:

Categories of personal data[2]	Purpose	Legal basis of processing
Identification and contact data for contractual relationships	negotiating the conclusion of the contract	the processing is necessary for the implementation of measures taken prior to the conclusion of the contract at the request of this data subject
Identification and contact data for contractual relationships Data on goods and services and delivery data Payment data Invoicing data	pln of the concluded contract – delivery of goods, provision of services, resolution of complaints, invoicing	the processing is necessary for the pln of the contract to which the data subject is a contracting party
Payment details	identification and proof of origin of payments	processing is necessary for the purposes of the legitimate interests of the Company and for the pln of the legal obligation that applies to the Company - the obligation to keep accounts. The interference with the data subject's rights is proportionate to the given purpose. Without the mentioned personal data, the Company would not be able to carry out business activities in accordance with the legal order, and the data subject (customer) would not be able to receive goods or services from the Company.
Billing data	Issuance of an accounting or tax document, bookkeeping, payment of taxes	processing is necessary for the pln of a legal obligation that applies to the Company - the obligation to keep accounts, the obligation to pay taxes
9. Data for marketing purposes	sending business communications by electronic mail to existing customers of the Company about the same or similar products or services of the Company	protection of the Company's legitimate interests The Company's legitimate interest is confirmed by the fact that this use of data is permitted by the provisions of Article 16, paragraph 2 of the REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on respect for private life and protection of personal data in electronic communications
9. Data for marketing purposes	telemarketing other than the above-mentioned marketing of products or services	the data subject has given consent to the processing of his personal data for one or more specific purposes
Identification and contact data for contractual relationships Data on goods and services and delivery data Payment data Invoicing data Data from communication between the Company and the customer	debt collection, defense against the claims of other persons	protection of the Company's legitimate interests. The interference with the data subject's rights is proportionate to the given purpose. Without the mentioned personal data and their transfer to, for example, the legal representative and the court, the Company would not be able to assert its claims or defend itself against the lawsuits and claims of other persons.
Data obtained during registration on the website	use of the Company's website - registration enables easier use of the e-shop	the processing is necessary for the implementation of measures taken prior to the conclusion of the contract at the request of this data subject
Cookies – information obtained using cookies stored by the Company	carrying out the transmission of electronic communication, or for providing a service through the Company's website, or for measuring traffic on the Company's website.	protection of the Company's legitimate interests The Company's legitimate interest is confirmed by the fact that this use of data is permitted by the provisions of Article 8, paragraph 1, letter a), c), d) REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on respect for private life and protection of personal data in electronic communications
7. Cookies – information obtained using cookies stored by third parties (Google, etc.)	internet advertising	the data subject has given consent to the processing of his personal data for one or more specific purposes using the settings of the internet browser, article 8, paragraph 1., letter b) REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on respect for private life and protection of personal data in electronic communications
database of customers and suppliers	communication, pln of contracts, conclusion of new contracts, resolution of complaints and service	protection of the Company's legitimate interests. The interference with the data subject's rights is proportionate to the given purpose. Without the mentioned personal data, the Company would not be able to carry out business activities, and the data subject would not be able to receive, achieve the resolution of complaints, the provision of service services.

IV. TIME OF PERSONAL DATA PROCESSING AND STORAGE

We only use and store your data for as long as is strictly necessary, as required by law, or as long as we need it to protect our rights. We have internal archiving rules in place to ensure that we do not keep data longer than we are authorized to.

In general, we are required to store basic data and data about products and services based on laws, e.g. accounting or tax laws. E.g. invoices are kept for 5 years from their issue. Due to the need to document a legal reason for issuing invoices, contracts are also archived for a period of 5 years from the date of termination of the contract.

For a period of 3-5 years, we keep the data due to our legitimate interests, especially in case we have to present evidence in a court case, taking into account the limitation periods according to the current Civil Code.

If we use data on the basis of your consent, we only do so for the duration of that consent, unless we have another legal reason to do so.

The table below contains specific processing times for individual categories of personal data for individual purposes.

Categories of personal data[3]	Purpose	Processing time - storage
Identification and contact data for contractual relationships	negotiating the conclusion of the contract	3 years from the end of the contract negotiations
1. Identification and contact data for contractual relations Data on goods and services and delivery data Payment data Invoicing data	pln of the concluded contract – delivery of goods, provision of services, resolution of complaints, invoicing	5 years from the end of the accounting period to which the document containing personal data relates
3. Payment information	identification and proof of origin of payments	5 years from the end of the accounting period to which the document containing personal data relates
4. Billing data	Issuance of an accounting or tax document, bookkeeping, payment of taxes	5 years from the end of the accounting period to which the document containing personal data relates
9. Data for marketing purposes	sending business communications by electronic mail to existing customers of the Company about the same or similar products or services of the Company	3 years from the last provision of our service or purchase of our goods
9. Data for marketing purposes	telemarketing other than the above-mentioned marketing of products or services	for the period during which the consent is validly granted to us - by default, for 3 years, the consent itself and the change or revocation of the consent are kept due to our legitimate interests for the entire period of validity of the consent and 5 years after it has expired
1. Identification and contact data for contractual relationships 2. Data on goods and services and delivery data 3. Payment data 4. Invoicing data 5. Data from communication between the Company and the customer	debt collection, defense against the claims of other persons	5 years from the end of the accounting period to which the document containing personal data relates. If the warranty period or the complaint procedure is longer, the Company stores the documents and data for the period during which this period runs or the procedure lasts. If the document relates to an unpaid claim or an pln obligation, the Company keeps the documents and data until the end of the first accounting period following the accounting period in which the claim was paid or the obligation was pln .
6. Data obtained during registration on the website	use of the Company's website - registration enables easier use of the e-shop	for the duration of the registration
Cookies – information obtained using cookies stored by the Company	carrying out the transmission of electronic communication, or for providing a service through the Company's website, or for measuring traffic on the Company's website.	for the duration of the Rules for the use of cookies and other technologies
7. Cookies – information obtained using cookies stored by third parties (Google, etc.)	internet advertising	for the duration of the Rules for the use of cookies and other technologies
8. database of customers and suppliers	communication, pln of contracts, conclusion of new contracts, resolution of complaints and service	10 years from the end pln the contract If the warranty period or complaint procedure is longer, the Company stores the data for the period during which this period runs or this procedure lasts.

V. SOURCES OF PERSONAL DATA

We process the data we received from you, as well as data from publicly available sources and registers, e.g. from the trade register, as well as data from third parties (data from the ONI system).

VI. RECIPIENTS OF PERSONAL DATA

The company uses the professional and specialized services of third parties to pln its contractual obligations. If these suppliers process personal data transferred from the Company, they have the status of personal data processors and process personal data only on the basis of the contract and according to instructions from the Company and may not use it otherwise.

It is about:

• carrier
• companies dealing with the management and collection of outstanding claims,
• legal representatives, notaries and executors
• auditors
• IT systems administrator (xxx company)
• internet advertising provider (Google)
• our sales representative.

We carefully select each such entity and conclude a personal data processing contract with each one, in which the processor has strict obligations to protect and secure personal data.

Processors are companies based both in the Czech Republic and in a member state of the European Union.

We do not transfer your personal data to recipients or processors outside the territory of the European Union.

As part of pln its legal obligations, the company also transfers personal data to administrative bodies and authorities established by applicable legislation, as some public administration bodies and other organizations are entitled to request information about you. It mainly concerns the courts, the Police of the Czech Republic and others. We only provide data if the right to request this data is permitted by law.

VI. METHOD OF PROCESSING PERSONAL DATA

The company processes personal data manually (in paper form) and automatically through IT systems.

VII. INFORMATION ON THE RIGHTS OF DATA SUBJECTS IN CONNECTION WITH PROCESSING

We process your data transparently, correctly and in accordance with the law. You have the right to access your data, to an explanation, as well as other rights if you believe that the processing is incorrect.

You can exercise all your rights, objections or requests below (of course with the exception of the right to file a complaint with the Office for the Protection of Personal Data, which you can only exercise with it) by letter delivered to the address of the Company's headquarters, by e-mail to the address: 2xalatky@gmail.com or using the form on the Company's website. If you exercise any of your rights and we have reasonable doubts about your identity, we may ask you to provide additional information necessary to confirm it.

In the event that you exercise any right, request or objection, if your request is justified, we will take appropriate measures without delay and no later than one month from the delivery of your request. Otherwise, we will inform you within the same period about the reasons for not taking measures and about the possibility of filing a complaint with the supervisory authority and requesting judicial protection. If necessary, this deadline can be extended by another two months, taking into account the complexity and number of applications. We will then inform you of any extension within one month of receiving the request, together with the reasons for this extension.

If you submit a request in electronic form, we will also provide you with information in electronic form, if possible, unless you request otherwise.

Information and all communications and actions are provided and performed free of charge. If your requests are manifestly unreasonable or unreasonable, we may charge you a reasonable fee that takes into account the administrative costs associated with providing the requested information or communication or taking the requested actions, or refuse to comply with the request.

These are the following rights:

1. RIGHT OF ACCESS TO PERSONAL DATA

If you ask us, you will receive confirmation from us as to whether we are processing your personal data and, if so, also:

– a copy of your personal data that we have,

– information about:

• the purposes for which we process them,
• categories of processed personal data,
• recipients to whom your personal data has been or will be made available,
• the planned period of processing (storage) of your personal data,
• about the existence of the right to request from us the correction or deletion of your personal data, the restriction of their processing or to object to this processing,
• the right to file a complaint with the supervisory authority,
• about any available information about the source of the personal data, unless we have obtained it from you;
• the fact that whether automated decision-making takes place, including profiling.,
• about the appropriate safeguards if we were to transfer your personal data outside the EU (which we do not).

2. RIGHT TO CORRECTION OF INACCURATE DATA

You have the right to notify us of inaccurate, outdated or pln personal data. In that case, we will of course fix them. Until we verify the accuracy of your data, we will limit their processing (see point 4. below). Taking into account the purposes for which the data is processed, you have the right for us to pln pln data as well.

3. THE RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA

You can object at any time to the processing of your personal data that we use for our legitimate interest.

Until it is verified that we have serious legitimate reasons for processing your personal data, we will limit its processing unless such processing is necessary for the determination, exercise or defense of legal claims. If it turns out that we have no grounds for processing your personal data, we will delete your personal data, unless you request that it be retained.

You can also object at any time to the processing of your personal data that we process for direct marketing purposes, and we will stop using your data for these purposes.

4. RIGHT TO LIMIT PROCESSING

In some cases, we are obliged to limit the processing of your personal data. This means that your personal data will be stored with us and we will not handle it otherwise, unless you give us your consent or it is necessary for the purpose of determining, exercising or defending legal claims or for the purpose of protecting the rights of another natural or legal person.

We are obliged to limit the processing of personal data if:

– If you deny the accuracy of the personal data, for the time required for us to verify the accuracy of the personal data;

– It becomes clear that the processing of your personal data is unlawful and you refuse to delete it and instead ask us to limit its use;

– We no longer need your personal data, but you ask us to keep it for the determination, exercise or defense of legal claims;

– You will object to the processing of your personal data for the purposes of our legitimate interests until it has been verified that our legitimate reasons for processing your personal data outweigh your legitimate reasons for the data to be deleted.

5. RIGHT TO ERASURE

You have the right to erasure of personal data concerning you if:

– your personal data are no longer needed for the purposes for which they were collected or otherwise processed;

– you revoke the consent on the basis of which the data was processed, and there is no other legal reason for the processing;

– you object to the processing of your personal data for the purposes of our legitimate interests and it becomes clear that our reasons for the processing are not serious;

– you object to the processing of personal data for direct marketing;

– personal data were processed by us illegally;

– personal data must be deleted to pln a legal obligation that the law imposes on us;

– personal data were collected in connection with the offer of information society services to the child.

Please note, however, that there are cases when we are not obliged to delete your personal data (even if any of the above conditions are pln ), for example if we need the data to determine, exercise or defend legal claims.

6. RIGHT TO PORTABILITY OF PERSONAL DATA

If we process your personal data automatically (i.e. using computer technology) based on a contract or with your consent and you ask us to do so, we will give you the personal data you have provided to us in a structured, commonly used and machine-readable format. If you wish, we will transfer this data directly to another controller that you designate, if technically feasible.

If the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be granted.

7. THE RIGHT TO WITHDRAW CONSENT TO THE PROCESSING OF PERSONAL DATA

In cases where we need your consent to process your data, you are entitled to withdraw this consent at any time. Withdrawal of consent does not affect the processing of your data for as long as this consent was validly granted by you, nor the processing of your data for other legal reasons, if applicable (e.g. compliance with legal obligations or for the purposes of our legitimate interests).

8. AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING

You have the right not to be subject to any decision based solely on automated processing, including profiling, which would have legal effects on you or similarly significantly affect you.

The company does not make automated decisions without the influence of human judgment with legal effects for data subjects.

9. THE RIGHT TO APPLY TO THE AUTHORITY FOR THE PROTECTION OF PERSONAL DATA

If you believe that the processing of your personal data has violated a regulation or other legal regulation, you have the right to contact the Office for the Protection of Personal Data ( www.uoou.cz ) and file a complaint with it.

10. RIGHT TO LIMIT OR CANCEL MARKETING COMMUNICATIONS

If you have given us consent for marketing or otherwise receive commercial offers from us, you can withdraw your consent at any time or opt out of receiving offers in the following ways:

– the option to stop sending them is included directly in our commercial communications,

– if you no longer want us to call you, tell us during the call,

– you can also tell us at our branch or in writing that you no longer wish to receive offers.

Please note that if you limit marketing, we may still contact you for service, claims and provision of the services you have ordered.

VIII. COMMISSIONER FOR THE PROTECTION OF PERSONAL DATA

More information on request at 2xalatky@gmail.com