In accordance with the principle of transparency, the data controller is obligated to inform the data subject about the processing of personal data concerning that subject. The information obligation is specified by Articles 13 and 14 of the European Parliament and Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and by Act No. 110/2019 Coll.
Name and Address of the Controller: The controller according to the above-mentioned legislation is:
Optiflow Solutions s.r.o.
Trojská 782/53,
182 00 Praha 8
Company ID: 08226695
Registered in the Commercial Register at the Municipal Court in Prague under section C 315064.
Purpose of Processing Personal Data:
- Communication via designated persons
- Marketing communication
- Protection of legal claims
- Fulfillment of legal obligations
- Fulfillment of contractual relationships
- Prevention of fraudulent activities and defense in case of a dispute
- Accounting and tax purposes
- Debt collection
- Network and information system security
- Customer support
- Sending offers of other products and services
Processed Personal Data:
- Identification data (first name, last name)
- Contact details (address, email, phone)
- Bank account details
- Other data necessary for fulfilling the contract or statutory legal provisions, depending on the purpose for which the personal data was obtained.
Method of Processing and Protection of Personal Data: Personal data is processed by the controller or processor based on a contract for processing personal data, specifically in the areas of payroll, accounting, and healthcare. The controller processes personal data through authorized employees or employees of processors. Processing takes place using IT equipment or manually for paper-based personal data while adhering to all security principles for the management and processing of personal data. The controller has implemented technical and organizational measures to ensure the protection of personal data, particularly measures to prevent unauthorized or accidental access, modification, destruction, or loss of personal data, unauthorized transfers, and unlawful processing or other misuse of personal data. All entities to which personal data may be disclosed respect the right to privacy and are obligated to comply with applicable data protection laws.
Retention Period of Personal Data: The controller processes and stores personal data for the period necessary to fulfill all rights and obligations arising from the relevant contractual relationship and for as long as the controller is required to retain personal data under applicable laws. Data provided during contractual negotiations and business relationships is kept for three subsequent calendar years after receiving the personal data. Data provided during recruitment processes is retained for the duration of the selection process. Data provided based on consent is kept for the duration of the consent. In other cases, the processing period depends on the purpose of the processing or is governed by legal provisions in the field of personal data protection.
Data subject to archiving under specific legal provisions will be processed for the duration specified by those provisions.
Rights of the Data Subject: Every data subject has the following rights under applicable law, which can be exercised at any time:
- The right to be informed about the processing of personal data (including the purpose, legitimate interests of the controller, recipients of personal data, etc.)
- The right to access personal data (upon request, the controller will provide information about personal data they hold)
- The right to rectification (you can request the correction of inaccurate personal data)
- The right to erasure (you can request that your data be erased, unless other legal obligations apply)
- The right to restrict processing (you can define limitations for the processing of your data if not in conflict with other processing purposes)
- The right to data portability (your data can be transferred to another entity at your request)
- The right not to be subject to automated individual decision-making, including profiling (currently, no automated processing or profiling is performed)
- The right to object (you can object to processing and withdraw your consent, as well as file a complaint with the supervisory authority, the Office for Personal Data Protection, address: Pplk. Sochora 27, 170 00 Praha 7, phone: 234 665 111, website: www.uoou.cz).
We emphasize that exercising these rights does not pose any risk to you and will not affect your future relationship with the controller in any negative way. We aim to process personal data legally and properly and protect your rights. If you have any concerns, we would appreciate it if you bring them to our attention.