These Personal Data Processing Principles (the "Principles") have been issued by sídlomat s.r.o., with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, Company ID (IČO): 082 43 387, entered in the Commercial Register (obchodní rejstřík) kept by the Municipal Court in Prague, file No. C 315452 (the "Company"). These Principles describe how the Company collects, processes and shares the information of users (the "user") of the website sidlofirmypraha5.cz, and of customers (the "customer") using its services.

The Company is both the controller and the processor of the personal data of customers who provide it when ordering the services; the Company may use the further processors listed below to process the personal data.

We recommend that you read the entire Principles and make sure that you fully understand the information provided. If you have any questions about these Principles or about the Company's collection, processing and sharing of personal data, please contact us at [email protected].

The Company processes data obtained through the use of the website and by means of cookies. To better target its advertising campaigns and to improve the website, the Company uses information about the user and the pages viewed, or about the links they clicked and other activities on the website, such as the completion of order and contact forms. This data is obtained automatically through the Company's tools and the tools of the data processors listed below. If your device has cookie storage enabled, this data is also obtained by means of those files.

The Company processes above all the data you provide in the contact form. Some personal data is necessary in order to complete the form (name and email address) and serves for the basic identification of the user. The data the Company processes may include the following:

• First and last name, or business name (obchodní firma);
• Business identification number (IČO);
• Tax identification number (DIČ);
• A copy of an identity document (identity card / driving licence / passport / residence permit);
• Where necessary, further data strictly required to conclude and perform the contractual relationship, such as:
  • Sex;
  • Permanent residence address;
  • Other place of residence;
  • Date of birth;
  • Place of birth;
  • Nationality;
  • Identity document number;
  • The authority that issued the identity document;
  • The validity date of the identity document;
  • Birth number (rodné číslo) or another national identifier;
  • Email address;
  • Telephone number.

The Company does not knowingly collect information from persons under 18 years of age, and persons under 18 may not use its services. If you learn that a person under 18 has provided us with personal information in breach of these Principles, you may notify us at [email protected].

The Company always processes personal data solely for the purposes for which it was collected, on the basis of a legitimate interest, a legal obligation or the consent granted. We process personal data for various purposes, chiefly for:

• the performance and realisation of concluded contracts and orders;
• the fulfilment of statutory obligations in the area of accounting and taxes, or as required by other applicable laws and regulations, or as required by any judicial proceedings or an administrative authority;
• communication with customers, including sending information about current services and products, updates to the terms and conditions, and for marketing and promotional purposes;
• sending a reply to an enquiry from users of the website;
• handling a response to a specific job offer;
• analytics of website traffic in order to improve the services and their offering;
• evaluating the effectiveness of marketing: for each order, enquiry, contact form and affiliate partner registration we record where the visit came from (campaign and UTM parameters, referring website, landing page and time of the visit) on the basis of legitimate interest; ad click identifiers (e.g. gclid, fbclid) are stored only with your consent to marketing cookies;
• conversion measurement in advertising systems: with your consent to marketing cookies, we pass an encrypted (hashed) email address and telephone number from the order or enquiry to Google for more accurate conversion measurement (Google Ads enhanced conversions);
• marketing outreach by means of electronic contact;
• processing transactions and detecting fraud;
• targeting potential customers by means of online advertising. To better target advertising and to optimise the website, the Company uses information about users' activity on the website. This information also includes data obtained by means of cookies.

Personal data is processed above all by the Company and its employees, who are bound by a duty of confidentiality, and further by the Company's service suppliers where it is processed in connection with the performance and realisation of concluded contracts and orders (e.g. lawyers).

The Company may further use so-called processors to process personal data. These entities may process personal data only for the purposes and in the manner determined by the Company and may not extend that processing without further consent. We pass on to processors only the data they strictly need in order to provide their services. The Company uses the following processors:

• Google LLC (tools for web analytics and online marketing);
• Meta Platforms Ireland Ltd. (tools for online marketing);
• Seznam.cz, a.s. (tools for online marketing);
• Microsoft Ireland Operations Ltd. (Microsoft Clarity and Microsoft Advertising – tools for web analytics and online marketing);
• Smartlook.com, s.r.o. (web analytics tool);
• OpenAI Ireland Ltd. (tools for online marketing);
• Ahrefs Pte. Ltd. (web analytics without cookies);
• Usercentrics A/S (Cookiebot – cookie consent management).
• In justified cases, the Company may also pass personal data to other entities (processors).

Personal data may be passed to the following processors:

• processors that process personal data according to the Company's instructions in the area of public relations, electronic data administration or bookkeeping;
• public authorities and other entities where required by applicable legislation;
• other entities in the event of an unexpected event in which the provision of the data is necessary in order to protect life, health, property or another public interest, or where it is necessary to protect our rights, property or safety.

Personal data for the purposes set out in point 2 is processed to the extent necessary to fulfil those purposes and for the period necessary to achieve them, or for the period directly laid down by legislation. Thereafter, the personal data is erased or anonymised.

After this period has elapsed, personal data may be kept only for the purposes of the state statistical service, for scientific purposes and for the purposes of archiving.

The basic time limits for the processing of personal data are available below.

The Company processes the personal data of registered customers until their registration is cancelled. Data on customers' contact persons is processed for the entire duration of the business relationship, or until the customer updates the data.

In the case of customers of the services, the Company is entitled, where applicable, to process their basic personal, identification and contact data, data about the services and data from their communication with the Company for a period of 10 years from the day the last contract ended.

Invoices issued by the Company are, in accordance with Section 35 of Act No. 235/2004 Coll., on Value Added Tax (zákon o dani z přidané hodnoty), archived for a period of 10 years from their issue. Owing to the need to demonstrate the legal grounds for issuing the invoices, contracts are also archived for a period of 10 years from the day the contract ended.

Data obtained for marketing purposes is processed for the entire duration of the consent, that is, also for the period during which the user permits storage within the cookie settings on the website or in their browser. Processing may continue even after the consent is withdrawn, at most until the expiry of the relevant type of cookie.

Business and marketing communications sent by means of electronic contact are sent until the consent is withdrawn or until their receipt is unsubscribed.

Customers may at any time cancel the receipt of any marketing and business communications, namely:

• by clicking the relevant link placed in the footer of each business communication;
• on the web page designated for that purpose;
• by sending a request to the contact provided.

The user can disable advertising targeting (cookies) by making a change directly in their browser. If you disable the storage of selected cookies, some parts of the website may not work correctly.

The processing of personal data takes place both manually and automatically in electronic information systems, in electronic or paper form, always with a high level of technical, organisational and personnel security within the meaning of the requirements of generally binding legislation.

All persons who, in the course of their work position (or within the scope of contractually assumed obligations), come into contact with personal data are trained and bound by a duty of confidentiality.

Where the data subject is an identifiable natural or legal person and proves their identity, they will have the following rights:

• The right of access to personal data

Under Article 15 GDPR, the data subject has the right of access to personal data, which comprises the right to obtain from the Company:

• confirmation as to whether it is processing their personal data;
• information about the purposes of the processing, the categories of personal data concerned, the recipients to whom the personal data has been or will be disclosed, the envisaged period of processing, the existence of the right to request from the controller the rectification or erasure of personal data concerning the data subject or the restriction of its processing or to object to such processing, the right to lodge a complaint with a supervisory authority, all available information about the source of the personal data where it is not obtained from the data subject, the fact that automated decision-making, including profiling, is taking place, and the appropriate safeguards for the transfer of the data outside the EU;
• where this will not adversely affect the rights and freedoms of others, a copy of the personal data as well.

In the case of a repeated request, the Company will be entitled to charge a reasonable fee for a copy of the personal data.

Right to the rectification of inaccurate data

Under Article 16 GDPR, you have the right to the rectification of inaccurate personal data that the Company processes about you. You also have an obligation to notify changes to your personal data and to prove that such a change has occurred. At the same time, you are obliged to provide cooperation to the Company where it is found that the personal data it processes about you is not accurate. We will carry out the rectification without undue delay, always however having regard to the technical possibilities available.

Right to erasure

Under Article 17 GDPR, you have the right to the erasure of personal data concerning you, unless the Company demonstrates legitimate grounds for processing that personal data. The Company has mechanisms in place to ensure the automatic anonymisation or erasure of personal data where it is no longer needed for the purpose for which it was processed.

Right to the restriction of processing

Under Article 18 GDPR, the data subject has, until the matter is resolved, the right to the restriction of processing where they contest the accuracy of the personal data or the grounds for its processing, or where they object to its processing, in writing to the Company's registered office address.

Right to notification of rectification, erasure or restriction of processing

Under Article 19 GDPR, the data subject has the right to notification by the Company in the event of the rectification, erasure or restriction of processing of personal data. Where personal data is rectified or erased, the Company will inform the individual recipients, except in cases where this proves impossible or would require disproportionate effort.

Right to the portability of personal data

Under Article 20 GDPR, you have the right to the portability of the data concerning you that you provided to us as the controller, in a structured, commonly used and machine-readable format. At the same time, you have the right to ask us to transmit this data to another controller. Where the exercise of this right could adversely affect the rights and freedoms of third parties, your request cannot be granted.

Right to object to the processing of personal data

Under Article 21 GDPR, you have the right to object to the processing of your personal data by the Company. Unless the Company demonstrates that there are compelling legitimate grounds for the processing which override the interests or the rights and freedoms of the data subject, the Company will, on the basis of the objection, end the processing without undue delay.

Right to withdraw consent to the processing of personal data

If you grant the Company consent to the processing of personal data, it can be withdrawn at any time. The withdrawal must be made by an express, comprehensible and specific expression of will, either in writing to the Company's registered office address or by means of the email address [email protected].

Automated individual decision-making, including profiling

The data subject has the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The Company states that it does not carry out automated decision-making, without the influence of human assessment, with legal effects for data subjects.

Right to contact the Office for Personal Data Protection

You have the right to lodge a complaint concerning our processing of your personal data with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7. The authority's website: www.uoou.cz.

The Company undertakes to protect the personal data and other information of its customers and of the users of its services. To that end it uses a range of security technologies and measures designed to protect information against unauthorised access, use or disclosure. The measures it uses are designed to provide a level of security appropriate to the risk of misuse of personal data. The security of personal data is regularly tested by the Company and the protection is continuously improved. Please bear in mind, however, that 100% certainty cannot be guaranteed on the internet. All personal data in electronic form is stored in databases and systems accessible only to persons who need to handle the personal data directly for the purposes set out in these rules, and only to the extent necessary.

If you have any questions about this processing of personal data, or if you wish to exercise your rights, do not hesitate to contact us at [email protected].

The controller of your personal data is sídlomat s.r.o., with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, Company ID (IČO): 082 43 387, entered in the Commercial Register kept by the Municipal Court in Prague, file No. C 315452.

We hereby inform you that we may amend or update these Personal Data Processing Principles at any time.

Any changes to these Principles become effective upon their publication in Czech on the following page: /gdpr.

These Personal Data Processing Principles are effective from 1 January 2023.