Consent to the processing of personal data

Consent to Personal Data Processing
INFORMATION FOR CLIENTS ON PERSONAL DATA PROCESSING:
The Controller declares that all personal data provided to it by the Client (data subject) will be processed in accordance with applicable Czech legislation, in particular with Act No. 110/2019 Coll.
according to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation)

I. Personal Data Controller
FLOR SERVICE TRADE, s.r.o.
Kopečná 949/14
602 00 Brno
Registration No.: 02108208

II. Legal Basis, Purposes and Scope of Processing
The Controller processes Client personal data on the basis of the legal titles listed below and for the specified purposes:

1. Performance of Contract (Performance of Purchase Agreement)
• Legal basis: Necessity for the performance of a contract to which the Client is a party (purchase agreement, service provision agreement). Provision of personal data is a contractual obligation of the Client.
• Purpose of processing: Order processing, goods delivery, service provision, invoicing, communication regarding the order, warranty claims and complaint resolution.
• Scope of data: Title, first name, surname, address, delivery address, e-mail, telephone number, bank account number (for payments/refunds).

2. Compliance with Legal Obligation
• Legal basis: Necessity for compliance with a legal obligation applicable to the Controller (e.g. accounting act, tax laws, VAT act, archival act).
• Purpose of processing: Accounting, tax obligation compliance, document archiving.
• Scope of data: Billing data (first name, surname, ID number/Tax ID, address), data on documents.

3. Legitimate Interest of the Controller
• Legal basis: Legitimate interest of the Controller.
• Purpose of processing:
o Protection of legal claims (maintaining records for potential litigation, debt collection).
o Sending commercial communications (newsletters) to existing Clients at their e-mail address, unless the Client has rejected such communications (so-called legitimate interest under Act No. 480/2004 Coll., on certain information society services). You can unsubscribe from the mailing list at any time.
• Scope of data: Contact and identification data, purchase data.

III. Duration of Personal Data Processing
Personal data will be processed for the duration of the contractual relationship and subsequently for the time necessary to:
1. Compliance with legal obligations: In particular for 10 years from the end of the tax period in which the transaction occurred (for tax and accounting law purposes).
2. Protection of legal claims: For 4 years from the termination of the contract or complaint resolution, but no longer than until the statute of limitations for legal claims expires.
3. Archiving: According to Act No. 499/2004 Coll. (Archival Act and Records Management Act) and applicable deadlines.
After the archival period expires, the data will be destroyed.

IV. Data Processors and Recipients of Personal Data
The Controller transfers Client personal data only in justified cases and only to the extent necessary, to the following categories of recipients:
Data Processors (entities processing data for the Controller):
• IT systems and web hosting providers (e.g. BSSHOP or other e-shop solution operator).
• Accounting, audit and tax service providers.
• Marketing service providers.

Recipients (entities to whom transfer is necessary for contract/law performance):
• Carriers and delivery companies (for the purpose of delivering ordered goods).
• Payment gateways and banking service providers (for the purpose of processing payments).
• Public authorities (e.g. tax office, courts, criminal prosecution bodies) in accordance with applicable laws.

V. Client (Data Subject) Rights
As a Client (data subject), you have the following rights in connection with the processing of personal data:
1. Right of access to personal data: You have the right to obtain confirmation of whether and what data about you we process, and to obtain a copy of such data.
2. Right to rectification and completion: You have the right for us to correct inaccurate personal data and complete incomplete data without undue delay.
3. Right to erasure ("right to be forgotten"): You have the right for us to erase your data if:
o they are no longer necessary for the purposes for which they were collected,
o you have withdrawn consent and there is no other legal basis for processing,
o you have objected to processing and there are no overriding legitimate reasons for processing,
o the data were processed unlawfully. (This right does not apply if processing is necessary for compliance with a legal obligation - e.g. for accounting purposes).
4. Right to restrict processing: You have the right for us to restrict the processing of your data in cases where:
o you dispute the accuracy of the data (until verified),
o processing is unlawful, but you refuse erasure and request restriction,
o the Controller no longer needs the data, but you require it for the establishment, exercise or defence of legal claims.
5. Right to data portability: You have the right to obtain personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.
6. Right to object: You have the right to object at any time to the processing of your personal data carried out on the basis of the Controller's legitimate interest (e.g. against newsletter sending). In case of objection, the Controller will no longer process the data unless it demonstrates compelling legitimate reasons for processing that override the Client's interests, or for the establishment, exercise or defence of legal claims.

VI. Exercise of Rights and Complaints
You can exercise all your rights by contacting the Controller at the e-mail address info@florservice.cz or in writing at the company's registered address.
Right to lodge a complaint: If you believe that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the supervisory authority. The supervisory authority in the Czech Republic is:
Office for Personal Data Protection Pplk. Sochora 27 170 00 Prague 7 web: www.uoou.cz