Request a solution

Personal Data Processing Policy

OPTIXS, s.r.o., with its registered office at Křivoklátská 37/3, Letňany, 199 00 Prague 9, Company Registration Number: 02418072 (hereinafter referred to asthe “Controller”), hereby informs its customers and business partners, in accordance with Article 12 et seq. of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), of the manner and scope of the processing of personal data.

I. Scope and categories of data processed

The Controller processes personal data provided to it by the data subject in connection with the conclusion of a sales contract, a quotation request or registration to receive commercial communications. This includes, in particular:

  1. Identification and billing details: First name, surname, title, company name, company registration number, VAT number, registered office/business address.
  2. Contact details: Delivery address, telephone number, email address.
  3. Transaction data: Bank account number, order history and fulfilment of contracts.
  4. Technical data: IP address and cookies (to the extent consented to by the user in their browser settings or cookie bar).

II. Purpose and legal basis for processing

The Data Controller processes personal data for the following purposes and on the basis of the following legal grounds:

  1. Performance of a contract and pre-contractual negotiations: Processing is necessary for the fulfilment of orders, the delivery of goods and communication with the customer. The provision of data is a contractual requirement.
  2. Compliance with legal obligations: The Controller is obliged to retain accounting and tax documents for the period specified by the relevant legislation (the Accounting Act, the VAT Act).
  3. Legitimate interests of the Data Controller (Direct marketing to customers): The Data Controller is entitled to send existing customers commercial communications relating to similar goods or services to the contact details obtained in connection with the sale. The data subject has the right to object to this processing at any time (opt out).
  4. Consent to processing (Marketing to other parties): in the case of individuals who are not customers of the Controller (e.g. newsletter subscribers, enquirers without a concluded contract), commercial communications are sent solely on the basis of freely given consent. This consent may be withdrawn at any time.

III. Recipients of personal data

Personal data is not disclosed to third parties, with the exception of entities whose cooperation is necessary for the performance of a contract or to ensure the company’s operations (so-called processors):

The Controller has entered into appropriate data processing agreements with all processors to guarantee data security.

IV. Data retention period

Personal data is processed and retained for the period strictly necessary to fulfil all rights and obligations arising from the contractual relationship, and further for the period during which the Controller is obliged to retain the data in accordance with generally applicable legal regulations (usually 10 years for tax documents). 

Data processed for marketing purposes is retained for the duration of the Controller’s legitimate interest (in particular, for the duration of the business relationship) or until consent is withdrawn or an objection is raised against such processing.

V. Rights of the data subject

In connection with the processing of personal data, the data subject has the following rights under the GDPR:

  1. Right of access: The right to request confirmation from the Controller as to whether their personal data is being processed and, if so, to obtain access to it.
  2. Right to rectification: The right to have inaccurate personal data rectified or incomplete personal data completed.
  3. Right to erasure: The right to request the erasure of personal data without undue delay where the grounds for processing no longer apply, or where consent has been withdrawn or a legitimate objection has been raised.
  4. Right to restriction of processing: The right, in certain cases, to request that the processing of data be restricted.
  5. Right to object: where processing is based on a legitimate interest (Article II(3)), the data subject has the right to object. If the data subject does so, the Controller shall no longer process the personal data for these purposes, unless the Controller demonstrates compelling legitimate grounds for continuing the processing.
  6. Right to withdraw consent: Where processing is based on consent, the data subject has the right to withdraw that consent at any time.
  7. Right to lodge a complaint: The data subject has the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz), if they believe that the processing of their personal data infringes the GDPR.

VI. Data Security

The Data Controller declares that it has taken all appropriate technical and organisational measures to safeguard personal data, in particular measures to secure data storage facilities and physical storage of personal data, and that access to personal data is restricted to authorised personnel only.

VII. Final Provisions

By submitting an order via the online order form, you confirm that you have read and understood the privacy policy and that you accept it in its entirety. The Data Controller is entitled to amend these terms. A new version of the privacy policy will be published on its website.

Contact details of the Data Controller:

OPTIXS, s.r.o., Křivoklátská 37/3, 199 00 Prague 9

Website: www.optixs.cz