TERMS AND DEFINITIONS
A. CONTACTS
1. SUBJECT MATTER. APPLICATION
1.1. This Policy defines the procedure for processing and protecting Personal Data by the Company (the “Company,” “Laflau,” “we,” “us,” “our”), which is received (collected) by the Company from the Data Subjects (“you,” “your”): (1) when you use the Service, (2) when we provide services to you or you provide services to us, as well as in relation to (3) the activities carried out in accordance with the Company’s constituent documents, (4) entering into and performing any contracts and agreements to which either the Company or the Data Subject is a party, (5) exercising rights and performing obligations arising out of the employment relationships involving the Company, and (6) in other cases as stipulated by the applicable laws of Czech Republic or other regulations governing the processing of Personal Data, or by this Policy.
1.2. The Policy shall apply:
(1) to the Data Subjects (see Appendix 02 to this Policy for more details);
(2) to other persons, if their participation is required for the processing of Personal Data in case of transmitting the Personal Data by the Company to counterparties under personal data processing agreements, other agreements, and contracts (see Section 5 of the Policy for more details);
(3) irrespective of where we store or process your Personal Data.
2. WHAT PERSONAL DATA WE COLLECT AND PROCESS
2.1. We collect and process the following categories of Personal Data:
(1) Provided Data: data you provide to us. You provide data when signing up for the Service, filling out forms within the Service, or communicating with us via email, phone, messengers, or social media. We keep a record of such messages if you write to or call us.
(2) Usage Data: data we collect automatically. We automatically collect certain information when you visit, use, or navigate through the Service.
(3) Third-party Data: data we receive from third parties. We may receive information about you from other sources, including third parties, which help us to update, expand, and analyze our available data; prevent or detect fraud; process payments; or analyze your usage of the Service.
For more details on the Personal Data we collect and process for each category, see Appendix 01 to this Policy.
3. PROCESSING OF PERSONAL DATA. PURPOSES AND LEGAL GROUNDS
3.1. We process Personal Data for the following purposes: (1) ensuring the proper functioning of the Service, including cases where we provide services to you and/or you provide services to us, (2) entering into and performing existing contracts and agreements, (3) in cases provided by the applicable laws of Czech Republic or other regulations governing the processing of Personal Data, and (4) for other purposes.
3.2. We process Personal Data on the following legal grounds:
(1) Consent: We process your Personal Data with your express consent to the processing of the Personal Data for a specific purpose.
(2) Legitimate Interests: We process your Personal Data to the extent reasonably required to meet our legitimate business interests.
(3) Contract Performance: We process your Personal Data where it is required to perform the terms and conditions of the contract you have entered into with us.
(4) Legal Obligations: We process your Personal Data where it is required by law to comply with applicable laws, government requests, in the course of a court proceeding, in accordance with court rulings, or in the course of a legal process, e.g., in response to a court ruling or subpoena (including in response to requests from public authorities to comply with national security or law enforcement requirements).
For a list of specific purposes of the Personal Data processing, the legal grounds for such processing, and the categories of processed Personal Data, see Appendix 03 to this Policy.
4. RIGHTS OF THE DATA SUBJECTS
4.1. The Data Subjects have the following rights, including: (1) the right to access, (2) the right to data rectification, (3) the right to data erasure (the “right to be forgotten”), (4) the right to restrict processing, (5) the right to data portability, (6) the right to object, as well as (7) other rights stipulated by the applicable laws of Czech Republic or other regulations governing the processing of Personal Data, or by this Policy.
4.2. The Data Subjects or their representatives may exercise their rights by submitting a request using the details specified in Section A of the Policy, or in any other manner provided by this Policy.
4.3. If we are unable to identify the Data Subject who has submitted the request, we may request additional information to help us identify the Data Subject, e.g., information confirming the relationship between the Data Subject and the Company (contract number and date, other details), or other information confirming that the Company has processed the Personal Data of the Data Subject.
4.4. We may reject a request if required by the laws of Czech Republic or by legislative requirements that third parties we cooperate with must comply with. The reasons for rejection will be stated in our response.
4.5. You may file a complaint against our rejection with the local supervisory authority for data protection.
For a complete list of rights of the Data Subjects and their scope, see Appendix 04 to this Policy.
5. PROVISION (DISCLOSURE) OF PERSONAL DATA TO THIRD PARTIES
5.1. We provide (disclose) Personal Data to third parties if they are: (1) competent authorities, (2) Sellers, (3) providers, including partners, contractors, or agents providing services to us or on our behalf and requiring access to such information to perform their obligations, and (4) purchasers of the Company’s business/assets.
5.2. By accepting this Policy and providing us with your Personal Data, you give your consent to such provision (disclosure) of Personal Data. If you do not consent to such provision (disclosure) of Personal Data, you will be unable to use the Service.
For the list of third parties to whom we provide (disclose) Personal Data, the categories of provided Personal Data, and specifics of processing such Personal Data by third parties, see Appendix 05 to this Policy.
6. STORAGE OF PERSONAL DATA
6.1. We store your Personal Data for the periods specified in Appendix 06 to this Policy. The applicable laws of Czech Republic or other regulations governing the processing of Personal Data may provide for a longer storage period.
7. TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES
7.1. The countries to which we or third parties we cooperate with transfer your Personal Data may not have data protection laws equivalent to those in your jurisdiction. In such cases, we take appropriate safeguards as stipulated by the applicable laws to ensure your data is adequately protected during its transfer outside your jurisdiction.
7.2. By accepting this Policy and providing us with your Personal Data, you give your consent to such transfer. If you do not consent to such transfer of Personal Data, you will be unable to use the Service.
7.3. If your jurisdiction is the European Economic Area (EEA), we may transfer your data outside the EEA to perform a contract/agreement entered into with you. During such data transfer, we (1) meet our legal and regulatory obligations; (2) take appropriate precautions, such as abiding by the standard contractual clauses on the protection of Personal Data. We will undertake all reasonable steps to ensure your data is securely processed in compliance with this Policy.
8. PERSONAL DATA OF MINORS
8.1. The Service is designed for a broad audience and may be used by minors. Minors may access certain public features of the Service and its content without having to provide us with Personal Data. However, minors wishing to access all the content and functionality of the Service must sign up. Signing up involves the collection of certain Personal Data. We may ask you to provide us with information and documents proving your age. If you are a minor, we may ask you to provide documents proving emancipation from parents or the legal consent of your parent or other legal representative.
8.2. Additionally, we use certain technologies, such as cookies (see Section 11 of this Policy), to automatically collect information on our Users (Purchasers) (including minors) when they visit or use the Service. We collect, process, store, and disclose data of minors in the manner provided by this Policy.
If you are a parent or other legal representative of a child and have become aware that your child has provided us with Personal Data, please contact us at the address specified in Section A of this Policy.
9. PROTECTION OF PERSONAL DATA
9.1. We use appropriate physical, electronic, managerial, and technical safeguards to ensure the security of all Personal Data that we process. However, we cannot ensure or guarantee the complete (absolute) security of your Personal Data that you transfer to the Service. While we do our best to protect your Personal Data, you should act responsibly when transferring your Personal Data to the Service. Please use the Service only in a secure environment, for instance, use firewalls, and choose a provider that encrypts traffic.
10. AUTOMATED DECISION-MAKING
10.1. We do not use automated decision-making processes, including User profiling, that rely on Personal Data.
11. USE OF COOKIES AND SIMILAR TECHNOLOGIES
11.1. See our Cookie Policy to learn more about how we use cookies and similar technologies and how you can control and/or opt out of such technologies.
12. AMENDMENTS
12.1. We may amend the Policy at any time. Any amendments we make to the Policy shall become effective upon the release of the revised Policy. Every new version shall supersede any prior version of the Policy. We advise you to frequently review the Policy to stay informed about how we collect, process, and protect your Personal Data.
Appendix
to the Personal Data Processing Policy
CATEGORIES OF COLLECTED AND PROCESSED PERSONAL DATA
Provided Data
Usage Data
Third-Party Data
Appendix 02
to the Personal Data Processing Policy
DATA SUBJECTS. PROCESSED PERSONAL DATA OF DATA SUBJECTS
Purchasers, including minors
Sellers
Recipients
Potential Users (signing up for the Service but not using it)
Current or former employees of Laflau
Candidates for Laflau vacancies
Natural persons who have or had civil-law relations with Laflau
Representatives or employees of Laflau counterparties
Loyalty program members
Parents of minors
Shareholders and founders of Laflau
Individuals who reached out to Laflau with inquiries, communications, applications, complaints, suggestions via contact information or feedback tools
Individuals involved in interviews, surveys, analytical and marketing studies related to Laflau operations
Visitors to Laflau office spaces
Appendix 03
to the Personal Data Processing Policy
PROCESSING OF PERSONAL DATA. PURPOSES AND LEGAL GROUNDS. CATEGORIES OF PERSONAL DATA
Creation (registration), maintenance, and management of a Service account. Registration and further signing in to the Service, including seamless authorization features. Identification of the account in automated management systems, such as CRM. Sending informational messages and push notifications related to Service operation (service notifications)
Entering into contracts with Users. Performance of terms and conditions of contracts entered into with Users, including provision of services, payment for services/orders, order fulfillment and management, provision of data to third parties for order fulfillment, communication during order fulfillment (providing order status updates, responding to inquiries, complaints, and providing support)
Membership in loyalty programs
Exercising rights and fulfilling obligations arising from employment relationships
Sending promotional/marketing messages. Presenting targeted advertising using cookies and similar technologies
Conducting promotional/marketing events
Sending information on amendments in terms and conditions, policies, agreements
Sending information on new products/services/features
Searching and selecting candidates for Laflau vacancies
Conducting research and surveys. Requesting and posting feedback
Developing new features, creating new products/services and offers
Collecting, processing, and presenting statistical data and other research based on anonymized Personal Data
Entering into, performing, and terminating civil-law contracts with third parties
Carrying out activities provided for by Laflau constituent documents
Preventing misconduct, specifically fraud. Enhancing methods for combating fraud
1) Assessing and improving service quality
2) Identifying and preventing technical issues within the Service
3) Managing the Service in terms of internal operations, including fault searching and correction, data analysis, testing, research, statistics, and surveys
4) Ensuring optimal Service performance
5) Maintaining Service security and robustness
1) Providing responses during legal, regulatory, and arbitration proceedings
2) Responding to information requests received from public authorities or other third parties
3) Preventing damage in accordance with the law
Appendix 04
to the Personal Data Processing Policy
RIGHTS OF THE DATA SUBJECTS
Access to Personal Data
Rectify Incorrect Data
Object to Processing
Data Portability
Erase Data
Revoke Consent to Data Processing
Restrict Processing
Opt-Out of Advertising/Marketing Messages and Targeted Advertising
Information on Data Transfer Precautions to Third Countries or International Organizations
File Complaints
Appendix 05
to the Personal Data Processing Policy
THIRD PARTIES TO WHICH WE PROVIDE (DISCLOSE) PERSONAL DATA
1.1. We transfer and disclose Provided Data, Usage Data, and Third-Party Data. Personal Data is provided upon request and in compliance with the applicable laws.
2.1. We transfer and disclose the Purchasers’ Provided Data to enable the Seller to fulfill their contractual obligations to the Purchasers.
3.1. Payment acceptance and invoicing service providers
3.1.1. We only transfer and disclose Provided Data to the mentioned providers upon their request. If you do not engage payment acceptance and invoicing services within the Service, we will not share Provided Data with them.
3.1.2. We neither collect nor store your credit card information. Such information is provided directly to our payment acceptance and invoicing service providers. Their use of Provided Data for payment processing is governed by their privacy policy.
3.2. Data storage service providers
3.2.1. We store Provided Data, Usage Data, and Third-Party Data at the Scaleway Data center Paris 1 (France, Paris).
3.3. Telecommunication Service Provider
3.3.1. We transfer and disclose Provided Data to telecommunication service providers.
3.4. Advertising Platforms and Applications
3.4.1. We transfer and disclose Usage Data. The advertising platforms we use allow us to optimize and display ads based on Service usage data, such as tracking Usage Data, including cookies.
3.5. Marketing and Analytics Platforms
3.5.1. We transfer and disclose Usage Data, including cookies, for web and mobile analytics purposes, as well as to personalize content within the Service: for example, to offer you only those of our services that might be of particular interest to you.
Platforms
Google Analytics; Firebase
Usage Purpose
Who Stores and Processes Data
Google LLC, Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.
Where to Find the Service Privacy Policy (if available)
https://policies.google.com/privacy
How You Can Opt Out
3.6. Review Aggregators
3.6.1. We transfer Provided Data for the purpose of requesting reviews related to the operation of the Service.
4. Purchasers of the Laflau business/assets
4.1. We transfer and disclose Provided and Usage Data in relation to any merger, acquisition, sale of the Laflau assets, financing, or purchase of all or a portion of the Laflau business/assets by another company, or in the course of negotiation regarding any of the above.
5. Affiliated companies
5.1. We transfer and disclose the Provided Data, Usage Data, and Third-Party Data to affiliated companies to the extent required for achieving the objectives outlined in the Policy.
6. Other suppliers and partners
6.1. We may transfer and disclose Provided Data, Usage Data, and Third-Party Data to other suppliers and partners with which we enter into agreements for the purposes set out in the Privacy Policy.
Appendix 06
to the Personal Data Processing Policy
STORAGE PERIOD OF PERSONAL DATA
Release date: 04.11.2024