GDPR

1. Identity and contact details of the personal data controller

The controller of your personal data is:

2. Where we process your personal data and transfers outside the EU

Our website, its database and its file storage run on Microsoft Azure in data centres in the European Union. Images on the website are delivered through Microsoft's content delivery network (Azure Front Door), which answers each request from a server close to the visitor; for visitors outside the European Union, that server can be outside the European Union.

Some of our service providers are companies based in the United States or their European subsidiaries. Depending on the service, they may process your personal data in the United States or access it from there:

• Microsoft (Microsoft Ireland Operations Limited, Ireland, part of Microsoft Corporation, USA) hosts our website and delivers e-mails from our forms to us, as our processor. Microsoft processes the data in the European Union but may transfer limited data to the United States, for example to keep its services secure and working.
• Google reCAPTCHA (Google Cloud EMEA Limited, Ireland, part of Google LLC, USA) checks our forms for automated abuse, as our processor under the Google Cloud Data Processing Addendum.
• Google Analytics (Google Ireland Limited, Ireland, part of Google LLC, USA) measures how our website is used so that we can improve it, as our processor and only with your consent.
• Google Maps (Google Ireland Limited, Ireland, part of Google LLC, USA) provides the map on our Contact page, only with your consent. Google decides itself how it uses the data it receives from the map and is responsible for that use as an independent controller, including any transfer to the United States.

Transfers to the United States are based on the adequacy decision of the European Commission for the EU–U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023). Microsoft Corporation and Google LLC are certified under this framework; you can check their certification at dataprivacyframework.gov. For the services that Microsoft and Google provide as our processors, our contracts with them also include the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), which continue to protect your data if the framework stops applying. You can ask us for a copy of these safeguards at info@pinflowes.com; the standard contractual clauses are also published by the European Commission.

We do not transfer personal data to international organisations. Which of these services process your data is described in the part of this policy that applies to you.

1. Purpose of processing

We process your personal data for the following purposes:

• the proper conduct of the recruitment process and entry into a contract with the selected applicant;
• protection of our legitimate interests, in particular in the event of claims being asserted against our company in connection with allegations of discrimination or unequal treatment during the recruitment process;
• inclusion and maintenance of the applicant in the database of job applicants.

2. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

• performance of a contract to which the data subject is party, or taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
• the legitimate interest of the controller within the meaning of Article 6(1)(f) GDPR;
• the consent of the data subject within the meaning of Article 6(1)(a) GDPR.

3. Categories of personal data processed

For the above purposes, we process the following categories of personal data:

• address and identification data (name and surname, address, date of birth, contact details);
• descriptive data (education, knowledge of foreign languages, professional knowledge and skills);
• special categories of personal data (medical fitness).

4. Recipients of personal data

Your personal data may be provided to the following recipients:

• external providers of document shredding services;
• public authorities for the purpose of fulfilling legal obligations;
• occupational health service providers;
• providers of information systems and IT services acting as our processors, in particular Microsoft, through whose e-mail service applications sent via our online form are delivered to us;
• Google, which operates the reCAPTCHA check of our online application form as our processor (see Part E);
• other entities for the purpose of establishing, exercising, or defending legal claims.

5. Information on any transfer of personal data to a third country or international organization

We process your personal data in the European Union. If you apply through our online form, the reCAPTCHA check (Google) and the delivery of your application to us by e-mail (Microsoft) involve service providers that may transfer personal data to the United States. The safeguards for these transfers are described in Part A, section 2.

6. Period for which personal data will be stored

Below we provide information on the period for which your personal data will be retained, or the criteria on the basis of which such period is determined.

To ensure transparency and clarity, we have divided the retention period for your personal data according to the individual purposes of processing.

1. Proper conduct of the recruitment process and conclusion of a contract with the selected applicant: for the duration of the recruitment process, and in justified cases also after its completion, where a longer retention period is required by applicable legal regulations.
2. Protection of our legitimate interests: for the period necessary to protect the rights and legal claims of our company as controller, in particular with regard to possible claims relating to allegations of discrimination or unequal treatment during the recruitment process, but no longer than until the expiry of the relevant statutory limitation periods, unless the specific circumstances justify a longer processing period.
3. Inclusion and maintenance of the applicant in the database of job applicants: for the duration of the granted consent, but no longer than 6 months.

7. Whether the provision of personal data is a legal or contractual requirement

We process your personal data for the purpose of assessing your interest in entering into an employment contract with our company, i.e. for the purpose of taking steps prior to entering into an employment contract at the request of the data subject.

The processing of personal data of job applicants is necessary in order for us to assess the suitability of the applicant for the given position and, where applicable, to conclude an employment contract with them. Without the provision of such data, it is not possible to include the applicant in the recruitment process and therefore to assess their suitability for the performance of the work.

If you do not provide us with the necessary personal data, we will not be able to properly carry out the recruitment process and potentially conclude an employment contract with you.

8. Automated decision-making, profiling

When processing your personal data, we do not carry out any decision-making based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

Our online application form is protected by Google reCAPTCHA (see Part E, section 8). This check does not evaluate your application. If you cannot submit the form, please send your application and CV to info@pinflowes.com; it will be considered in the same way.

1. Purpose of processing

1.1. Customers (natural persons)

• entering into and performing a contract;
• compliance with legal obligations applicable in connection with the relevant contract, in particular accounting and tax obligations;
• protection of our legitimate interests, including sending commercial communications to you as an existing customer in the form of direct marketing, debt recovery, protection of legal claims, and retention of data for the purpose of defense in potential disputes.

1.2. Natural persons acting as representatives of customers

• our interest in concluding a valid contract, i.e. verifying whether you, as the person representing the other contracting party, are authorized to conclude the relevant contract, and our protection in the event of asserting our legitimate claims or defending ourselves against claims asserted by third parties.

2. Legal basis for processing

2.1. Customers (natural persons)

• performance of a contract to which the data subject is party, or taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
• compliance with a legal obligation pursuant to Article 6(1)(c) GDPR;
• our legitimate interest pursuant to Article 6(1)(f) GDPR.

2.2. Natural persons acting as representatives of customers

• our legitimate interest pursuant to Article 6(1)(f) GDPR.

3. Categories of personal data processed

3.1. Customers (natural persons)

• identification and contact details;
• payment and invoicing details;
• any other data related to contractual performance.

3.2. Natural persons acting as representatives of customers

• identification data and contact details;
• descriptive data (function or job position).

4. Recipients of personal data

Your personal data may be provided to the following recipients:

• external providers of document shredding services;
• external providers of audit, legal, and tax advisory services;
• external providers of information systems;
• Google, which operates the reCAPTCHA check of our registration, login and inquiry forms as our processor (see Part E);
• other entities for the purpose of establishing, exercising, or defending legal claims.

5. Information on any transfer of personal data to a third country or international organization

We process your personal data in the European Union. When you use our online forms or your user account, the reCAPTCHA check (Google) and our hosting provider (Microsoft) involve service providers that may transfer personal data to the United States. The safeguards for these transfers are described in Part A, section 2.

6. Period for which personal data will be stored

Below we provide information on the period for which your personal data will be retained, or the criteria on the basis of which such period is determined.

To ensure transparency and clarity, we have divided the retention period for your personal data according to the individual purposes of processing.

1. Conclusion and performance of a contract with the customer: for the duration of the concluded contract and the period during which claims arising from such contract are enforceable, unless applicable legal regulations stipulate a longer period.
2. Compliance with legal obligations which we are required to observe in connection with the conclusion of the relevant contract with the customer: for the period stipulated by applicable legal regulations.
3. Protection of our legal interests: for the period strictly necessary in the event that we are required to assert our claims in judicial or administrative proceedings, or defend ourselves against asserted claims, but always no longer than until the expiry of the relevant statutory limitation periods and one year thereafter.
4. Direct marketing, i.e. sending commercial communications to customers who are natural persons: until you inform us that you object to the further sending of commercial communications.

7. Whether the provision of personal data is a legal or contractual requirement

The provision of your personal data is partly a contractual requirement and partly a legal requirement.

Without the provision of such data, we would not be able to enter into a contractual relationship with you and fulfill our obligations arising from the relevant contract concluded with you, in particular acceptance and processing of an order, issuance of an invoice, and ensuring delivery of goods or services. Likewise, we would not be able to comply with our obligations imposed by applicable legal regulations, especially in the field of accounting and taxation.

8. Automated decision-making, profiling

When processing your personal data, we do not carry out any decision-making based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

Our registration, login, password recovery and inquiry forms are protected by Google reCAPTCHA (see Part E, section 8).

1. Purpose of processing

1.1. Business partners (natural persons)

• entering into and performing a contract;
• compliance with legal obligations applicable in connection with the relevant contract, in particular accounting and tax obligations;
• protection of our legitimate interests, including sending commercial communications to you as an existing business partner in the form of direct marketing, debt recovery, protection of legal claims, and retention of data for the purpose of defense in potential disputes.

1.2. Natural persons acting as representatives of business partners

• our interest in concluding a valid contract, i.e. verifying whether you, as the person representing the other contracting party, are authorized to conclude the relevant contract, and our protection in the event of asserting our legitimate claims or defending ourselves against claims asserted by third parties.

2. Legal basis for processing

2.1. Business partners (natural persons)

• performance of a contract to which the data subject is party, or taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
• compliance with a legal obligation pursuant to Article 6(1)(c) GDPR;
• the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR.

2.2. Natural persons acting as representatives of business partners

• the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR.

3. Categories of personal data processed

3.1. Business partners (natural persons)

• identification and contact details;
• payment and invoicing details;
• any other data related to contractual performance.

3.2. Natural persons acting as representatives of business partners

• identification data and contact details;
• descriptive data (function or job position).

4. Recipients of personal data

Your personal data may be provided to the following recipients:

• external providers of document shredding services;
• external providers of audit, legal, and tax advisory services;
• external providers of information systems;
• other entities for the purpose of establishing, exercising, or defending legal claims.

5. Information on any transfer of personal data to a third country or international organization

We process your personal data in the European Union. Some of our service providers, in particular providers of our information systems, are companies based in the United States or their European subsidiaries. Depending on the service, they may process your personal data in the United States or access it from there. The safeguards for these transfers are described in Part A, section 2.

6. Period for which personal data will be stored

Below we provide information on the period for which your personal data will be retained, or the criteria on the basis of which such period is determined.

To ensure transparency and clarity, we have divided the retention period for your personal data according to the individual purposes of processing.

1. Conclusion and performance of a contract with the business partner: for the duration of the concluded contract and the period during which claims arising from such contract are enforceable, unless applicable legal regulations stipulate a longer period.
2. Compliance with legal obligations which we are required to observe in connection with the conclusion of the relevant contract with the business partner: for the period stipulated by applicable legal regulations.
3. Protection of our legal interests: for the period strictly necessary in the event that we are required to assert our claims in judicial or administrative proceedings, or defend ourselves against asserted claims, but always no longer than until the expiry of the relevant statutory limitation periods and one year thereafter.
4. Direct marketing, i.e. sending commercial communications to business partners who are natural persons: until you inform us that you object to the further sending of commercial communications.

7. Whether the provision of personal data is a legal or contractual requirement

The provision of your personal data is partly a contractual requirement and partly a legal requirement.

Without the provision of such data, we would not be able to enter into a contractual relationship with you and fulfill our obligations arising from the relevant contract concluded with you, nor would we be able to comply with our obligations imposed by applicable legal regulations, in particular in the field of accounting and taxation.

8. Automated decision-making, profiling

When processing your personal data, we do not carry out any decision-making based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

1. Purpose of processing

We process your personal data for the following purposes:

• use of the contact form through which you may contact us if you are interested in our products or have other inquiries;
• protection of the website's forms and user accounts against spam, automated abuse and attacks, using Google reCAPTCHA;
• measuring how the website is used, using Google Analytics, only with your consent;
• showing our location on a map on the Contact page, using Google Maps, only with your consent;
• use of cookies. Detailed information on the processing of personal data in connection with the use of cookies can be found in the Cookie settings .

2. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

• performance of a contract to which the data subject is party, or taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
• the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR, in particular our interest in protecting our forms and systems against spam and abuse;
• your consent pursuant to Article 6(1)(a) GDPR for analytics cookies and for showing the Google map. You can withdraw your consent at any time in the Cookie settings .

3. Categories of personal data processed

For the purpose of using the contact form to contact us, we process the following categories of personal data:

• identification and contact details;
• descriptive data provided by you.

When you use a form protected by Google reCAPTCHA, and, with your consent, for Google Analytics, technical data about your device and your visit is processed: in particular your IP address, information about your browser and device, and information about how you interact with the page. Google Analytics also uses a randomly generated identifier stored in a cookie.

4. Recipients of personal data

We share your personal data only with the recipients listed below, and only to the extent they need it for the purposes described in this part. Our processors handle your data solely on our instructions, under a data processing agreement as required by Article 28 GDPR, and are obliged to keep it confidential and secure. We do not sell your personal data.

The recipients are:

• Microsoft, which hosts this website in data centres in the European Union and delivers messages from our forms to us by e-mail, as our processor;
• Google, which checks our forms for automated abuse (Google reCAPTCHA), as our processor;
• Google, which provides Google Analytics as our processor, only if you consent to analytics cookies;
• Google, which provides the map on our Contact page (Google Maps) as an independent controller, only if you agree to show the map (see section 9).

The companies behind these services and where they process data are listed in Part A, section 2.

5. Information on any transfer of personal data to a third country or international organization

We process your personal data in the European Union. Microsoft (hosting and e-mails from our forms) and Google (reCAPTCHA, and with your consent Google Analytics and Google Maps) are part of groups based in the United States and may transfer personal data there. These transfers rely on the EU–U.S. Data Privacy Framework and on the European Commission's standard contractual clauses, as described in Part A, section 2.

6. Period for which personal data will be stored

For the purpose of using the contact form to contact us, we process your personal data for the period necessary to handle your request, unless the nature of the specific case or applicable legal regulations imply a legitimate need to retain it for a longer period.

We do not keep the data processed by Google reCAPTCHA in our own systems; we only receive the result of the check. Google Analytics cookies expire after no more than 2 years, and we keep Google Analytics data for no longer than 14 months.

7. Whether the provision of personal data is a legal or contractual requirement

The provision of your personal data is a contractual requirement. Without such data, we would not be able to process your request to enter into a contractual relationship or handle a matter related to such relationship.

8. Automated decision-making, profiling

When processing your personal data, we do not carry out any decision-making based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

To protect our forms against spam and automated abuse, Google reCAPTCHA automatically assesses whether a submission is made by a person or by an automated program. If the check cannot confirm this, the form is not sent. The check concerns only the technical circumstances of the submission; it does not assess you, your inquiry or your job application. You can always contact us at info@pinflowes.com instead, and your message or application will be handled by a person in the same way.

9. Integrated third-party services

If we integrate third-party services on our website, for example for video playback or other functions, we process your personal data on the basis of Article 6(1)(b) and (f) GDPR. Such processing is necessary for the implementation of the functions you request or to ensure the optimal functioning of the website. For more information, we recommend that you review the privacy statements of the respective providers.

On our Contact page, we can show a map provided by Google Maps so that you can find our office. The map is loaded only with your consent, which you give either in the cookie settings (category "Maps") or by clicking "Yes, show me the map" on the Contact page. Only then does your browser connect to Google, which receives, among other things, your IP address and may store its own cookies. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in the Cookie settings ; the map is then hidden again. Google processes this data as an independent controller under its own Privacy Policy.

On our website, we display icons linking to our profiles on social networks, such as Facebook, Instagram, LinkedIn, and others. These icons serve exclusively as links; no data about website visitors is automatically transmitted to third parties in connection with them.

Only after clicking on a specific icon may the relevant platform, for example Meta or LinkedIn, obtain information about your visit and possibly associate it with your user account if you are logged in to that social network. In such a case, data processing takes place on the side of the operator of the relevant platform, which acts as an independent controller of personal data. We recommend that you review the personal data processing terms of the individual providers.

If integrated third-party services use cookies, the Cookie settings shall apply.

1. Rights of data subjects

In connection with the processing of your personal data, you are entitled to the following rights:

1.1. Right of access to personal data (Article 15 GDPR)

You have the right to request confirmation from us as to whether your personal data is being processed. If so, you have the right to obtain access to such data and information about:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed;
• the planned period for which the personal data will be stored, or the criteria used to determine that period;
• the existence of the right to request rectification, erasure, restriction of processing, or to object to the processing of personal data;
• the right to lodge a complaint with a supervisory authority;
• the sources of the personal data, if not obtained directly from you;
• whether automated decision-making, including profiling, takes place.

1.2. Right to rectification (Article 16 GDPR)

You have the right to request that we rectify without undue delay inaccurate personal data concerning you and, taking into account the purposes of the processing, complete incomplete personal data.

1.3. Right to erasure, the “right to be forgotten” (Article 17 GDPR)

You have the right to have personal data concerning you erased if:

• it is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw the consent on the basis of which the personal data was processed and there is no other legal ground for the processing;
• you object to the processing of personal data and there are no overriding legitimate grounds for the processing;
• the personal data has been processed unlawfully;
• the personal data must be erased in order to comply with a legal obligation under EU law or Czech law.

Exceptions to the obligation to erase personal data include cases where the processing of your personal data is necessary for compliance with our legal obligations, for reasons of public interest in the area of public health, or for the establishment, exercise, or defense of our legal claims.

1.4. Right to restriction of processing (Article 18 GDPR)

You have the right to request restriction of the processing of your personal data if:

• you contest the accuracy of the data, for a period enabling us to verify the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead;
• we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
• you have objected to the processing of your personal data, pending verification whether our legitimate grounds override your legitimate grounds.

Where the processing of your personal data has been restricted for the above reasons, such personal data may, with the exception of storage, be processed only with your consent, or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the EU or of a Member State.

1.5. Right to data portability (Article 20 GDPR)

Where the processing of your personal data is based on your consent or on a contract concluded with you and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.

When exercising your right to data portability, you also have the right to have your personal data transmitted by us to another controller, where technically feasible.

The exercise of the above right must not adversely affect the rights and freedoms of others.

1.6. Right to withdraw consent (Article 7(3) GDPR)

Where the processing of your personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

1.7. Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection, at www.uoou.cz, if you believe that the processing of your personal data is contrary to the GDPR.

2. Right to object

If your personal data is processed on the basis of our legitimate interest, you have the right to object to such processing at any time pursuant to Article 21 GDPR.

In such a case, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests or rights and freedoms, or for the establishment, exercise, or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.