Doocument B/V

V. Information for Business Partners

Management of Business Relationships and Communication with Business Partners – Suppliers

Purpose of personal data processing:

Identification and contact of potential suppliers of goods or services.
Recording of contact data of existing suppliers and their employees in the controller's system.
Contacting suppliers in connection with the fulfillment of contractual or pre-contractual relationships.

Data subjects or category of data subjects:

Contact persons or employees of a potential supplier.
Contact persons or employees of an existing supplier.
Statutory bodies or other persons authorized to act on behalf of the supplier.

Category of personal data: Ordinary personal data.

List or scope of personal data: Name of the organization, title, first and last name, e-mail address (work), telephone number (work).

Legal basis for personal data processing: Lawfulness of personal data processing: Art. 6 (1) (f) of Regulation (EU) 2016/679 (GDPR) – legitimate interest.

Statutory obligation of personal data processing: Statutory obligation to process personal data is not performed according to a specific regulation.

Legitimate interest (Art. 6 (1) (f) of Regulation (EU) 2016/679 (GDPR)):

Ensuring efficient communication with business partners – the controller needs to process personal data for the purposes of proper communication with suppliers and processing business matters.
Maintaining and managing business relationships – data processing is necessary for long-term cooperation and management of business relationships.
Maintaining the agenda and fulfilling contractual obligations – for example, in orders, invoicing, and receiving services or goods.
Processing is necessary for the purposes of the legitimate interest of the controller, while this interest is not overridden by the interests or fundamental rights and freedoms of the data subjects, which are properly protected in accordance with the GDPR.

Recipients or category of recipients to whom personal data will be provided: Personal data processed for the purposes of managing business relationships and communication with business partners – suppliers are not provided to any external recipients.

Other authorized entity based on Art. 6 (1) (c) of Regulation (EU) 2016/679 (GDPR): Personal data may also be provided to public authorities that have legal authorization for their processing, e.g., control and supervisory authorities, courts, or law enforcement agencies.

Transfer to third countries: Personal data are not provided to third countries.

Transfer to international organizations: Personal data are not provided to international organizations.

Disclosure of personal data: The Controller does not disclose personal data.

Retention period / criterion for its determination:

Until the fulfillment of the purpose of processing.
For the duration of the contractual relationship and a further 5 years from its termination.
For the duration of the contractual relationship and a further 5 years from its termination.

Instruction on the form of the requirement for the provision of personal data from data subjects: The provision of personal data is required based on the legitimate interest of the controller. If the data subject does not provide the required data, it may lead to the impossibility of establishing or maintaining a business relationship, concluding a contract, or properly fulfilling contractual obligations.

Source of personal data: Personal data are obtained directly from the data subject or from business partners who provided data about their employees or contact persons. If necessary, data may also be obtained from publicly available sources.

Information on the existence of automated individual decision-making including profiling: The Controller declares that based on the provided personal data, no automated individual decision-making or profiling according to Art. 22 of the GDPR occurs.

Economic Agenda and Processing of Accounting and Tax Documents (Supplier – Contractual Business Partner)

Purpose of personal data processing: The purpose of personal data processing is the maintenance of the economic, accounting, and tax agenda of the Controller in relation to suppliers of goods and services in accordance with applicable legal regulations. The processing of personal data includes in particular:

recording of business contracts concluded with suppliers,
receipt, processing, and archiving of invoices and other tax documents,
processing of bank statements and related accounting documents,
maintenance of accounting and tax records according to specific legal regulations.

Data subjects or category of data subjects:

suppliers – business entities,
statutory representatives of suppliers,
authorized persons or employees of suppliers acting on their behalf in the fulfillment of contractual, accounting, and tax obligations.

Category of personal data: Ordinary personal data.

List of personal data:

Recording of business contracts: name of the organization (supplier), title, first name, last name, e-mail address, telephone contact, signature.
Invoicing (receipt and processing of invoices): business name or name of the taxable person, address of the registered office, place of business or establishment, ID No. (IČO), Tax ID / VAT ID (DIČ/IČ DPH), title, first name, last name, telephone contact, e-mail address, bank account number, signature.
Tax documents and bank statements: same scope as in invoicing, including data stated on tax documents, receipts, bank statements, or other documents related to the accounting agenda.
Tax and accounting records: all the above-mentioned data to the extent stated in the accounting and tax documents maintained according to the Act on Accounting.

Legal basis for personal data processing: Lawfulness of personal data processing: The processing of personal data is performed based on:

Art. 6 (1) (b) of the GDPR Regulation – performance of a contract to which the data subject is a party,
Art. 6 (1) (c) of the GDPR Regulation – fulfillment of a statutory obligation of the Controller.

Statutory obligation of personal data processing:

Act No. 431/2002 Coll. on Accounting as amended.
Act No. 222/2004 Coll. on Value Added Tax as amended.
Act No. 513/1991 Coll. Commercial Code as amended.
Act No. 595/2003 Coll. on Income Tax.

Recipients or category of recipients to whom personal data will be provided: Personal data processed within the economic, accounting, and tax agenda are provided to the following recipients:

Anna Žákovičová, ID No. (IČO): 30 347 424 – external provider of accounting and economic services, who processes personal data in the position of a processor according to Art. 28 of the GDPR Regulation, based on a personal data processing agreement concluded with the Controller.
The scope of processing primarily includes the processing of accounting documents, invoices, bank statements, tax documents, and maintenance of accounting and tax records in accordance with specific legal regulations.
Personal data are provided exclusively to the extent necessary to fulfill the purpose of processing and in accordance with applicable legal regulations on personal data protection.

Other authorized entity based on Art. 6 (1) (c) of Regulation (EU) 2016/679 (GDPR): Personal data may also be made available to public authorities that are authorized to process them based on specific legal regulations, in particular: Financial Administration of the Slovak Republic (e.g., Tax Office), Customs Office, Slovak Trade Inspection (SOI), Law Enforcement Agencies, Courts.

Transfer to third countries / international organizations: Personal data are not provided.

Disclosure of personal data: The Controller does not disclose personal data.

Legitimate interest of the controller (Art. 6 (1) (f) of Regulation (EU) 2016/679 (GDPR)): The Controller does not perform the processing of personal data based on legitimate interests.

Retention period of personal data / criterion for its determination: Data are retained for at least 10 years after the year to which they relate, in accordance with the laws on accounting and taxes. Subsequently, they are disposed of according to Act No. 395/2002 Coll. on Archives and Registries.

Instruction on the form of the requirement for the provision of personal data from data subjects: The provision of personal data is a contractual and at the same time a statutory requirement. The data subject is obliged to provide personal data. In the case of failure to provide these data, it is not possible to conclude a contractual relationship, nor subsequent performance from the contract. Also, it is not possible to ensure the proper fulfillment of the Controller's obligations arising from the relevant general legal regulations.

Source of personal data: Personal data are obtained directly from the data subject or from a person acting on behalf of the supplier (e.g., when concluding a contract, processing accounting documents, or within business communication).