PRIVACY POLICY

 

FLOWPAY B.V., a company with its registered office at Fred. Roeskestraat 115, 1076EE Amsterdam, Netherlands, RSIN: 864458381, as part of the FLOWPAY Group, and all companies within the FLOWPAY Group, including:

​

• FLOWPAY s.r.o. (100% subsidiary of FLOWPAY B.V.), with its registered office at Rooseveltova 613/38, Bubeneč, 160 00 Prague 6, ID No.: 09770747, registered at the Municipal Court in Prague under file no. C 342283; and                                                                                   

• FLOWPAY Financial s.r.o. (100% subsidiary of FLOWPAY s.r.o.), with its registered office at Rooseveltova 613/38, Bubeneč, 160 00 Prague 6, ID No.: 09969241, registered at the Municipal Court in Prague under file no. C 345308, (hereinafter referred to as "we" or "Our Company"), are committed to protecting customers' personal data in compliance with the legal regulations of the Czech Republic, the Slovak Republic, and the European Union, including the GDPR and other applicable laws.

​

This document provides information on what personal data is processed within the FLOWPAY Group, particularly in relation to Czech and Slovak customers and users of our services. It describes whether the data is processed on the basis of consent or another legal reason, for what purposes it is used, to whom it may be disclosed, and what rights data subjects have in connection with the processing of personal data.

​

These principles are prepared in accordance with legal regulations, including Act No. 110/2019 Coll. on Personal Data Processing, Act No. 18/2018 Z.z. on Personal Data Protection (Slovak Republic) (hereinafter referred to as the "Act"), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter referred to as the "GDPR").

​

   I) Introductory provisions and definitions of basic terms

​

1. Our Company is a liable person under Act No. 253/2008 Coll. on Certain Measures against the Legalization of Proceeds from Crime and Terrorist Financing, as amended, and Act No. 297/2008 Z.z. on Protection against Legalization of Income from Criminal Activity and Terrorism Financing (AML Act of the Slovak Republic) (hereinafter jointly referred to as the “AML”), and under these laws, is obliged to implement measures in accordance with the AML Acts of both the Czech Republic and the Slovak Republic, as well as other regulations. These measures include, inter alia, the identification and verification of the client. For this purpose, our Company is obliged to collect and store the client's personal data and to make copies of the documents from which this data was verified.                                                                                                                                                                                                      

2. As you provide us with your personal data, we have the status of an administrator of your personal data.                                                           

3. The terms "administrator", "processor", "personal data", "processing" used in this text are to be interpreted in the context of the GDPR:                                                                                                                                                                                                                                       

Administrator within meaning of Article 4 (7) of the GDPR is a natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.                                            

Processor within the meaning of Article 4 (8) of the GDPR is a natural or legal person, public authority, agency or other body which processes personal data for the administrator.                                                                                                                                                                   

Personal data means all information about an identified or identifiable natural person, (i.e. about the data subject).                                            

Processing of personal data within the meaning of Article 4 (2) of the GDPR means any operation or set of operations involving personal data or sets of personal data which is carried out with or without automated procedures such as the collection, recording, organization, structuring, storage, adaptation or modification, retrieval, inspection, use, disclosure by transmission, dissemination or any other disclosure, alignment or combination, restriction, deletion or destruction.                                                                                                                                                                                 

   II) For what purpose do we process your personal data?                                                                                                                                             

1. We process your personal data only for the purposes for which you have been informed by Our Company. What personal data we process and for what purposes depends on how you provide us with personal data. You have the opportunity to provide us with personal data in the following ways:

 

If you communicate with us through various channels                                                                                                                             

If you communicate with us through various channels, in particular by making an inquiry via email and social networks. In this case, we process your personal data to the scope, for the purpose and from the authorization (legal title) listed here:                                                                                                                           

Purpose: Processing and registration of your requests, proving that we have accepted and processed your request, e.g. when you create with us this way.                                                                                                                                                                                                                                                                                                                                                                                  

Scope of processed information: Name, surname, e-mail address, telephone number, records of your requests and communication.                                                                                                                                                                                                                                                                                                                                                                                  

Legal title: Legitimate interest in being able to stay in touch with you.

Duration of processing: For a period of 10 years from the termination of the contract, or for a maximum of 3 years from the last communication with you if the contract is not concluded, or as required by applicable AML laws.

You have the right to object to the processing on the basis of our legitimate interest (see Article IV, paragraph 9).

 

When providing loan financing through our "FLOWPAY" system                                                                                                                                                                                                                                                      

We process your personal data, which you provided us when arranging a loan in our "FLOWPAY" system and some other data about you listed in the table below, to the extent necessary for the purpose of:                                                                                                                           

Purpose: Providing loan financing for your business through our FLOWPAY system, including the fulfillment of obligations under the AML Act.                                                                                                                                                                                                                                                                                                                                                                                  

Scope of processed information: Name, surname, birth number, date of birth, place and country of birth, gender, permanent residence, citizenship, email address, telephone number, bank account of a business natural person, ID number and registered office of a business natural person, photocopy of identity card.

Legal title: Necessity for the fulfillment of the contract and identification of the client according to the AML Act and the legitimate interest of Our Company in the verification of identity for the purpose of remote conclusion of the business loan contract and identification of the client of the business natural person or natural person representing the client.                                                                                                                            

Duration of processing: For a period of 10 years from the termination of the contract.

If you choose to use our loan financing, this information is necessary in order for us to be able to conclude a business loan contract and to be able to comply with the obligations set out in the AML Act.

 

When approaching with offers of our products and services incl. tailor-made offers                                                                                                                            

We want to maintain further contact with you. In this case, we process your personal data to the extent, for the purpose and from the authorization (legal title) listed here:                                                                                                                                                                                                                                                       

Purpose: Addressing with our offers of products and services, incl. tailor-made offers.

Scope of processed information: Name, surname, telephone number, e-mail address, records of your requirements and past communication, order history of our products and services.

​

Legal title: Legitimate interest in the possibility of staying in touch with you and sending you special offers designed for you.

​

Duration of processing: For the duration of the legitimate interest, but for a maximum of 3 years from the last registration.

​

As for addressing with our offers of products and services, incl. tailor-made offers, we will be happy to be in touch with you. Therefore, in order not to send you offers that do not interest you, we may use information from our records of your requirements and communication.

​

At the same time, we do not want to bother you with this, so you have the option to exclude the sending of commercial communications by following the procedure below and at the same time within each e-mail we send you (see Article IV, paragraph 9).

​

You have the right to object to the processing of your personal data for the purpose of sending business messages, on the basis of which we will immediately stop sending business messages and processing your personal data in this connection.

​

When approaching with offers of products and services of our business partners, incl. tailor-made offers

​

We would like to address you with business messages, the content of which will be newsletters and offers of products and services of our business partners, incl. offers tailor-made for you. In this case, we process your personal data to the extent, for the purpose and from the authorization (legal title) listed here:

​

Purpose: Addressing with offers of products and services, incl. tailor-made offers, our business partners of Our Company.

​

Scope of processed information: Name, surname, telephone number, e-mail address, records of your requirements and past communication, order history of our products and services.

​

Legal title: Consent to the processing of personal data and the sending of commercial communications.

 

Duration of processing: Until the withdrawal of consent to the processing of personal data and the sending of business offers.​ 

 

The provision of this personal data by you is completely voluntary, but this data is necessary for us to be able to send you our business message with the offer of products or other services of our business partners, incl. offers tailor-made for you.

 

Therefore, in order not to send you offers that do not interest you, we may use information from our records of your requirements and communication.

​

You have the right to always withdraw your consent to the processing of personal data, in accordance with the procedure set out in Article IV below. paragraph 2.

​

   III) To whom do we pass personal data?

​

1. We are entitled to pass on your personal data to other entities (processors) with whom we will conclude a contract on the processing of personal data. We do not know in advance to whom we will provide personal data. Therefore, here are the categories of potential recipients with a justification why your personal data could be transferred:

​

• Recipient: FLOWPAY Financial s.r.o., ID No.: 09969241, with its registered office at Rooseveltova 613/38, Bubeneč, 160 00 Prague 6, a company registered at the Municipal Court in Prague under file no. No. C 345308, and to other cooperating entities. Reason for the provision: cooperating company within the "FLOWPAY" system.

​

• Recipient: Persons who provide Our Companies with the necessary services in connection with your loan financing. Reason for the provision: We may need administrative assistance with the preparation of contracts in order to provide you with loan financing for your business, or to assess the risks and evaluate your creditworthiness when providing a loan.

​

• Recipient: The person responsible for our accounting and tax obligations. Reason for the provision: We need an accounting and tax service provider in the position of processor to keep our accounts and meet our tax obligations.

​

• Recipient: A person providing the operation of the applications and our software (computer systems), including persons providing cloud services. Reason for the provision: We need a software provider who is in the position of a developer to ensure the operation of information systems.

​

• Recipient: The person who sends the e-mails. Reason for the provision: We may entrust the sending of e-mails with the offer of products and services to a third party, which we will provide your e-mail address for this purpose.

 

   2. We would like to inform you that we always comply with your right to obtain information about to whom, when and for what purpose your personal data was provided.

 

   3. Personal data is not transferred to countries outside the European Union. 

​

   IV) What are your rights?

​

1. With regard to the fact that Our Company processes personal data about you, you have the rights about which we would like to inform you in this section. You can exercise all your rights with us in any way that suits you and that allows you to verify that you really ask us (allows you to verify your identity), and we will try our best to meet your needs. However, in order to be able to satisfy you as best we can, we would like to ask you to exercise your rights in writing at the e-mail address info@flowpay.io.                                 

2. Right to withdraw consent - we process some of your personal data on the basis of your consent. It is your right to revoke your consent to the processing of personal data, including your consent to the sending of commercial communications. You can revoke the consent by requesting the address info@flowpay.io. Regarding the processing of your personal data for the purpose of sending business messages, you can revoke your consent to the processing of personal data and consent to the sending of business messages simply by clicking on the appropriate link at the end of each business message, or modifying your user settings within your user profile.                                                                                                                                                                                                                                       

3. Right of access - you have the right to access personal data that Our Company processes about you, and at the same time the right to information about what personal data we process about you, for how long, what are the purposes of their processing, to whom we make it available and whether we use them for automated decision-making (or how this automated decision-making works). We will provide you with a copy of your personal data free of charge. Only in the event that there are several copies, we will allow you to demand the necessary payment for their provision.                                                                                                                                                                                                                         

4. Right of correction - if you find that we are processing incomplete or incorrect personal data about you, you have the right to correct personal data, or to supplement it if the purpose of processing this personal data so requires.                                                                                                                                                                                                                         

5. The right to deletion - you also have the right to delete your personal data which Our Company stores and processes about your person. In order to request deletion one of the following reasons must be given:                                                                                                                                                                                                                         

• your personal data is no longer needed for the purpose for which it was collected or processed;

​

• your personal data is processed illegally by Our Company;

​

• you have revoked the consent on the basis of which the processing of your personal data was carried out, and we have no other right (legal title) to further process this personal data;

​

• raise an objection to the processing of your personal data if this personal data is processed for direct marketing purposes (e.g. sending commercial messages);

​

• you object to the processing of your personal data, which we process on the basis of our legitimate interest, and if we are unable to prove that our legitimate interest outweighs your right to deletion;

​

• there is a legitimate reason to delete such personal data;

​

• Our Company processes the child's personal data without parental consent to such processing.

​

We would like to warn you that there may be a situation where your personal data cannot be deleted on the basis of your revocation of consent to the processing of personal data or on your request for the deletion of personal data. Such a case is especially a situation where the processing of your personal data is required by law. In the event that this situation occurs, Our Company will inform you of the reason on the basis of which your personal data cannot be deleted despite your explicit request for deletion of personal data.

​

   6. The right to portability - another right that you can exercise is right to portability. Based on this right, you can request the                         provision of your personal data, which was provided to us on the basis of your consent and which we process automatically. Upon           request, we will provide you with your personal data that meets these conditions in a commonly used, structured and machine-                 readable format, or based on your request, we will pass it on to another administrator according to your destination, if it is                         technically feasible.

​

   7. Right to restrict processing - in cases where you feel that your personal data processed by Our Company is incorrect, you have               the right to request that we limit the processing of your personal data to the time necessary to verify the accuracy of your personal           data and their possible correction. You also have this right in the following cases:

​

• the processing of your personal data by Our Company is illegal, but you do not want your personal data to be deleted;

​

• Our Company no longer needs your personal data for the purpose for which we processed it, but you insist on their processing (especially storage) by Our Company to determine, enforce or defend your legal claims;

​

• you have raised an objection to the processing of your personal data on the basis of a legitimate interest of Our Company, in which case the restriction of processing will be valid for the time necessary to determine whether our legitimate interest exceeds your right not to have your personal data continue to be processed.

​

   8. The right to object to the processing of your personal data on the basis of a legitimate interest - with regard to the fact that           we process some of your personal data on the basis of a legitimate interest, you have the right to object to this processing, on the             basis of which we assess whether of interest to process your personal data for the purpose or whether your right to have your                 personal data no longer processed prevails

​

   9. The right to object to the processing of your personal data for the purpose of direct marketing - you have the right to object           to the processing of your personal data for the purpose of direct marketing (e.g. for the purpose of sending business messages). In           such a case, we will immediately stop processing your personal data for this purpose.

​

  10. Right to complain - in the event that all the above rights are insufficient from your point of view, or you are of the opinion that in             any way Our Company violates your rights, you have the opportunity to file a complaint with the supervisory authority. You can                 make a complaint by contacting the Office for Personal Data Protection, which is available at:

​

https://www.uoou.cz/podatelna-uradu/os-1006

​

or customers in the Slovak Republic, complaints can also be submitted to the Office for Personal Data Protection of the Slovak Republic: https://dataprotection.gov.sk/uoou.

 

These privacy policy is made in Czech. If we provide you with a translation of the Czech language version, this translation is only informative, and in case of discrepancies between the language versions, the Czech version always takes precedence.

​