Protection of Personal Data

Data Controller

SYSMA CZ s.r.o., Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic
Company ID 06110347; VAT ID CZ06110347; registered with the Municipal Court in Prague, Section C, File 276295.

Contact: [email protected].

Personal Data We Process

Depending on our business relationship and services, we process names, titles, company and position, email, telephone and contact address, business and contractual records, and necessary technical and operational data. These are mainly professional business contact details.

Purposes and Legal Bases

Quotations, contracts, IT services, support and communication: contract or pre-contract steps, Article 6(1)(b) GDPR; contact details of customer and partner representatives: legitimate interest in service delivery and business relations, Article 6(1)(f). Accounting, tax and other statutory duties: Article 6(1)(c). Legal claims, IT security, misuse prevention and incidents: legitimate interest, Article 6(1)(f).

Where electronic details were obtained in connection with our services, we may send information about similar services under Section 7(3) of Act No. 480/2004 Coll. Each message offers a simple, free opt-out. Other marketing is sent only on an appropriate legal basis, particularly consent.

Sources, Recipients and Processing

We obtain data from you, your company, customers, suppliers, partners, public registers and professional sources. Authorised staff and, as needed, IT, hosting/cloud, accounting, administrative, legal, technology and support providers may process them. Processors act under our instructions and an agreement; authorities receive data where law requires.

For certain customer IT, implementation, monitoring or support services, SYSMA CZ acts as processor, follows customer instructions and is governed where applicable by an Article 28 GDPR agreement.

Technology or cloud services may entail transfers outside the EU/EEA; where this occurs, GDPR-required transfer mechanisms and safeguards apply.

Retention

We retain data only as long as necessary for the purpose, business relationship, statutory duties and establishment, exercise or defence of legal claims. We then delete or anonymise it unless law requires longer retention.

Security and Automated Processing

Technical and organisational measures protect confidentiality, integrity and availability, prevent unauthorised access, loss or misuse, and support risk and incident management, continuity and recovery. Our information security management system is certified to ISO/IEC 27001:2022.

We may use automated tools, including AI, with appropriate safeguards and human oversight. We do not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR.

Your Rights

You may request access, rectification, erasure, restriction or portability; object to processing based on legitimate interest, including direct marketing; withdraw consent where applicable; and lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7 (uoou.gov.cz).

Contact us by email or at our registered address to exercise your rights. We may reasonably verify your identity.