Personal Data Processing Agreement entered into on the www.postarflowis.sk domain

Preamble

1. The Customer is a legal entity or a natural person entrepreneur who has registered on the www.postarflowis.sk domain.

2. The scope of services designated as “single account” means the provision of services exclusively to the Customer.

3. The scope of services designated as “multi account” means the provision of services to the Customer and, through the Customer, also to the Customer’s clients.

4. In the case of the “single account” scope of services, only the agreement on the processing of personal data by a processor applies to the Customer.

5. In the case of the “multi account” scope of services, both the Agreement on the processing of personal data by a processor and the Agreement on the processing of personal data by another processor apply to the Customer.

Agreement on the Processing of Personal Data by a Processor

I. Introductory Provisions

1. This agreement, entered into remotely between Flowis, s. r. o. and a legal entity or a natural person entrepreneur, regulates the rights and obligations of the contracting parties in relation to the processing of personal data by a processor on behalf of the controller and is entered into pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the “GDPR”).

2. The Processor is Flowis, s. r. o., with its registered office at Bottova 2A, 811 09 Bratislava, Company ID No.: 50 015 168, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, File No. 107163/B, email address: info@flowis.com, telephone number: +421 907 298 107.

3. The Controller is a legal entity or a natural person entrepreneur who has registered on the www.postarflowis.sk domain.

4. The Processor is a certified provider of a delivery service under Section 76a of Act No. 222/2004 Coll. on value added tax and is registered in the list of certified providers of delivery services for electronic invoicing operating in the territory of the Slovak Republic maintained by the Financial Administration of the Slovak Republic.

5. The Processor, as service provider, and the Controller, as customer, have entered into an agreement on the provision of an electronic invoice delivery service. As part of the provision of the services, the Processor will process, on behalf of the Controller, the personal data of the Controller’s suppliers and customers that will be stated in electronic invoicing.

II. Subject Matter of the Agreement

1. The subject matter of this agreement is the authorisation of the Processor by the Controller to process, on behalf of the Controller, the personal data of the Controller’s suppliers and customers that will be stated in electronic invoices sent by the Controller and delivered to the Controller on the www.postarflowis.sk domain.

2. The subject matter of the processing consists of the personal data of the Controller’s customers and suppliers stated on invoices sent by the Controller and delivered to the Controller.

3. The Processor will process personal data for the necessary period and only during the term of the agreement on the provision of an electronic invoice delivery service.

4. The Processor will process personal data for the purposes of performing the agreement on the provision of an electronic invoice delivery service and in securing the sending and delivery of electronic invoices.

5. The Processor will process the following personal data:

   • first name and surname of the Controller’s customers and suppliers
   • residential address and place of business of the Controller’s customers and suppliers
   • other personal data of customers and suppliers stated on the Controller’s and suppliers’ invoices

6. The data subjects are the Controller’s customers and suppliers.

7. The placement or upload of an invoice by the Controller in the Controller’s account environment on the www.postarflowis.sk domain is deemed to constitute the Controller’s instruction to process the personal data stated in the invoice. The delivery of an invoice to the Controller into the Controller’s account environment on the www.postarflowis.sk domain is deemed to constitute the Controller’s instruction to process the personal data stated in the invoice.

8. The Processor undertakes to:

   • process personal data only on the basis of documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless such processing is required by Union law or the law of a Member State to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
   • ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
   • implement all required measures pursuant to Article 32 GDPR;
   • comply with the conditions for engaging another processor set out in paragraphs 2 and 4 of Article 28 GDPR;
   • taking into account the nature of the processing, assist the Controller, insofar as possible, by appropriate technical and organisational measures in fulfilling the Controller’s obligation to respond to requests for the exercise of the data subject’s rights laid down in Chapter III GDPR;
   • assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Processor;
   • at the choice of the Controller, after the end of the provision of services relating to processing, delete or return all personal data to the Controller and delete existing copies, unless Union law or the law of a Member State requires storage of such personal data;
   • make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

III. Rights and Obligations of the Contracting Parties

1. After termination of the agreement, the Processor shall delete the processed personal data in accordance with the procedure set out in the agreement on the provision of an electronic invoice delivery service.

2. The service provider shall not be liable for the content and data stored by the customer through the customer’s account. The Controller declares that it processes and provides to the Processor the personal data of third parties that it provides to the Processor for processing in accordance with the GDPR and applicable legal regulations and that it has the relevant legal basis for their processing.

IV. Term of the Agreement

1. The contracting parties have agreed that the agreement is entered into for a fixed term, namely until the termination of the agreement on the provision of an electronic invoice delivery service.

2. The contracting parties are entitled to withdraw from this agreement pursuant to the provisions of the Commercial Code. Upon withdrawal from the agreement, the agreement terminates when, in accordance with that Act, the expression of will of the entitled party to withdraw from the agreement is delivered to the other party. After that time, the effects of withdrawal from the agreement may not be revoked or changed without the consent of the other party.

V. Final Provisions

1. Before registering an account on the www.postarflowis.sk domain, the Controller is requested to confirm that it has read this agreement and agrees to it in full.

2. This agreement and the relationships arising from it shall be governed by the substantive law of the Slovak Republic. The contracting parties have agreed that the courts of the Slovak Republic shall have jurisdiction to resolve disputes arising from this agreement.

3. The rights and obligations not regulated by this agreement shall be governed by the relevant provisions of the Commercial Code, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and other generally binding legal regulations. In accordance with Section 5(7) of Act No. 22/2004 on electronic commerce, the contracting parties have agreed that the provisions of Section 5(3) to (6) of Act No. 22/2004 on electronic commerce shall not apply to them.

Agreement on the Processing of Personal Data by Another Processor

I. Introductory Provisions

1. This agreement, entered into remotely between Flowis, s. r. o. and a legal entity or a natural person entrepreneur, regulates the rights and obligations of the contracting parties in relation to the processing of personal data by another processor and is entered into pursuant to Article 28(4) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the “GDPR”).

2. The Other Processor is Flowis, s. r. o., with its registered office at Bottova 2A, 811 09 Bratislava, Company ID No.: 50 015 168, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, File No. 107163/B, email address: info@flowis.com, telephone number: +421 907 298 107.

3. The Original Processor is a legal entity or a natural person entrepreneur who has registered on the www.postarflowis.sk domain.

4. The Other Processor is a certified provider of a delivery service under Section 76a of Act No. 222/2004 Coll. on value added tax and is registered in the list of certified providers of delivery services for electronic invoicing operating in the territory of the Slovak Republic maintained by the Financial Administration of the Slovak Republic.

5. The Other Processor, as service provider, and the Original Processor, as customer, have entered into an agreement on the provision of an electronic invoice delivery service. As part of the provision of the services, the Other Processor will process the personal data of the suppliers and customers of the Original Processor’s clients, as controllers, that will be stated in electronic invoicing.

6. The Original Processor confirms that the clients of the Original Processor, as controllers, have given express consent to the engagement of the Other Processor.

II. Subject Matter of the Agreement

1. The subject matter of this agreement is the authorisation of the Other Processor by the Original Processor to process, on behalf of the Original Processor’s clients as controllers, the personal data of the suppliers and customers of the Original Processor’s clients that will be stated in electronic invoices sent and delivered on the www.postarflowis.sk domain.

2. The subject matter of the processing consists of the personal data of the customers and suppliers of the Original Processor’s clients stated on invoices sent and delivered through the Other Processor’s application on the www.postarflowis.sk domain.

3. The Other Processor will process personal data for the necessary period and only during the term of the agreement on the provision of an electronic invoice delivery service.

4. The Other Processor will process personal data for the purposes of performing the agreement on the provision of an electronic invoice delivery service and in securing the sending and delivery of electronic invoices.

5. The Other Processor will process the following personal data:

   • first name and surname of the customers and suppliers of the Original Processor’s clients
   • residential address and place of business of the customers and suppliers of the Original Processor’s clients
   • other personal data of the customers and suppliers of the Original Processor’s clients

6. The data subjects are the customers and suppliers of the Original Processor’s clients as controllers.

7. The placement or upload of an invoice by the Original Processor in the application environment on the www.postarflowis.sk domain is deemed to constitute an instruction to process the personal data stated in the invoice. The delivery of an invoice into the application environment on the www.postarflowis.sk domain is deemed to constitute an instruction to process the personal data stated in the invoice.

8. The Other Processor undertakes to:

   • process personal data only on the basis of documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless such processing is required by Union law or the law of a Member State to which the Other Processor is subject; in such a case, the Other Processor shall inform the Original Processor of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
   • ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
   • implement all required measures pursuant to Article 32 GDPR;
   • comply with the conditions for engaging another processor set out in paragraphs 2 and 4 of Article 28 GDPR;
   • taking into account the nature of the processing, assist the Original Processor, insofar as possible, by appropriate technical and organisational measures in fulfilling its obligation to respond to requests for the exercise of the data subject’s rights laid down in Chapter III GDPR;
   • assist the Original Processor in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Other Processor;
   • at the choice of the Original Processor, after the end of the provision of services relating to processing, delete or return all personal data to the Original Processor and delete existing copies, unless Union law or the law of a Member State requires storage of such personal data;
   • make available to the Original Processor all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the Original Processor or another auditor mandated by the Controller.

III. Rights and Obligations of the Contracting Parties

1. After termination of the agreement, the Other Processor shall delete the processed personal data in accordance with the procedure set out in the agreement on the provision of an electronic invoice delivery service.

2. The Other Processor shall not be liable for the content and data stored in the application by controllers or by the Original Processor. The Original Processor declares and confirms that the clients of the original controller meet the conditions for processing the personal data of third parties that will be processed for the purposes of providing the services.

IV. Term of the Agreement

1. The contracting parties have agreed that the agreement is entered into for a fixed term, namely until the termination of the agreement on the provision of an electronic invoice delivery service.

2. The contracting parties are entitled to withdraw from this agreement pursuant to the provisions of the Commercial Code. Upon withdrawal from the agreement, the agreement terminates when, in accordance with that Act, the expression of will of the entitled party to withdraw from the agreement is delivered to the other party. After that time, the effects of withdrawal from the agreement may not be revoked or changed without the consent of the other party.

V. Final Provisions

1. Before registering an account on the www.postarflowis.sk domain, the Other Processor is requested to confirm that it has read this agreement and agrees to it in full.

2. This agreement and the relationships arising from it shall be governed by the substantive law of the Slovak Republic. The contracting parties have agreed that the courts of the Slovak Republic shall have jurisdiction to resolve disputes arising from this agreement.

3. The rights and obligations not regulated by this agreement shall be governed by the relevant provisions of the Commercial Code, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and other generally binding legal regulations. In accordance with Section 5(7) of Act No. 22/2004 on electronic commerce, the contracting parties have agreed that the provisions of Section 5(3) to (6) of Act No. 22/2004 on electronic commerce shall not apply to them.

Version 2026-10-05