Agreement on the Processing of Personal Data by a Data Processor, entered into on the domain www.postarflowis.sk

This distance contract between Flowis, s. r. o. and a legal entity or an individual entrepreneur governs the rights and obligations of the contracting parties regarding the processing of personal data by a processor on behalf of the controller and is concluded pursuant to Article 28( 3 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the “GDPR”).

The intermediary is Flowis, s. r. o., with its registered office at Bottova 2A, 811 09 Bratislava, Company ID No.: 50 015 168, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, File No. 107163/B, email address: info@flowis.com, phone number: +421 907 298 107.

The operator is a legal entity or an individual entrepreneur who has registered on the www.postarflowis.sk domain.

The intermediary is a certified provider of delivery services pursuant to Section 76a of Act No. 222/2004 Coll. on Value-Added Tax and is registered in the list of certified delivery service providers for electronic invoicing operating in the Slovak Republic, maintained by the Financial Administration of the Slovak Republic.

The intermediary, as the service provider, and the operator, as the customer, have entered into a contract for the provision of electronic invoice delivery services. As part of the provision of these services, the intermediary will process, on behalf of the operator, the personal data of the operator’s suppliers and customers that will be included in the electronic invoices.

The subject matter of this agreement is the operator’s authorization of the processor to process, on behalf of the operator, the personal data of the operator’s suppliers and customers, which will be included in electronic invoices sent by the Controller and delivered to the Controller via the domain www.postarflowis.sk.

The subject of the processing is the personal data of the controller’s customers and suppliers as listed on invoices sent by the controller and received by the controller.

The service provider will process personal data for as long as necessary and only for the duration of the contract for the provision of electronic invoice delivery services.

The intermediary will process personal data for the purpose of fulfilling the contract for the provision of electronic invoice delivery services and to ensure the transmission and delivery of electronic invoices.

The broker will process the following personal data:

• the first and last names of the operator's customers and suppliers
• the place of residence and place of business of the operator's customers and suppliers
• other personal data of customers and suppliers listed on the invoices of the operator and suppliers

The data subjects are the controller's customers and suppliers.

The posting or uploading of an invoice by the operator within the operator’s account environment on the domain www.postarflowis.sk is considered an instruction from the operator to process the personal data specified in the invoice. The delivery of an invoice to the operator within the operator’s account environment at www.postarflowis.sk is considered an instruction from the operator to process the personal data specified in the invoice.

The broker agrees to:

• process personal data only on the basis of documented instructions from the controller, including with regard to the transfer of personal data to a third country or an international organization, except where required by Union law or the law of the Member State to which the processor is subject; in such a case, the processor shall notify the controller of this legal requirement prior to processing, unless such notification is prohibited by the law in question for compelling reasons of public interest;
• ensure that persons authorized to process personal data undertake to maintain the confidentiality of the information, or are bound by an appropriate statutory obligation to maintain the confidentiality of the information;
• take all necessary measures in accordance with Article 32 of the GDPR;
• comply with the conditions for engaging a subsequent processor set forth in paragraphs 2 and 4 of Article 28 of the GDPR;
• taking into account the nature of the processing, to assist the controller to the greatest extent possible, through appropriate technical and organizational measures, in fulfilling its obligation to respond to requests to exercise the rights of the data subject as set forth in Chapter III of the GDPR;
• assist the controller in ensuring compliance with the obligations under Articles 32 through 36 of the GDPR, taking into account the nature of the processing and the information available to the processor;
• upon termination of the provision of processing-related services, at the controller’s discretion, to delete all personal data or return it to the controller and delete any existing copies, unless Union or Member State law requires the retention of such personal data;
• provide the operator with all information necessary to demonstrate compliance with the obligations set forth in this article, and allow for and cooperate with audits and inspections conducted by the operator or another auditor designated by the operator.

Upon termination of the contract, the intermediary will delete the personal data being processed.

The service provider is not responsible for the content and data stored by the customer through the customer's account. The customer represents and warrants that he or she has obtained consent to process the personal data of third parties, which will be processed for the purpose of providing the services.

The contracting parties have agreed that this contract is entered into for a fixed term, specifically until the expiration of the contract for the provision of electronic invoice delivery services.

The contracting parties are entitled to withdraw from this contract in accordance with the provisions of the Commercial Code. Upon withdrawal from the contract, the contract shall terminate when, in accordance with this law, the notice of the entitled party’s intention to withdraw from the contract is delivered to the other party. After this time, the effects of withdrawal from the contract cannot be revoked or modified without the consent of the other party.

Before registering a customer account on the www.postarflowis.sk domain, the customer is asked to confirm that they have read this agreement and agree to it in its entirety.

This Agreement and the relationships arising therefrom shall be governed by the substantive law of the Slovak Republic. The contracting parties agree that the courts of the Slovak Republic shall have jurisdiction to resolve any disputes arising from this Agreement.

Rights and obligations not provided for in this agreement are governed by the relevant provisions of the Copyright Act, the Commercial Code, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and other generally binding legal regulations. In accordance with Section 5(7) of Act No. 22/2004 on Electronic Commerce, the contracting parties have agreed that the provisions of Section 5(3) through (6) of Act No. 22/2004 on Electronic Commerce do not apply to them.