Privacy Policy
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · effective from [DOPLNIT]
In short. We process your data to reply to you, to provide accounting and tax services and to meet our legal obligations, in particular under the anti-money laundering act. We store data in the EU and never sell it. We send marketing e-mails only with your consent or to existing clients, and you can unsubscribe at any time. Contact for anything about your data: [DOPLNIT e-mail].
1 Who is the controller
The controller of your personal data is Inteza Accounting, s.r.o., company ID (IČO) 30213673, registered office U Průhonu 1516/32, 170 00 Praha 7, entered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 459148 ("Inteza" or "we"). Contact: e-mail [DOPLNIT], phone [DOPLNIT], data box [DOPLNIT]. We have not appointed a Data Protection Officer because we are not required to; please use the contact above for any questions.
2 When we are a controller and when a processor
We are the controller of the data of website visitors, prospective clients, clients and their representatives, and business partners. Personal data of third parties contained in accounting and tax records that a client hands over to us (for example the client's customers, suppliers or employees) is processed by us as a processor on the client's instructions under a data processing agreement. For those people, our client is the controller. For anti-money laundering purposes we always act as an independent controller.
3 What data, why, on what basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to enquiries and preparing an offer (form, e-mail, phone) | Name, e-mail, phone, language, requested service, message | Steps prior to a contract at your request; legitimate interest in replying (Art. 6(1)(b) and (f)) | 12 months from the last contact if no contract is concluded |
| Concluding and performing the contract, representation before authorities | Identification and contact data, birth number (if required for a filing), IČO, DIČ, data box ID, power of attorney and its scope, correspondence | Performance of a contract; legal obligation (Art. 6(1)(b) and (c)) | Term of the contract and 10 years after it ends (contract and material correspondence); routine correspondence 3 years |
| Client identification and due diligence under the anti-money laundering act, international sanctions | Identity document data and copy, verification payment data, information on business activity, source of funds, beneficial owner, PEP and sanctions | Legal obligation under Act No. 253/2008 Coll. (Art. 6(1)(c)); additional document copy: public interest (Art. 6(1)(e)) | 10 years after the business relationship ends |
| Invoicing and our own accounting | Name or company name, IČO, DIČ, address, bank account, payments | Legal obligation (Art. 6(1)(c)) | 10 years from the end of the accounting period |
| News and offers by e-mail | Name, e-mail, language, consent record | Consent; for clients legitimate interest (Art. 6(1)(a) and (f)) | Until consent is withdrawn or you unsubscribe; consent record 3 years afterwards |
| Running the website and measuring traffic | IP address, cookies, device and page-view data | Essential cookies: legitimate interest; other cookies: consent | Cookie choice 12 months; analytics up to 14 months |
| Handling your requests and complaints | Contact data, content of the request, our reply | Legal obligation (Art. 6(1)(c)) | 3 years after resolution |
Where we rely on legitimate interest, it is our interest in answering enquiries, documenting our cooperation, defending against possible claims and offering similar services to existing clients. After the periods above we delete or anonymise the data unless another legal ground requires us to keep it.
4 What data you must provide
Providing data in the contact form is voluntary, but without contact details we cannot reply. To conclude a contract, and under Act No. 253/2008 Coll., we must identify you and carry out client due diligence. Identification takes place either in person with an identity document, or remotely using copies of documents and a verification payment of CZK 1 (or EUR 1) from your own account at a bank in the EU or EEA. Without this data we cannot provide the service. Consent to marketing is not a condition of our cooperation.
5 Who receives your data
We share data only to the extent necessary:
- our processors, who provide technical services to us under an agreement pursuant to Art. 28 GDPR: website and forms (Lovable, Supabase), system integration (Make), Raynet CRM, Evala accounting system and client portal (Seyfor), Google Workspace e-mail and storage, iDoklad invoicing, web analytics [DOPLNIT];
- authorities before which we represent you under a power of attorney (plná moc) and to which we file on your behalf from our own data box (tax office, Czech Social Security Administration, health insurer), and authorities to which we must disclose data by law (e.g. the Financial Analytical Office, courts, police);
- cooperating professionals (external accountant, tax adviser) only where necessary for your matter and bound by confidentiality.
We do not sell data or pass it to other companies for their marketing.
6 Transfers outside the EU
We store data in the EU. Some providers (e.g. Supabase or Google) have a parent company in the USA that may have limited access to data, for example when providing technical support. Such transfers are protected by the EU-U.S. Data Privacy Framework or by standard contractual clauses approved by the European Commission. We will provide a copy of these safeguards on request. Data processed under the anti-money laundering act is not transferred outside the EU and EEA.
If you contact us via WhatsApp, Telegram or Viber (for example, using the button on our website), the app operator also processes data about the communication as an independent controller under its own terms, including outside the EU. If you do not want this, please use the form, e-mail, telephone or the client portal.
7 Cookies
The website uses essential cookies without which it cannot work. We use analytics or marketing cookies only if you accept them in the cookie banner. You can change your choice at any time via the "Cookie settings" link in the website footer.
8 Your rights
You have the right to:
- access your data and obtain a copy;
- rectification of inaccurate or incomplete data;
- erasure, where we no longer need the data and are not required by law to keep it;
- restriction of processing;
- data portability for data you provided under a contract or consent;
- object to processing based on legitimate or public interest, and to marketing at any time without giving reasons;
- withdraw consent at any time, e.g. via the link in every e-mail; withdrawal does not affect processing carried out before it;
- lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
Send your request to [DOPLNIT e-mail] or to our data box. We will reply without undue delay and within one month at the latest; in complex cases we may extend this by two months and will tell you why. To avoid disclosing data to someone else, we may ask you to verify your identity. Statutory retention obligations (e.g. under the anti-money laundering act) cannot be cancelled by an erasure request, and some rights may be restricted as provided by law.
9 Automated decision-making
We do not make decisions about you based solely on automated processing and do not carry out profiling with legal effects. A person always decides whether to accept a client.
10 How we protect your data
We use EU-based storage, encrypted transfer, two-factor sign-in, access limited to authorised persons and regular backups. Everyone who works with the data is bound by confidentiality. Please send documents through the client portal or by e-mail, not through messaging apps. If you nevertheless send a document via WhatsApp or Telegram, for example, we will save it in our system no later than the next business day and delete it from the app. We will report any security breach that could put you at risk to the Office for Personal Data Protection and, where the risk is high, to you as well.
11 Changes to this policy
We may update this policy, for example when our services or the law change. The current version with its effective date is always published on the website; we inform clients of material changes by e-mail. This policy is published in Czech, Russian, Ukrainian and English; in case of any discrepancy, the Czech version prevails.
Version 1.3 · effective from [DOPLNIT]