Introductory Provisions
BA Ventio™, BUSINESS AFFAIRS s.r.o., Company ID No.: 29314836, registered office at Kaprova 42/14, 110 00 Prague 1, Czech Republic, contact email: info@baventio.com (hereinafter referred to as the “Company”), provides its services in accordance with applicable legislation and processes customers’ personal data in compliance with applicable legal regulations. The Company acts as the data controller.

This document provides customers with information about the processing of their personal data and their related rights and obligations. This document may be revised and updated as necessary. We declare that all internal processes relating to the processing of personal data comply with Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendments to Certain Acts, as amended, and, from 25 May 2018, also with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation), commonly known as the GDPR.

When processing personal data, we adhere to the principles of lawful processing and focus on lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
The Company processes personal data both manually and by automated means. The Company maintains records of all activities involving the processing of personal data, whether manual or automated.

As of the publication date of this policy, no binding criteria have been established for accrediting entities authorised to issue certificates of good practice in personal data protection, or for issuing such certificates in a manner that would allow our procedures to be certified as compliant with the above-mentioned legislation. We therefore declare that all internal processes carried out within our Company comply with the aforementioned regulations.
The legislation does not require, and at the time of publication of this policy does not permit, the obtaining of such certification. If accreditation mechanisms become available in the future and are not mandatory, we reserve the right not to obtain certificates, seals, or marks issued by an accredited entity.

What Data Do We Process and Why?
We undertake not to request more personal data from you than is strictly necessary to achieve each of the purposes specified below. If you decide to use the services offered by BUSINESS AFFAIRS s.r.o., you must enter into a contract with the Company to order those services. When creating a customer account, we require you to provide the following personal data: your name, date of birth, residential address, email address, telephone number, username, and password.
We must process this personal data to identify and authenticate you and to operate your customer account, without which our services cannot be used. We continue to process the personal data necessary to operate your customer account even after the provision of services has ended. This enables you to order additional services without having to create a new customer account and is in the legitimate interest of our Company.

For the purposes of ordering and providing services and identifying you, we also process the following personal data: your name, date of birth, residential address, email address, and telephone number (hereinafter collectively referred to as “basic identification data”), as well as any additional personal data we obtain from you in connection with the service provided, for example through email or telephone communications, where processing such data is necessary to provide the relevant service. We must process this personal data to provide the services you have ordered. Without such processing, we would be unable to provide those services.

The processing of personal data is necessary for entering into and/or performing a contract and therefore does not require your consent. The legal basis for this processing is the necessity of performing the contract. You are not obliged to provide us with this personal data. However, if you do not provide it or do not agree to its processing for the purposes stated above, we will have to refuse to enter into a contract with you. In connection with the services provided, we also process personal data relating to those services, particularly information about the type, scope, and price of the services and your payment history.
Video surveillance recordings are also stored in the areas of our premises designated for customer contact. These recordings constitute personal data and are processed for the purpose of preventing damage. We obtain all the data mentioned in this section in connection with the provision of our services. Together with your basic identification data, we process it to improve our services and/or protect the interests of our Company, including enforcing our legitimate claims and protecting our rights in judicial or other proceedings.

As this processing is necessary for the purposes of our Company’s legitimate interests, your consent is not required. The legal basis for this processing is the necessity of pursuing the legitimate interests of our Company. We also process our customers’ personal data to comply with legal obligations. In particular, under accounting legislation and other legal regulations, especially those relating to taxation, we retain documents in electronic or paper form containing personal data, including invoices and documents establishing the legal basis for issuing invoices. These documents may contain customers’ names and addresses and are retained for the period prescribed by law.

We are also required to retain operational data, location data, and records (so-called logs) generated or processed when operating public communications networks and providing publicly available electronic communications services, together with the associated IP addresses. This obligation arises under Section 97(3) of Act No. 127/2005 Coll., on Electronic Communications and on Amendments to Certain Related Acts (the Electronic Communications Act).
Once the legally prescribed retention period has expired, we will no longer process these personal data for this purpose. The legal basis for this processing is compliance with legal obligations. Because we are required to obtain this data from you in connection with the services provided, or obtain it from other sources, to fulfil our legal obligations, refusing to provide the data or objecting to its processing would prevent us from entering into a contract with you and providing our services.
We also use our customers’ personal data for marketing and promoting our products. We never provide personal data to third parties for their own marketing purposes without the explicit consent of our customers.

We process your email address to send electronic commercial communications relating to our Company’s products without your consent, where permitted by applicable law, as this is in our Company’s legitimate interest. A condition for sending such commercial communications is that customers are given a clear and prominent opportunity to withdraw their consent to the use of their email address easily and free of charge, or at our expense, with every individual message, unless they have previously refused such use of their email address. If you inform us that you do not agree to receive these commercial communications, we will stop processing your personal data for this purpose. The legal basis for this processing is the necessity of pursuing the legitimate interests of our Company.

When you visit our Company’s website, you also provide information about your IP address, location, browser, operating system, and screen resolution. This personal data is collected through Google web analytics tools and is used solely for our internal purposes, namely to analyse and improve our services. As this data is collected and processed for the purposes of our legitimate interests, your consent is not required. The legal basis for this processing is the necessity of pursuing the legitimate interests of our Company. Further information about Google’s personal data protection practices can be found in its relevant privacy policies. If you consent to the storage of cookies on your device when visiting our website, we process records of your behaviour through cookies placed on our website to improve the operation of the website. The legal basis for this processing is your consent.

How Long Do We Process Personal Data?
We process your personal data only for as long as the purpose for which it is processed remains valid.
Personal data necessary to maintain a customer account will be processed for as long as services are being provided. If a customer does not cancel their account after the services have ended, we will continue to process the personal data necessary to maintain that account for a period of three years. Operational and location records that we are legally required to process are retained for six months pursuant to Section 97(3) of Act No. 127/2005 Coll., on Electronic Communications and on Amendments to Certain Related Acts (the Electronic Communications Act). After the ordered service has ended and all related contractual obligations have expired, including any warranty obligations, we will stop processing your personal data for that purpose and delete it, unless the data, or some of it, is being processed for another purpose. Where personal data is processed to comply with a legal obligation, we will stop processing it for that purpose once the prescribed retention period has expired.

Is Personal Data Disclosed to Third Parties?
If we provide ordered services, or parts of them, through other parties (for example, an IT consultant, a delivery service, or a certification authority), or if providing the ordered service necessarily requires transferring personal data to another party (for example, an entity responsible for registering domain names in a central registry), we will provide those third parties with your personal data only to the extent strictly necessary to provide the ordered service. We are authorised to process personal data in this way without your consent because otherwise we would be unable to fulfil the contract and provide the requested service. However, we must always ensure that these third parties comply with all personal data protection obligations and do not use your personal data for any other purpose without your consent. If the identity of a third party receiving personal data is not specified in this policy, we will inform you when you order the relevant service.

Personal data is transferred to third parties in connection with the following services and to the following extent:
Provision of commercial certificates (SSLmarket.cz): Personal data is transferred to the certification authority DigiCert (DigiCert, Inc., 2801 North Thanksgiving Way, Suite 500, Lehi, Utah 84043, USA) for verification purposes. The data transferred includes the individual’s first and last name, address, email address, and telephone number. Domain name registration (CZECHIA.COM): For domain name registration, personal data is transferred to other data controllers, namely registrars, or directly to the central registries of individual domain names. The data transferred includes the individual’s first and last name, address, email address, telephone number, and any additional personal data required by the registry for the relevant domain name. Web hosting services and website creation (wix.com): If the service also includes domain name registration, the provisions concerning domain name registration above apply. In the case of a service demo or hosting service demo provided through the wix.com portal, the customer’s email address is provided to Ecomail for the purpose of sending emails created by us.

Who Has Access to Personal Data?
Within our Company, access to your personal data is restricted to individuals who need it to achieve the purpose for which the data is processed. We conduct regular audits for this purpose. Customer support employees have access only to the personal data they need to authenticate requests and identify customers. This access is necessary for the proper operation of customer support services. Employees who have access to personal data receive appropriate training in data protection and are required to maintain confidentiality.

What Other Rights Do You Have Regarding the Protection of Your Personal Data?
In connection with the protection of your personal data, you have the right to:

• Obtain confirmation from us as to whether or not personal data concerning you is being processed.

• Obtain information about the purposes of processing, the categories of personal data concerned, the recipients to whom personal data has been or will be disclosed, the planned retention period or the criteria used to determine it, the existence of the right to request the rectification or erasure of personal data or the restriction of its processing, or to object to such processing, the right to lodge a complaint with a supervisory authority, all available information about the source of personal data if it was not obtained directly from you, the existence of automated decision-making, including profiling, and appropriate safeguards where data is transferred outside the EU.

• Obtain copies of the personal data we process about you, provided that doing so does not adversely affect the rights and freedoms of others.

• Request the rectification of inaccurate personal data that we process about you.

• Request the erasure of personal data concerning you if we are unable to demonstrate legitimate grounds for continuing to process it.

• Request the restriction of processing of your personal data until an issue has been resolved if you dispute the accuracy of the data, the grounds for its processing, or object to its processing.

• Receive notification from our Company if your personal data is rectified, erased, or its processing is restricted. If personal data is rectified or erased, we will notify each recipient unless this proves impossible or requires disproportionate effort. Upon request, we may provide you with information about these recipients.

• Exercise your right to data portability. This means you may obtain your personal data from us in a structured, commonly used, and machine-readable format and request that we transfer it to another data controller. This right applies only where processing is automated, the data was obtained on the basis of your consent or for the performance of a contract, and the transfer is technically feasible.

• Object to the processing of your personal data on grounds relating to our Company’s legitimate interests or object to the dissemination of commercial communications.

• Refuse the processing of your personal data for the purpose of receiving commercial communications.

• Withdraw your consent to the processing of your personal data at any time if our Company processes it on the basis of your consent. Such withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before it was withdrawn.

• ​

If you have any concerns about whether the processing of your personal data complies with applicable legislation, you may lodge a complaint with the supervisory authority in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), available at www.uoou.cz.

This policy is effective as of 1 January 2018.