Privacy Policy

1. Basic information

This document contains comprehensive information on the processing and protection of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter also referred to as the “GDPR”) in conjunction with Act No. 110/2019 Coll., which personal data are processed by Able.cz s.r.o., Company ID No.: 242 78 815, with its registered office at Vlněna 526/5, Trnitá, 602 00 Brno, in the course of its activities.

2. Personal data controller

Able.cz s.r.o. Company ID No.: 242 78 815 registered office: Vlněna 526/5, Trnitá, 602 00 Brno a company registered in the Commercial Register maintained by the Regional Court in Brno, File No.: C 85424 contact e-mail address: hello@able.cz company website: www.able.cz (hereinafter also referred to as “Able”)

3. Scope of personal data processed

In the course of its activities, which consist primarily of providing consulting and services in the field of IT related to the systematic management and development of clients’/customers’ brands in the online environment (brand management), and to the design, development and administration of software and web applications, Able processes personal data that it obtains from its clients/customers, if they are natural persons, or from contact persons of clients/customers in connection with Able’s activities, or personal data from persons who are clients/customers of Able’s clients/customers.

In specific cases, Able processes, in particular, the following personal data:

identification and contact details of clients/customers and their contact persons, if they are natural persons, and, where applicable, also personal data from persons who are clients/customers of Able’s clients/customers;
data on the services ordered by the client or, as the case may be, on the services and software and web applications provided by Able;
data from mutual communication (whether conducted in person, in writing, by telephone or otherwise) between Able and the contact persons of customers/clients;
payment data (e.g., information on the amount paid or owed, account number, etc.).

4. Purpose of and legitimate interest in the processing of personal data

Able processes the personal data of clients/customers, their contact persons and, where applicable, also personal data from persons who are clients/customers of Able’s clients/customers for the purposes and on the basis of the legal grounds and legitimate interest of Able set out below in paragraphs 4.1 to 4.4 of this document.

4.1. Conclusion and performance of a service agreement

Where a service agreement is concluded between Able and a client/customer, Able processes, in accordance with Article 6(1)(b) of the GDPR, the personal data that are necessary for the proper performance of that agreement. For this reason, Able processes, in particular:

identification and contact details of clients/customers and their contact persons, if they are natural persons, and, where applicable, also personal data from persons who are clients/customers of Able’s clients/customers;
data on the services ordered by the client or, as the case may be, on the services and software and web applications provided by Able;
data from mutual communication (whether conducted in person, in writing, by telephone or otherwise) between Able and the contact persons of customers/clients;
payment data (e.g., information on the amount paid or owed, account number, etc.).

Able processes personal data for this reason for the duration of the contractual relationship between Able and the client. After this period, the personal data may be retained further on the basis of legitimate interest; for details, see Article 4.2 of this document.

4.2. Legitimate interest

The processing of personal data on the grounds of legitimate interest pursuant to Article 13(1)(d) of the GDPR in conjunction with Article 6(1)(f) of the GDPR is carried out by Able in the following cases:

a) processing is carried out for the purpose of protecting Able’s property, including demonstrating Able’s rights and legal claims. For these reasons, Able retains personal data contained in contractual documentation as well as in mutual communication. We retain personal data for this reason for a period of 10 years.

b) processing is carried out for the purpose of possible communication with Able’s clients in the event of an unforeseeable event. For this reason, personal data are retained for a period of 4 years after the termination of the contractual relationship or, in the remaining cases, from the moment of the last mutual communication.

4.3. Compliance with legal obligations

Personal data are processed in accordance with Article 6(1)(c) of the GDPR for the purpose of complying with obligations arising from generally binding legal regulations, in particular in connection with archiving, accounting and the fulfillment of tax obligations. For this reason, Able processes, in particular:

identification and contact details of clients/customers and their contact persons, if they are natural persons, and, where applicable, also personal data from persons who are clients/customers of Able’s clients/customers;
data on the services ordered by the client or, as the case may be, on the services and software and web applications provided by Able;
payment data (e.g., information on the amount paid or owed, account number, etc.).

For this reason, personal data are retained for the period laid down directly in the relevant generally binding legal regulations. These include, in particular but not exclusively, Act No. 563/1991 Coll., as amended (Section 31), Act No. 235/2004 Coll., as amended (Section 35), Act No. 280/2009 Coll., as amended (Section 148), and Act No. 586/1992 Coll.

If a client grants Able consent to the processing of personal data pursuant to Article 6(1)(a) of the GDPR, such processing is carried out only for the purpose for which the consent was granted. The client may withdraw consent to processing at any time; in such a case, this does not affect the lawfulness of the processing of personal data on another legal basis. The client may withdraw the consent granted in writing to the address stated in Article 2 of this document or via the e-mail address: hello@able.cz.

Where consent to the processing of personal data has been granted, Able retains such data for a period of 7 years (unless otherwise stated in the consent granted), or until the consent granted is withdrawn.

5. Transfer of personal data to third parties

In certain cases, Able transfers personal data to third parties. These are, in particular, cases of securing the supply or subcontracting of IT services, where Able transfers personal data to the selected supplier/subcontractor so that full and comprehensive performance of the agreed services can be ensured in accordance with the respective service agreement concluded with the client/customer.

Furthermore, personal data administered by Able may be transferred to entities that provide Able with accounting or legal services.

When processing personal data, Able uses tools for the automated processing of personal data focused on customer relationship management (CRM), which are provided to Able by third parties.

Able also transfers personal data to tax authorities and public administration bodies where such an obligation is imposed by law, and only to the extent and for the period strictly necessary.

Able does not intend to transfer personal data to a third country or an international organization.

6.1. Right of access to personal data

In accordance with Article 15 of the GDPR, the data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and, if so, has the right of access to such data, to the information described in detail in Article 15 of the GDPR, to a copy of the personal data being processed, and to information on the manner in which they are processed.

6.2. Right to rectification of personal data

In accordance with Article 16 of the GDPR, the data subject has the right to have Able rectify, without undue delay, inaccurate personal data concerning that data subject. At the same time, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3. Right to erasure of personal data (the right “to be forgotten”)

In accordance with Article 17 of the GDPR, the data subject has the right “to be forgotten,” i.e., the right to have Able erase, without undue delay, the personal data concerning that person which Able processes, on the grounds set out in Article 17 of the GDPR.

6.4. Right to restriction of processing

The data subject has the right to have Able restrict the processing of their personal data in the cases set out in Article 18 of the GDPR.

6.5. Right to data portability

The data subject has the right to obtain their personal data from Able and to transmit them to another controller under the conditions set out in Article 20 of the GDPR.

6.6. Right to object

In accordance with Article 21 of the GDPR, the data subject has the right to object where personal data are processed by Able on the grounds of legitimate interest. If such an objection is relevant and justified, Able will no longer process such personal data.

6.7. Right to information on automated decision-making, including profiling

Within the meaning of Article 22 of the GDPR, data subjects are not subject to any decision by Able based solely on automated processing, including profiling, which would produce legal effects concerning the data subjects or similarly significantly affect them.

6.8. Right to lodge a complaint with a supervisory authority

If the data subject considers the processing of personal data by Able to be unlawful, they are entitled to lodge a complaint with the Office for Personal Data Protection.

6.9. Right to security of processing and to notification of personal data breaches to the data subject

For the purpose of securing the processing of the data provider’s personal data, Able has adopted appropriate technical and organizational measures to ensure a level of security appropriate to the risk under the conditions set out in Article 32 of the GDPR, and maintains records of the processing activities for which it is responsible in accordance with Article 30 of the GDPR. At the same time, should a personal data breach occur, the controller will notify the data subject of such breach without undue delay in accordance with Article 34 of the GDPR.

7. Additional information

In the event of any uncertainty regarding the processing of personal data by Able, or in order to exercise the rights set out in Article 6 of this document, Able may be contacted in writing at the address stated in Article 2 of this document or via the e-mail address: hello@able.cz.

This document is effective as of September 1, 2025.