2.1 The Provider is in relation to the Personal Data of Client Clients by the Client in accordance with Article 28 GDPR. The user is the administrator of this data.

2.2 These Terms and Conditions govern the mutual rights and obligations in the processing of personal data to which the Provider has gained access in connection with the fulfillment of the license agreement concluded in the form of agreement of the General Terms and Conditions on www.sofit.cz (the „License Agreement“) concluded with the User on the date of establishment of the user account.

2.3. The Provider undertakes for the User to process personal data to the extent and for the purposes set out in Articles 2.4 – 2.7 of these Terms and Conditions. Processing resources will be automated. The Provider will collect, store, store, block, and disassemble personal data in the processing. The Provider is not authorized to process personal data in violation or beyond the limits set by these terms.

2.4 The Provider undertakes for the user to process personal data in the following extent:

1. common personal data,
2. special categories of data under Article 9 of the GDPR,

which the User obtained in connection with his own business.

2.5. The Provider undertakes for the user to process personal data in order to process inquiries and client requests obtained from the contact form.

2.6. Personal data may only be processed at the workplace of the Provider or his subcontractors under Article 2.8 of these Conditions, within the territory of the European Union.

2.7. The Provider undertakes for the User to process the personal data of the User’s clients, all for the time necessary to exercise the rights and obligations arising from the contractual relationship between the Provider and the User and to claim the said contractual relations (for 15 years from the termination of the contractual relationship).

2.8 The user grants permission to engage a subcontractor as a further processor under Article 28 (2) of the GDPR, which is the hosting application provider. In addition, the User grants the Provider a general authorization to engage in the processing of another personal data processor, but the Provider must inform the user in writing of any intended changes to the acceptance or replacement of the other processors and give the user the opportunity to object to these changes. The Provider must impose on its subcontractors as personal data processors the same personal data protection obligations as set out in these terms.

2.9. The Provider undertakes that the processing of personal data will be ensured in particular as follows:

1. Personal data is processed in accordance with legal regulations and on the basis of the User’s instructions, ie for the performance of all activities necessary for the provision of web platforms.
2. The Provider undertakes to provide technically and organizationally the protection of the processed personal data so that unauthorized or accidental access to the data, its modification, destruction or loss, unauthorized transmissions, any other unauthorized processing as well as other misuse and to ensure that all personal data processor obligations resulting from the law are safeguarded continuously throughout the personal and organizational continuity of the processing of data.
3. The technical and organizational measures adopted shall correspond to the level of risk. Provider ensures the continued confidentiality, integrity, accessibility, and resilience of processing systems and services, and timely restores the availability of and access to personal data in the event of physical or technical incidents.
4. The Provider hereby declares that the personal data protection is subject to the Provider’s internal security regulations.
5. Personal data shall be accessible only to authorized Provider and subcontractors pursuant to Article 2.8 of these Conditions, which shall stipulate to the Provider the conditions and extent of data processing and any such person will access personal data under his / her unique identifier.
6. Empowered persons Providers who process personal data under these conditions are required to maintain confidentiality about personal data and security measures whose disclosure would compromise their security. Provider shall ensure their demonstrable commitment to this obligation. The Provider will ensure that this obligation for both the Provider and the Beneficiary will continue after the termination of a legal or other relationship with the Provider.
7. Provider will assist the user, through appropriate technical and organizational measures, if possible, to meet the user’s obligation to respond to the data subject’s requests for data subject to the GDPR; as well as ensuring compliance with the obligations under GDPR Articles 32 to 36, taking into account the nature of the processing and the information available to the Provider.
8. Upon termination of the provision of the performance associated with the processing under Article 2.7 of these Conditions, the Provider is obliged to delete all personal data or to return it to the User if he is not obliged to store personal data under a special law.
9. The Provider will provide the User with all the information necessary to demonstrate that the obligations under this Agreement and the GDPR have been met, will allow audits, including inspections, conducted by the User or another auditor assigned by the User.

2.10 The User undertakes to promptly report any facts known to him that could adversely affect the proper and timely fulfillment of the obligations arising from these Conditions and to provide the Provider with the necessary cooperation to meet these conditions.