DATA CONTROLLER'S PRIVACY POLICY

3. Purpose of Personal Data Processing

 

As a data controller, we process personal data exclusively on a lawful legal basis and in accordance with defined purposes arising from our business activities—providing digital solutions, software development, IT consulting, and related services.
 

Response to inquiries, questions, or requests

When you contact us via email, contact forms on our website, by phone, or in person, we process your data (such as name, email, phone number, message content) to respond to your request.

Legal basis: Legitimate interest of the controller under Art. 6(1)(f) GDPR.
You have the right to object to such processing.

​

Expression of interest in our services or collaboration

We process data to prepare proposals, technical specifications, and communicate before entering into a contract.

Legal basis: Art. 6(1)(b) GDPR – taking steps prior to entering into a contract.

​

Fulfillment of contracts with clients, suppliers, and partners

When providing our services (e.g., designing and implementing software solutions, consulting services, system administration, support), we process personal data of contact persons of contracting parties, as well as data contained in orders, contracts, invoices, and project documentation.

Legal basis: Art. 6(1)(b) GDPR – contract performance.

​

Compliance with legal obligations

We process data to fulfill obligations arising from laws (e.g., accounting, taxes, employment records, archiving obligations).

Legal basis: Art. 6(1)(c) GDPR – legal obligation.

​

Managing internal processes and business communication records

We process data related to contract records, correspondence, email communication, project administration, and internal reports to ensure effective company management and fulfillment of obligations to clients and partners.

Legal basis: Legitimate interest under Art. 6(1)(f) GDPR.
You have the right to object to such processing.

​

Records and communication with business contacts

We process personal data of contact persons from partners, subcontractors, or collaborators (name, email, phone, job position) for the purpose of developing and ensuring business cooperation.

Legal basis: Legitimate interest under Art. 6(1)(f) GDPR in conjunction with § 78(3) of the Personal Data Protection Act.

​

Personnel records and recruitment

When selecting new employees or external collaborators, we process applicants' personal data (CV, contact details, professional information).

Legal basis:

• Art. 6(1)(b) GDPR – pre-contractual relationship (for specific responses to job offers),

• Art. 6(1)(a) GDPR – consent (only when storing applicants in a database for future recruitment).

​

Marketing and presentation of our solutions

We process selected data (e.g., name, email, photograph, video recordings) for presenting our projects, sending newsletters, publishing references, conducting online campaigns, or sharing content on social media.

Legal basis:

• Legitimate interest under Art. 6(1)(f) GDPR – for marketing to existing clients regarding similar services,

• Consent under Art. 6(1)(a) GDPR – for visual content (photos/videos), newsletters, or marketing to non-clients.

Consent is voluntary and you can withdraw it at any time.

​

Categories of data subjects

• Clients and potential clients

• Contractual partners, suppliers, subcontractors

• Job applicants

• Employees and external collaborators

• Contact persons of business partners

• Participants in marketing and promotional activities

​

Scope of processed personal data

• Identification data (name, surname, Company ID, Tax ID, company, position)

• Contact details (email, phone, address, business address)

• Data related to business relationships (orders, contracts, invoicing, project documentation)

• Communication content (emails, messages, correspondence)

• Data for accounting and tax purposes

• Photographs, video recordings, and marketing materials (only with explicit consent)

​

DiTeSo s. r. o. as Data Processor

In cases where DiTeSo s. r. o. acts as a data processor under Art. 28(3) of the GDPR, we process personal data exclusively according to the instructions of another controller (our client). In such cases, the purpose of processing is determined by the controller, not by us.

Our role consists of technical, system, and administrative processing of data through information systems, development tools, or infrastructure solutions that we create, operate, or manage for the client.

​

Nature and scope of processing activities

Processing personal data as a processor includes mainly the following activities:

• Development, testing, and implementation of software solutions – during development or operation of systems, processing of client's personal data may occur (e.g., test or production data).

• Operation and maintenance of IT systems and databases – technical administration and service interventions in systems storing personal data (e.g., CRM, ERP, internal client platforms).

• Hosting, cloud, and backup services – management of data storage, servers, and backups containing personal data, according to client instructions.

• Data processing within integrations – technical support for connecting systems and data transfers between different applications or environments.

• User support and service communication (helpdesk, ticketing) – access to data to the extent necessary for resolving technical requirements.

• Data migration and conversion – transfer or conversion of client databases between systems when changing software or platforms.

• Security and analytical activities – monitoring functionality, system logging, testing security measures (without evaluating personal data content).

In all these cases, we process personal data only to the extent necessary for contract performance and in accordance with the client's (controller's) instructions.

​

Processing data based on controller's instructions

As a processor, we make no decisions about the purpose or method of processing.

We process data exclusively according to the controller's written instructions, which are regulated in the data processing agreement.

Examples of processing include:

• Processing personal data of employees, clients, or users of systems we operate for the client,

• Processing test datasets containing personal data during software development or modifications,

• Accessing personal data during maintenance, backup, or incident resolution.

​

Detailed description of processor activities (DiTeSo s. r. o.)

For greater transparency, here's an overview of the main processing activities that DiTeSo s. r. o. performs as a processor:

1. Development and implementation of information systems – configuration, testing, and tuning of systems containing personal data.

2. Service and technical support – resolving incidents, failures, and client requirements through access to data processing systems.

3. Hosting and cloud solutions – server, storage, and database management, including security settings, backup, and recovery.

4. Data and system integration – technical data processing when connecting client applications or modules.

5. Analytical processing and reporting – data processing for reports, statistics, or logs according to client instructions.

6. Testing security features and software functionality – processing personal data during testing operations based on client authorization.

7. Data migration and archiving – technical data processing during transfer or archiving of client data structures.

​

Legal basis for processing personal data

When DiTeSo s. r. o. acts as a processor, the legal basis for processing is the data processing agreement concluded with the controller under Art. 28 of the GDPR.

Based on this agreement, we adopt the legal basis for processing personal data determined by the controller (our client) and process data exclusively according to their instructions, to the extent necessary for fulfilling the tasks specified in the agreement.

DiTeSo s. r. o. makes no decisions about the purposes or methods of processing and ensures that all operations comply with GDPR requirements, including confidentiality, integrity, and security of personal data.

DiTeSo s. r. o.:

• Does not process personal data for its own purposes or based on legitimate interest,

• Acts exclusively according to the controller's written instructions,

• Implements technical and organizational measures to protect personal data,

• Ensures confidentiality of all data it accesses,

• Engages additional processors only with prior consent or in accordance with the framework agreement with the controller.

​

Summary

As a processor, DiTeSo s. r. o. fulfills a purely technical and service role in personal data processing.

The controller (client) is always responsible for determining the purpose and lawfulness of processing, while DiTeSo s. r. o. ensures implementation of technical and operational tasks in compliance with GDPR.