1. Parties and conclusion
1.1 The controller is the customer of Lanflow services (the “controller”). The processor is LANTEK NET s.r.o., registered office Pýchavková 269/5, Pitkovice, 104 00 Praha 114, Czech Republic, company ID (IČO) 07145691, VAT ID CZ07145691, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 294855 (the “processor”).
1.2 This agreement forms part of the terms and conditions. It is concluded when an account is created in the client zone or an order is confirmed, and lasts as long as the processor processes personal data for the controller.
2. Subject matter, nature and purpose
2.1 The processor transfers, converts into the required formats and temporarily stores data between the systems the controller has connected in the client zone (e-shop, accounting, bank, carriers, payment gateways, public administration systems and others).
2.2 The purpose is the automatic transfer of documents, orders, stock, payments and related data according to the settings the controller chooses in the client zone.
2.3 Categories of data subjects: the controller’s customers, contact persons of its customers and suppliers, users of the controller’s account.
2.4 Categories of personal data: name, address, e-mail, phone, company and VAT ID, order, invoice and delivery data, payment data (amount, variable symbol, account number and payer name), and for age verification the verification result. Special categories of personal data (Art. 9 GDPR) are not processed.
3. Processor obligations
3.1 The processor:
- processes personal data only on documented instructions from the controller; the instructions are this agreement, the order and the integration settings in the client zone. If it believes an instruction infringes the law, it informs the controller;
- ensures that persons authorised to process the data are bound by confidentiality;
- takes the measures required by Art. 32 GDPR, in particular: encryption in transit (TLS), encryption of access keys (AES-256-GCM), separation of each client’s data, two-factor authentication, storage in the EU, backups, and keeping transfer data only as long as needed for the transfer, its retry and troubleshooting;
- assists the controller with data subject requests and with obligations under Articles 32 to 36 GDPR;
- notifies the controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available;
- makes available the information needed to demonstrate compliance and allows audits. The controller announces an audit at least 30 days in advance, carries it out during business hours without disrupting operations and bears its costs.
4. Sub-processors
4.1 The controller grants general authorisation to engage sub-processors. The processor binds them to the same data protection obligations and remains responsible for them. Currently:
| Sub-processor | Activity | Location |
|---|---|---|
| OVH SAS (OVHcloud) | servers, databases | EU |
| Cloudflare, Inc. | network protection and data delivery | global network; transfers outside the EU under standard contractual clauses and the Data Privacy Framework |
| backup provider | encrypted backups | EU |
| e-mail service provider | e-mail alerts | EU |
4.2 The processor announces changes to sub-processors by e-mail at least 30 days in advance. If the controller disagrees, it may object before the change takes place or terminate running.
4.3 Providers of systems the controller has connected itself (e.g. its e-commerce platform, accounting software or bank) are not sub-processors. They process data under their own contract with the controller.
5. Termination
5.1 Within 30 days after the services end, the processor deletes the controller’s personal data and stored access credentials unless the law requires retention. On request made before the services end, it first provides an export of the available data. Data is removed from backups as they are routinely overwritten, within 90 days at the latest.
6. Final provisions
6.1 The parties’ liability is governed by the terms and conditions and the GDPR. Data protection contact: in writing to our registered office at Pýchavková 269/5, Pitkovice, 104 00 Praha 114 or via the contact form on this website.
6.2 This agreement is effective from 16 October 2026. The processor may amend it in the same way as the terms and conditions. This English version is a translation; in case of conflict, the Czech version prevails.