Personal data processing policy

I. Data controller

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) is:

LIPPIO s.r.o. has not appointed a data protection officer.

II. What personal data we process

We process personal data that you provide to us, particularly through the contact form, by email, by telephone, in person or in connection with our services.

This may include in particular:

• your first and last name,
• your email address and telephone number,
• your business name, company ID, VAT ID and billing details,
• the content of your message or enquiry,
• data needed to enter into and perform a contract,
• accounting, tax, payroll and HR data provided in connection with agreed services,
• technical data relating to use of the website, such as your IP address, device information and information needed to secure the form.

We always limit the scope of data processed to what is necessary for the specific purpose.

III. Purposes and legal bases for processing

We process personal data primarily for the following purposes:

• handling questions or enquiries and taking steps before potentially entering into a contract, under Article 6(1)(b) GDPR,
• entering into and performing contracts for accounting, tax, payroll or advisory services, under Article 6(1)(b) GDPR,
• complying with legal obligations, particularly those arising from accounting, tax and other legislation, under Article 6(1)(c) GDPR,
• protecting our rights, securing the website, preventing misuse of the form and handling legal claims on the basis of legitimate interests under Article 6(1)(f) GDPR,
• other purposes to which you have consented, under Article 6(1)(a) GDPR.

Providing data through the contact form is voluntary. However, without contact details we cannot respond to your question or enquiry.

IV. Accounting and payroll services for clients

When providing accounting, payroll and related services, we may also process personal data concerning employees, customers, suppliers and other people provided to us by our clients.

In these cases, the relevant client may be the data controller and LIPPIO s.r.o. acts as a data processor under the client’s instructions and an appropriate agreement. Requests concerning such data generally need to be addressed to the controller who provided it to us.

V. How long we retain personal data

We retain personal data only for as long as necessary for the relevant purpose:

• data from routine questions and unsuccessful enquiries is generally retained for no longer than 12 months after the last communication,
• data relating to a contractual relationship is retained for its duration and subsequently for the period needed to protect legal claims,
• accounting, tax and other documents are retained for the periods required by applicable law,
• data processed on the basis of consent is retained until consent is withdrawn, but no longer than the period stated when consent was given,
• technical and security data is retained for the period necessary to secure and protect the website.

After the applicable period expires, we securely delete or anonymise the data unless the law requires us to retain it further.

VI. Recipients of personal data

Personal data may be disclosed to trusted recipients and processors to the extent necessary, particularly:

• providers of web hosting, server and email services,
• IT support and information system administration suppliers,
• providers of accounting and communication software,
• tax advisers, auditors, lawyers and other professional advisers,
• public authorities where disclosure is required by law,
• Google in connection with reCAPTCHA v3 form protection and recording enquiries in Google Sheets, and email service providers when forwarding an enquiry to the authorised form administrator.

We enter into appropriate agreements with processors and ensure that they process personal data only under our instructions, securely and to the extent necessary.

VII. Transfers outside the European Union

Some providers of technical services, particularly Google, may also process personal data outside the European Union or the European Economic Area.

Such transfers take place only where GDPR conditions are met, particularly on the basis of a European Commission adequacy decision or standard contractual clauses and other appropriate safeguards.

Information about Google’s processing of data can be found in its privacy policy .

VIII. Automated decision-making

We do not carry out automated individual decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

When you submit an enquiry, reCAPTCHA v3 automatically assesses the risk of form abuse to protect the website. Accepted enquiries are recorded in a private Google Sheet and forwarded by email to the authorised form administrator. Form details are not sent to analytics.

IX. Your rights

Subject to the conditions of the GDPR, you have in particular:

• the right of access to personal data under Article 15 GDPR,
• the right to rectify inaccurate data under Article 16 GDPR,
• the right to erasure under Article 17 GDPR,
• the right to restriction of processing under Article 18 GDPR,
• the right to data portability under Article 20 GDPR,
• the right to object to processing based on legitimate interests under Article 21 GDPR,
• the right to withdraw consent at any time without affecting the lawfulness of earlier processing,
• the right to lodge a complaint with the Czech Office for Personal Data Protection.

You can exercise your rights by email at info@lippio.cz or in writing to our registered office.

The supervisory authority is the Czech Office for Personal Data Protection , Pplk. Sochora 27, 170 00 Prague 7.

X. Personal data security

We have adopted appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.

Only authorised people who need personal data to fulfil their employment or contractual duties and who are bound by confidentiality obligations have access to it.

XI. Final provisions

We may update this policy from time to time, particularly when the services we use, the way we process personal data or legislation changes. The current version will always be published on this website.

This policy version for the planned static website is dated 4 November 2026.