GDPR Compliance

Last Updated: January 15, 2026

Introduction

Alfares is committed to full compliance with the General Data Protection Regulation (GDPR) and other applicable European data protection laws. This document outlines our comprehensive approach to data protection and privacy, ensuring that we meet the highest standards for European businesses and their customers.

What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all organizations operating within the EU and those outside the EU that offer goods or services to individuals in the EU or monitor the behavior of individuals in the EU.

Our GDPR Commitment

Core Principles

We adhere to the seven core principles of GDPR:

1. Lawfulness, Fairness, and Transparency

• Legal Basis: We process personal data only when we have a valid legal basis
• Fair Processing: We ensure data processing is fair and reasonable
• Transparency: We provide clear information about how we use personal data

2. Purpose Limitation

• Specific Purposes: We collect data only for specified, explicit, and legitimate purposes
• No Further Processing: We do not process data for incompatible purposes
• Clear Objectives: We clearly communicate the purpose of data collection

3. Data Minimization

• Adequate, Relevant, and Limited: We collect only the data necessary for our purposes
• No Excessive Collection: We avoid collecting unnecessary personal information
• Regular Review: We regularly review and minimize our data collection practices

4. Accuracy

• Accurate and Up-to-Date: We maintain accurate and current personal data
• Rectification: We promptly correct inaccurate or incomplete data
• Verification: We verify data accuracy through appropriate measures

5. Storage Limitation

• Time-Limited Retention: We retain personal data only as long as necessary
• Clear Retention Policies: We have defined retention periods for different data types
• Secure Deletion: We securely delete data when no longer needed

6. Integrity and Confidentiality

• Security Measures: We implement appropriate technical and organizational security measures
• Access Controls: We limit access to personal data to authorized personnel
• Encryption: We use encryption and other security technologies

7. Accountability

• Documentation: We maintain comprehensive records of our data processing activities
• Regular Audits: We conduct regular compliance audits and assessments
• Training: We provide ongoing training to our staff on data protection

Legal Basis for Processing

Consent

We obtain explicit consent for processing personal data when required:

Consent Requirements:

• Freely Given: Consent is given without coercion or pressure
• Specific: Consent is obtained for specific processing purposes
• Informed: Individuals are fully informed about data processing
• Unambiguous: Consent is clear and affirmative
• Withdrawable: Individuals can withdraw consent at any time

Consent Management:

• Clear Language: We use plain, understandable language in consent requests
• Granular Options: We provide granular consent options for different purposes
• Easy Withdrawal: We make it easy to withdraw consent
• Consent Records: We maintain records of consent for audit purposes

Contract Performance

We process personal data when necessary for contract performance:

Contractual Processing:

• Service Delivery: Processing required to provide our services
• Customer Support: Processing for customer service and support
• Billing and Payment: Processing for financial transactions
• Account Management: Processing for account administration

Legitimate Interest

We process data based on legitimate interests when appropriate:

Legitimate Interest Assessment:

• Purpose: Clear and legitimate business purpose
• Necessity: Processing is necessary for the purpose
• Balancing: Interests are balanced against individual rights
• Documentation: We document our legitimate interest assessments

Legal Obligation

We process data when required by law:

Legal Requirements:

• Tax Obligations: Processing for tax and accounting purposes
• Regulatory Compliance: Processing for regulatory requirements
• Legal Proceedings: Processing for legal proceedings when required
• Security Requirements: Processing for security and fraud prevention

Data Subject Rights

Right to Information

Individuals have the right to be informed about data processing:

Information Provided:

• Identity and Contact: Our identity and contact details
• Purpose and Legal Basis: Why and how we process data
• Legitimate Interests: Our legitimate interests when applicable
• Recipients: Who receives the data
• Retention Period: How long we keep the data
• Rights: Individual rights under GDPR
• Complaints: Right to lodge complaints with supervisory authorities

Right of Access

Individuals can request access to their personal data:

Access Rights:

• Confirmation: Confirmation that we process their data
• Copy of Data: A copy of their personal data
• Processing Information: Information about processing purposes
• Recipients: Information about data recipients
• Retention Period: Information about data retention
• Rights: Information about their rights

Right to Rectification

Individuals can request correction of inaccurate data:

Rectification Process:

• Prompt Response: We respond to rectification requests promptly
• Verification: We verify the accuracy of correction requests
• Notification: We notify relevant parties of corrections
• Documentation: We document all rectification activities

Right to Erasure (Right to be Forgotten)

Individuals can request deletion of their personal data:

Erasure Conditions:

• No Longer Necessary: Data is no longer necessary for the original purpose
• Withdrawn Consent: Consent has been withdrawn
• Objection: Individual has objected to processing
• Unlawful Processing: Data has been processed unlawfully
• Legal Obligation: Required by law to delete the data

Right to Restrict Processing

Individuals can request restriction of data processing:

Restriction Scenarios:

• Accuracy Dispute: Individual contests data accuracy
• Unlawful Processing: Processing is unlawful
• No Longer Needed: We no longer need the data
• Objection Pending: Objection to processing is being considered

Right to Data Portability

Individuals can request their data in a portable format:

Portability Requirements:

• Structured Format: Data provided in a structured, commonly used format
• Machine Readable: Data is machine-readable
• Direct Transfer: Data can be transferred to another controller
• No Obstruction: We do not obstruct data portability

Right to Object

Individuals can object to data processing:

Objection Rights:

• Direct Marketing: Absolute right to object to direct marketing
• Legitimate Interest: Right to object to processing based on legitimate interest
• Scientific Research: Right to object to processing for scientific research
• Automated Decision Making: Right to object to automated decision making

Rights Related to Automated Decision Making

Individuals have rights regarding automated processing:

Automated Processing Rights:

• Human Intervention: Right to human intervention
• Explanation: Right to explanation of decisions
• Challenge: Right to challenge decisions
• Safeguards: Right to safeguards against automated decisions

Data Processing Activities

Customer Data Processing

We process customer data for service delivery:

Customer Data Types:

• Contact Information: Name, email, phone number, address
• Account Information: Username, password, account preferences
• Service Data: Service usage, preferences, history
• Communication Data: Emails, support tickets, feedback

Processing Purposes:

• Service Provision: To provide our software development services
• Customer Support: To provide technical support and assistance
• Account Management: To manage customer accounts and relationships
• Communication: To communicate about services and updates

Employee Data Processing

We process employee data for employment purposes:

Employee Data Types:

• Personal Information: Name, contact details, identification
• Employment Information: Job title, department, salary
• Performance Data: Performance reviews, training records
• System Access: Login credentials, access permissions

Processing Purposes:

• Employment Management: To manage employment relationships
• Payroll and Benefits: To process payroll and benefits
• Performance Management: To manage performance and development
• Security: To ensure system and data security

Website and Analytics Data

We process website and analytics data for improvement:

Website Data Types:

• Usage Data: Pages visited, time spent, interactions
• Technical Data: IP address, browser type, device information
• Cookie Data: Cookie preferences and settings
• Form Data: Information submitted through forms

Processing Purposes:

• Website Improvement: To improve website functionality and user experience
• Analytics: To understand website usage and performance
• Marketing: To provide relevant content and advertisements
• Security: To protect against fraud and security threats

Data Security Measures

Technical Security

We implement comprehensive technical security measures:

Security Technologies:

• Encryption: Data encryption in transit and at rest
• Access Controls: Role-based access controls and authentication
• Network Security: Firewalls, intrusion detection, and monitoring
• Backup Security: Secure backup and disaster recovery systems

Security Standards:

• Industry Best Practices: Following industry security standards
• Regular Updates: Keeping systems and software updated
• Vulnerability Management: Regular security assessments and testing
• Incident Response: Comprehensive incident response procedures

Organizational Security

We implement organizational security measures:

Security Policies:

• Data Protection Policy: Comprehensive data protection policy
• Access Control Policy: Clear access control procedures
• Incident Response Policy: Defined incident response procedures
• Training Programs: Regular security and privacy training

Security Procedures:

• Background Checks: Background checks for employees
• Confidentiality Agreements: Employee confidentiality agreements
• Clean Desk Policy: Clean desk and clear screen policies
• Visitor Management: Visitor access controls and procedures

Data Breach Management

Breach Detection and Response

We have comprehensive breach detection and response procedures:

Detection Systems:

• Monitoring: Continuous monitoring of systems and networks
• Alerts: Automated alerts for suspicious activities
• Reporting: Clear reporting procedures for potential breaches
• Investigation: Prompt investigation of potential incidents

Response Procedures:

• Immediate Response: Immediate containment and mitigation
• Assessment: Comprehensive assessment of breach impact
• Notification: Timely notification to authorities and affected individuals
• Documentation: Complete documentation of breach and response

Breach Notification

We comply with GDPR breach notification requirements:

Notification Timeline:

• 72 Hours: Notification to supervisory authority within 72 hours
• Without Delay: Notification to affected individuals without delay
• Documentation: Complete documentation of breach and response
• Follow-up: Follow-up actions and preventive measures

Notification Content:

• Breach Description: Clear description of the breach
• Data Categories: Categories of personal data affected
• Impact Assessment: Assessment of potential impact
• Remedial Actions: Actions taken to address the breach

International Data Transfers

Transfer Safeguards

We ensure adequate protection for international data transfers:

Transfer Mechanisms:

• Adequacy Decisions: Transfers to countries with adequate protection
• Standard Contractual Clauses: EU-approved data transfer agreements
• Binding Corporate Rules: Internal data protection policies
• Certification Schemes: Approved privacy frameworks

Transfer Documentation:

• Transfer Records: Complete records of international transfers
• Safeguard Documentation: Documentation of transfer safeguards
• Regular Review: Regular review of transfer arrangements
• Compliance Monitoring: Ongoing compliance monitoring

Third-Party Transfers

We ensure third-party compliance with data protection requirements:

Third-Party Requirements:

• GDPR Compliance: All third parties must comply with GDPR
• Data Processing Agreements: Comprehensive data processing agreements
• Security Standards: Adequate security measures
• Audit Rights: Rights to audit third-party compliance

Data Protection Officer

DPO Role and Responsibilities

We have appointed a Data Protection Officer (DPO):

DPO Responsibilities:

• Compliance Monitoring: Monitor GDPR compliance
• Advice and Guidance: Provide advice on data protection matters
• Training: Conduct data protection training
• Audit Coordination: Coordinate compliance audits

DPO Independence:

• Independent Role: DPO operates independently
• Direct Access: Direct access to senior management
• No Conflicts: No conflicts of interest
• Professional Development: Ongoing professional development

DPO Contact Information

For GDPR-related inquiries:

Contact Details:

• Email: [email protected]
• Phone: +420 774 287 541
• Address: Cetechovice 70, 768 02 Czech Republic
• Online: GDPR inquiry form

Training and Awareness

Employee Training

We provide comprehensive data protection training:

Training Programs:

• Initial Training: Data protection training for new employees
• Regular Updates: Regular training updates and refreshers
• Role-Specific Training: Training tailored to specific roles
• Compliance Testing: Regular testing of data protection knowledge

Training Content:

• GDPR Principles: Understanding of GDPR principles
• Data Handling: Proper data handling procedures
• Security Practices: Security best practices
• Incident Response: Incident response procedures

Awareness Programs

We maintain ongoing awareness programs:

Awareness Activities:

• Regular Communications: Regular communications about data protection
• Best Practice Sharing: Sharing of data protection best practices
• Case Studies: Learning from data protection case studies
• Feedback Mechanisms: Mechanisms for feedback and questions

Compliance Monitoring

Regular Audits

We conduct regular compliance audits:

Audit Schedule:

• Annual Audits: Comprehensive annual compliance audits
• Quarterly Reviews: Quarterly compliance reviews
• Ad Hoc Audits: Ad hoc audits as needed
• External Audits: External audits by independent auditors

Audit Scope:

• Policy Review: Review of data protection policies
• Procedure Assessment: Assessment of data protection procedures
• Technical Review: Review of technical security measures
• Training Evaluation: Evaluation of training effectiveness

Compliance Reporting

We maintain comprehensive compliance reporting:

Reporting Requirements:

• Regular Reports: Regular compliance reports to management
• Incident Reports: Reports on data protection incidents
• Training Reports: Reports on training completion and effectiveness
• Audit Reports: Reports on audit findings and recommendations

Contact Information

Data Protection Inquiries

For general data protection inquiries:

Contact Details:

• Email: [email protected]
• Phone: +420 774 287 541
• Address: Cetechovice 70, 768 02 Czech Republic
• Online: Privacy inquiry form

Supervisory Authority

For complaints about data protection practices:

EU Residents:

• Contact your local data protection authority
• UK Residents: Information Commissioner's Office (ICO)
• Swiss Residents: Federal Data Protection and Information Commissioner (FDPIC)

Data Subject Rights Requests

For exercising your data subject rights:

Request Methods:

• Email: [email protected]
• Online Form: Data subject rights request form
• Phone: [Rights Request Number]
• Post: [Rights Request Address]

Updates and Review

Policy Review

We regularly review and update our GDPR compliance:

Review Schedule:

• Annual Review: Comprehensive annual review of compliance
• Regulatory Updates: Updates for changes in data protection law
• Business Changes: Updates for business changes
• Incident Reviews: Reviews following data protection incidents

Continuous Improvement

We continuously improve our data protection practices:

Improvement Activities:

• Best Practice Adoption: Adoption of industry best practices
• Technology Updates: Updates to security and privacy technologies
• Process Optimization: Optimization of data protection processes
• Stakeholder Feedback: Incorporation of stakeholder feedback

---

This GDPR Compliance document is effective as of January 15, 2026. For questions about our GDPR compliance, please contact us at [email protected].