Personal Data Protection Policy and GDPR – Flowbily

1. Introduction

Personal data processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR), Act No. 110/2019 Coll., on personal data processing, and other applicable legal rules.

Flowbily is a desktop application intended in particular for importing calendar events, creating invoices, and exporting invoicing documents.

In ordinary use, calendar and invoicing data may be processed directly on the user’s computer. The application may also communicate with a server, for example to verify a licence, obtain updates, or provide security.

The specific method of processing depends on the features used, the application configuration, and the infrastructure actually deployed.

2. Data controller

The controller of personal data is:

Business name / first name and surname: Belvela s.r.o.

Registered office / place of business: Petříkov 101, 251 69

Company ID (IČO): 04293002

Contact e-mail: info@belvela.com

(the “Operator”).

The Operator determines the purposes and means of personal data processing where it acts as a controller under the GDPR.

If the user processes personal data of their clients or other persons through the application for their own business purposes, the user themselves may be the controller of that data. The Operator’s role is assessed according to the specific purpose and the actual method of processing.

3. What personal data may be processed

The scope of processed data depends on which application features the user uses.

3.1 Licence data

In connection with a licence, the following in particular may be processed:

licence identifier;

licence status and validity period;

information needed to verify the right to use the application;

application version;

date and result of licence verification;

necessary technical and security records.

3.2 Contact and contractual data

If the user purchases a licence, orders a service, or contacts support, their contact details may be processed, in particular name, e-mail address, order details, payment information, and the content of communication.

3.3 Calendar data

When importing calendar files or connecting to Google Calendar, the application may process, for example:

event titles and descriptions;

event dates, times, and durations;

other imported fields;

data needed to calculate time or prepare invoicing data.

The specific scope depends on the permissions granted by the user, the format of imported data, and the features used.

3.4 Invoicing data

When creating invoices, the application may work, for example, with names of customers, addresses, company ID (IČO), VAT ID (DIČ), description of the supply, prices, issue dates, dates of supply, and due dates.

Such data may be personal data if it relates to an identified or identifiable natural person.

3.5 Technical data

When communicating with a server or visiting the website, technical data may be processed, for example IP address, time of the request, application version, operating system information, request status, and security or diagnostic records, if such data is actually obtained.

4. Local processing of data in the application

Flowbily is a desktop application. Calendar files, imported events, invoicing data, and created invoices may be processed and stored locally on the user’s device.

If specific data remains solely on the user’s device and is not transferred to the Operator, the Operator does not automatically have access to its content.

The application may communicate with a server, for example to:

verify a licence;

check the validity of the right to use the application;

download updates;

provide security;

provide other expressly described online features.

This communication should be limited to data necessary for the relevant purpose.

If a feature is introduced that sends the content of calendars, invoices, or other user documents to a server, its operation must be explained in an appropriate manner and the processing must have a suitable legal basis.

5. Connection to Google Calendar

Flowbily may allow connection to Google Calendar through the Google API and import of calendar files.

When connecting to Google Calendar, the user separately authorises access through Google’s sign-in and authorisation process.

The application should request only the permissions needed for the features it actually provides. The scope of access corresponds to the permissions shown to the user in the authorisation dialog.

Data obtained through the Google API may be used for application features, for example to display events, calculate time, or prepare invoicing data, if the user uses those features.

Data obtained through the Google API is not used for advertising and is not sold to third parties. Its use is also subject to the Google API Services User Data Policy, including the Limited Use requirements.

The user may revoke the application’s permissions in their Google account settings. This may limit or terminate further connection and synchronisation.

6. Purposes and legal bases of processing

We process personal data only if there is a corresponding legal basis for the given purpose.

6.1 Performance of a contract

Under Article 6(1)(b) GDPR, we may process data necessary to conclude and perform a contract, for example when managing a licence, verifying the right to use the application, providing agreed features, and communicating in connection with the service.

6.2 Compliance with legal obligations

Under Article 6(1)(c) GDPR, we process data where this is necessary to comply with legal obligations, in particular in accounting, tax, and other duties laid down by law.

6.3 Legitimate interest

Under Article 6(1)(f) GDPR, we may process necessary data to secure the application and servers, prevent licence misuse, resolve technical issues, and protect legal claims.

In these cases we assess whether our legitimate interests are overridden by the rights and freedoms of the data subjects.

6.4 Consent

If there is no other applicable legal basis for a specific purpose and the law requires consent, we process personal data only on the basis of valid consent.

Consent must be freely given, specific, informed, and unambiguous. The user may withdraw it without affecting the lawfulness of processing before withdrawal.

Acceptance of the terms of service or confirmation that the user has read the personal data protection policy is not automatically consent to all types of processing.

6.5 Marketing

We send commercial communications in accordance with the applicable legal rules. If consent is required, we obtain it separately.

Where the law allows sending similar offers of our own to existing customers without separate consent, we comply with the relevant conditions and the option to opt out.

7. Recipients of personal data

Personal data may be disclosed to external providers where this is necessary to operate the application and website.

This may include, for example, providers of:

server infrastructure and hosting;

licence verification and update distribution;

e-mail and communication services;

payment services;

technical support;

other services actually used by the Operator.

If a provider processes personal data on behalf of the Operator as a processor, the requirements of Article 28 GDPR must be met.

Google may process data in connection with the use of Google Calendar under its own terms and privacy policy.

Data may be disclosed to public authorities where required by law or where another corresponding legal basis exists.

The specific list of providers must correspond to the technologies actually used by Flowbily.

8. Transfers of data outside the European Union

If personal data is transferred to countries outside the European Economic Area, we proceed in accordance with Chapter V GDPR.

Transfers may take place, for example, on the basis of a European Commission adequacy decision or another permitted mechanism, such as standard contractual clauses, if the relevant conditions are met.

The specific countries, recipients, and protection mechanisms depend on the external services used.

9. Retention period of personal data

We retain personal data only for as long as necessary for the purpose for which it was obtained, or for the period required by law.

Licence data is retained for as long as needed to manage the licence, verify rights, and settle any contractual claims.

Order data and accounting or tax records are retained for the period required by the applicable legal rules.

Technical and security records are retained for a reasonable period needed for security, diagnostics, and incident handling.

If calendar data and invoices are stored solely locally on the user’s device and are not transferred to the Operator, their retention and deletion are managed by the user.

Specific retention periods must correspond to the actual operation of the application and the systems used.

10. Security of personal data

We use appropriate technical and organisational measures corresponding to the nature of the processed data and the related risks.

These measures may include access-rights management, server security, protection of authentication data, software updates, and procedures for handling security incidents.

The user is responsible for securing their device, access credentials, and locally stored data.

Appropriate security measures reduce risks but cannot guarantee absolute security.

11. Rights of data subjects

To the extent provided by the GDPR, you have in particular the following rights.

Right of access: You have the right to obtain confirmation as to whether your personal data is being processed, and access to that data and related information.

Right to rectification: You may request correction of inaccurate personal data or completion of incomplete personal data.

Right to erasure: Under the conditions set by the GDPR, you may request erasure of personal data. The right is not absolute, for example where further retention is required by law.

Right to restriction of processing: In cases set by the GDPR, you may request restriction of processing.

Right to data portability: Under the GDPR, you may request the data you provided to us that we process by automated means on the basis of consent or a contract, in a structured, commonly used, and machine-readable format. Under statutory conditions you may also request that it be transmitted to another controller.

Right to object: If we process data on the basis of legitimate interest, you may object. In the case of direct marketing, you may object at any time.

Right to withdraw consent: If processing is based on consent, you may withdraw it at any time.

Rights relating to automated decision-making: Under the conditions of Article 22 GDPR, you have the right not to be subject to certain decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

These rights are exercised according to the specific circumstances and may be subject to statutory limitations.

12. How to exercise your rights

You may exercise your rights by e-mail:

info@belvela.com

Please state in your request which right you are relying on and which processing the request concerns.

If we have reasonable doubts about your identity, we may request additional information necessary to verify it.

We respond to requests without undue delay, generally within one month of receipt. In complex cases the period may, under the GDPR, be extended by up to a further two months. We will inform you of any extension and its reasons.

13. Complaint to the supervisory authority

If you believe that the processing of your personal data infringes legal rules, you have the right to lodge a complaint with a supervisory authority.

In the Czech Republic, that authority is:

Office for Personal Data Protection

Pplk. Sochora 27

170 00 Prague 7

Website: https://uoou.gov.cz

Lodging a complaint with the supervisory authority does not limit other rights granted to you by law.

14. Data of other persons and the user’s responsibility

Calendar events and invoicing documents may contain personal data of clients, business partners, or other persons.

The user is responsible for having an appropriate legal basis to import and process such data for their purposes.

If the user uses Flowbily for their own business and determines the purposes of processing their clients’ personal data, they generally act as the controller of that data.

If the Operator started processing personal data on behalf of the user as a processor, the contractual relationship would need to be adjusted accordingly and the requirements of Article 28 GDPR would need to be met.

15. Cookies and the website

The Flowbily website may use strictly necessary cookies and similar technologies to ensure the website works and is secure.

If the website uses analytics, marketing, or other optional technologies that require consent, they will be activated only after valid consent is obtained.

The user must be able to manage consent to the extent required by law.

Specific information about the cookies used, their purpose, validity period, and any recipients will be provided in a separate cookie notice or in the corresponding website settings, if those technologies are used.

16. Changes to the personal data protection policy

We may update this policy in particular if the application, technical infrastructure, external services used, or legal rules change.

We will publish the current version on the Flowbily website together with the date of the last update.

If a change requires new consent to personal data processing, we will obtain it separately. Publishing a new version of the policy does not replace consent where consent is required by law.

17. Contact details

You may contact us about personal data protection at:

Operator: Belvela s.r.o.

E-mail: info@belvela.com

Address: Petříkov 101, 251 69