Personal Data Processing Principles

At SOHE s.r.o., we take the protection of your personal data seriously. These principles explain what personal data we process, for what purposes, on what legal basis, how long we retain it, to whom we disclose it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter "GDPR") and Act No. 110/2019 Coll., on the processing of personal data.

1. Who is the data controller

The data controller is SOHE s.r.o., Company ID 04089111, with its registered office at Lidická 700/19, 602 00 Brno-Veveří. Registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 88177.

Contact point: Hořavova 91, 664 61 Opatovice.
E-mail: info@sohe.cz, phone: +420 724 689 762.

We have not appointed a Data Protection Officer – we have no legal obligation to do so (Art. 37 GDPR). For all matters concerning the processing of personal data, please contact us at the e-mail address above.

2. What personal data we process

• Identification and contact details – first and last name, company name, Company ID, phone, e-mail, or address.
• Inquiry and order data – type of service, location, description and scope of the order, requested date, and any other information you provide to us.
• Contractual relationship data – invoicing and payment details, communication content, data stated in inspection reports and documentation, if necessary for service fulfillment.
• Technical data upon form submission – IP address, date and time of submission, used to ensure security and protect against misuse.

We do not intentionally process sensitive (special category) personal data and do not request it.

3. Why we process data and on what legal basis

• Handling your inquiry and communicating with you – the legal basis is taking steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR), or our legitimate interest in responding to your query (Art. 6(1)(f)).
• Contract performance – providing the ordered service (inspection, occupational health & safety, fire safety, training) and related communication (Art. 6(1)(b)).
• Compliance with legal obligations – particularly bookkeeping and issuing tax documents, archiving documentation (Art. 6(1)(c)).
• Protection of our legitimate interests – website security and protection against form misuse, or the establishment, exercise, or defense of legal claims (Art. 6(1)(f)).

Completing and submitting the contact or inquiry form is voluntary and does not create an obligation to order a service. However, without providing contact details, we cannot respond to your inquiry. We do not use your data for marketing purposes; if we wanted to send you commercial communications, we would first ask for your consent, which you can withdraw at any time.

4. How long we retain data

• Inquiries that did not lead to a contract – for the time necessary to handle them and subsequently for the duration of our legitimate interest, generally no longer than 24 months from the last communication.
• Contractual and invoicing data – for the duration of the contract and thereafter for the period stipulated by accounting and tax regulations (typically 5 to 10 years).
• Technical and security logs – for the time strictly necessary to ensure security, after which they are deleted or anonymized.

After the retention period expires, we delete or anonymize the personal data.

5. To whom we disclose data

We do not transfer personal data to third parties for their own purposes and do not sell it. To the necessary extent, it may be processed by our processors, who are bound by a data processing agreement and a duty of confidentiality:

• web hosting and e-mail service provider,
• accounting and tax service provider,
• or subcontractors we engage to fulfill a specific order (always only to the necessary extent).

We may also disclose data if required by law or requested by an authorized public authority (e.g., court, tax administrator, supervisory authority).

6. Transfers to third countries

We process personal data within the European Union. We do not transfer it to third countries (outside the EU/EEA) or international organizations.

7. Automated decision-making and profiling

We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Where we obtain data from

We obtain personal data directly from you – from a completed form, e-mail, phone call, or subsequent communication and from the contractual relationship. We may verify company data in public registers (e.g., Commercial Register, VAT payer register).

9. Your rights

Regarding your personal data, you have the right to:

• access your data and obtain a copy (Art. 15 GDPR),
• rectify inaccurate or incomplete data (Art. 16),
• erasure ("right to be forgotten") under the conditions of Art. 17,
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent, if processing was based on it (without affecting the lawfulness of processing before withdrawal).

You can exercise your requests at info@sohe.cz. We will handle them without undue delay, at the latest within one month. To verify your identity, we may ask you for additional information.

If you believe that we are violating the GDPR in processing your data, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

10. Cookies

The website uses only necessary technical cookies; we do not use tracking or marketing cookies. Details can be found on the Cookies page.

11. Effectiveness and changes to these principles

These principles are effective from 19 June 2026. We reserve the right to update them in the event of changes to legislation or our practices; the current version is always available on this page.