PhotonFlux s.r.o., with its registered office at Cimburkova 916/8, 130 00 Praha 3-Žižkov, Czech Republic, Company ID 21032769, is the controller of personal data collected through its online services under the domain photon-swap.com (the “Service” or the “Website”). As controller, PhotonFlux decides on the purposes and means of processing your personal data. A “User” is understood to be any natural person using the Service.

PhotonFlux has appointed a Data Protection Officer (“DPO”) who oversees compliance with data protection obligations. If you have any questions, requests, or concerns regarding the processing of your personal data, you may contact the DPO by email at [email protected].

We process Users’ personal data only where a lawful basis applies. The primary purposes include:

• Provision of services: Personal data are processed to enable the use of the platform photon-swap.com operated by PhotonFlux s.r.o. This constitutes processing that is necessary for the performance of a contract pursuant to Article 6(1)(b) GDPR.
• AML/CTF compliance: We are legally required to identify customers and perform checks under Act No. 253/2008 Coll., on certain measures against money laundering and terrorist financing (the “AML Act”). This processing is required by law under Article 6(1)(c) GDPR.
• Service optimization and security: Technical data such as IP addresses, browser types, operating system details, and usage logs may be processed to ensure IT security, generate usage statistics, and improve the Website. This processing relies on our legitimate interest under Article 6(1)(f) GDPR.
• Marketing activities: With your consent, we may send newsletters, offers, or updates. This processing is based on Article 6(1)(a) GDPR. In certain cases, we may rely on our legitimate interest in direct marketing, which falls under Article 6(1)(f) GDPR.
• Legal claims: Data may also be processed for the purpose of establishing, exercising, or defending legal claims, which is justified as a legitimate interest under Article 6(1)(f) GDPR.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

Your personal data may be shared with different categories of recipients where necessary:

• The Financial Analytical Office (FAÚ) and other competent authorities to fulfil obligations under the AML Act.
• Public authorities, courts, or regulators if required by law.
• Professional advisers and service providers such as IT, compliance, legal, or accounting firms, under contracts that ensure data protection.
• Group entities of PhotonFlux where internal operations require.
• International recipients outside the European Economic Area only if adequacy decisions of the European Commission apply or if appropriate safeguards under Articles 45 and 46 GDPR are implemented.

We retain data only for as long as necessary for the purpose for which they were collected. Data processed under the AML Act are kept for five years following the termination of the business relationship or the completion of an occasional transaction. Data gathered via cookies are stored for their technical lifecycle or until deleted by the User. Marketing data are retained until consent is withdrawn or you object to further processing. If data are needed in connection with disputes, they are retained until the proceedings are concluded and enforceable.

Under GDPR, you are entitled to a range of rights. You may request access to your personal data, request rectification of inaccurate or incomplete data, or request erasure where the conditions of Article 17 GDPR are met. You also have the right to restrict processing in certain cases and the right to data portability, meaning you can receive your data in a structured, commonly used, and machine-readable format and transfer them to another controller. You may object to processing at any time where the legal basis is legitimate interest, including processing for direct marketing. Where we rely on your consent, you may withdraw it at any time.

If you believe your rights have been violated, you may lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic (www.uoou.cz). We will respond to requests within one month, extendable by two additional months in complex cases.

Providing personal data is voluntary but may be necessary in certain circumstances. Without completing AML identification, it will not be possible to establish a business relationship with PhotonFlux. Without providing basic contact details, it may not be possible to use the Service or communicate with us effectively.

We may use data for profiling and automated decision-making in limited contexts, including the personalization of marketing communications and risk assessments under AML/CTF procedures. Users may object to profiling at any time.

The Website uses cookies and similar technologies to maintain its technical functionality, optimize performance, enhance security, collect usage statistics, and display advertising that is relevant to Users’ interests. Cookies may be temporary (session cookies) or persistent, remaining on your device until they expire or until you delete them. You may adjust your browser settings to block or delete cookies at any time; however, certain features of the Service may not function correctly if cookies are disabled.

This Privacy Policy may be updated from time to time to reflect changes in law, technology, or business practices. The updated version will always be available on the Website and will indicate its effective date.

If you have any questions, concerns, or requests concerning this Privacy Policy or your personal data, please contact us:

PhotonFlux s.r.o.
Cimburkova 916/8
130 00 Praha 3-Žižkov
Czech Republic
Email: [email protected]