Privacy policy

Effective from 19 October 2026

This policy explains how we process personal data in the Water Element B2B portal. The portal consists of the shared portal at elements-distribution.com, where partners register and sign in, and the portals of the individual brands: Werner (werner.elements-distribution.com), Elements Gear (elements.elements-distribution.com) and further brands we will launch over time (together the "portal"). The portal is intended exclusively for business partners such as shops, online stores, rental companies, schools and clubs, for ordering goods at wholesale prices. The policy applies to registration applicants, to contact persons of partners, to other persons whose contact details a partner gives us (for example the owner or a sales representative), and to partners who are self-employed individuals.

A partner registers only once for all brands. We keep one shared record of the partner, with one sign-in for all brands. The brands a partner ticks during registration are only a request: our staff always decide which brands the partner can access. For each brand we then keep only what concerns that brand: access, the assigned price list, carts, orders and turnover. Once a brand is approved, we copy the partner's company details, billing and delivery addresses and sign-in e-mail into that brand's portal so that it can show prices and handle orders; bank details, other contacts, the premises address and documents stay only in the shared record.

1. Controller

Water Element, s.r.o. Registered office: Veslařská 1351/26, Komín, 624 00 Brno, Czech Republic Company ID (IČO): 28345312, VAT ID: CZ28345312 Registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 62707 E-mail: info@elements-distribution.com

For any data protection matter, write to info@elements-distribution.com. We have not appointed a data protection officer because we are not required to.

2. What personal data we process

Registration data: – company: name, company ID or registration number, whether it is a VAT payer, VAT ID, billing address (registered office) with country, premises address if it differs from the registered office, website and note, – contacts: the contact person's name, e-mail addresses and phone numbers, each with whom it belongs to (shop, owner, sales representative, purchasing or other) and optionally that person's name, and the billing e-mail and phone, – delivery addresses: one or more, each optionally with a label, a recipient, a contact person and a phone number for the carrier; if you choose delivery to the billing address, we use the contact person's name and the first phone number given as the contact for the carrier, – the brands you request, – bank details, if you provide them: account number, or IBAN and BIC, – documents, if you upload them: for example an extract from the commercial register, a trade licence or photos of the shop (JPG, PNG, WEBP or PDF files), – the language in which you submitted the registration and the time you confirmed that you acknowledge this policy, – the progress of the registration: the registration record with a copy of the data from the form (without the password), the time the e-mail address was verified, the status, who decided on the registration and when, and the reason for any rejection, which we also send you by e-mail. We pre-fill the currency according to the country of the billing address. For a self-employed individual, the company data are personal data as well.

Only our staff can see the documents. We store them as you upload them, i.e. including the metadata the file contains (for photos taken with a phone, for example the place and time the photo was taken and the device type; for PDFs, for example the author's name). Please remove any metadata you do not want to pass on to us before uploading. We do not need a personal identification number or a copy of an identity document to review a company; you may black out such data before uploading.

E-mail verification: before you fill in the form, we send a six-digit verification code to the e-mail address you entered; the code is valid for 15 minutes. In the verification record we store the code, the e-mail address and the IP address only as keyed fingerprints (HMAC) from which the data cannot be derived without the secret key; we delete these records after 24 hours, at the latest within 48 hours. The recipient of the verification e-mail is also kept in the e-mail log and the IP address of the verification in the audit trail, even if you never submit the registration; their periods are stated in section 6. The verified e-mail address then becomes your sign-in name.

Sign-in account: a partner has one sign-in account for all brands, with no roles and no further users. The sign-in name is the main e-mail address, i.e. the first e-mail address given in the registration. With the account we store the contact person's name, the first phone number given, the language, the e-mail notification settings and the time of the last sign-in. You set the password already during registration; we store it only as a fingerprint (argon2id algorithm) from which the password cannot be derived. The account may be used by anyone the partner authorises, so we do not distinguish the individual persons using it.

VAT ID check: from 26 October 2026 we check the VAT IDs of partners from EU member states, including Czech ones, in the VIES system operated by the European Commission, including for registrations submitted before that date. Only our staff see the result (valid, invalid, not verified) and the company name and address according to the register. An invalid VAT ID does not stop the registration; our staff will resolve it with you.

Brand data: for each brand, the access status (requested, granted, rejected or withdrawn), the reason and time of the decision, and the assigned price list (price level) with its change history.

Business data: carts (name and items; the portal automatically records who created the cart and who added an item), orders and pre-orders (items, prices, billing and delivery address including contact person and phone, your order number, note, requested delivery date), the change history of orders, messages on orders and claims and their attachments, claims including photos, invoices and other documents, shipments and tracking numbers, favourite products, saved lists and stock alerts. We store claim photos without EXIF metadata (for example without location data).

Technical and security data: – IP address and browser information for each sign-in (session), – audit trail: a record of important actions (for example sign-in, e-mail verification, submission of the registration or its refusal by the form, upload of documents, order submission, change of settings) with the time, the user and the IP address, – proof of acceptance of the terms and conditions: user, version of the terms, language, time and IP address, – a fingerprint of the IP address and e-mail used to limit the number of attempts to sign in, reset a password or register, – a log of e-mails sent: recipient, subject, content, status and time sent. One-time links (for example for setting a password) and verification codes are not readable in this log.

Where the data come from: from you, i.e. from the registration and from later changes. Exceptionally, we created the partner record ourselves based on our existing business relationship. We obtain the result of the VAT ID check from the VIES system. Technical data arise when the portal is used.

Data of other persons, for example the owner, a sales representative or a contact person for the carrier, are provided to us by the partner. The partner may give only data we need for the cooperation and should inform these persons that their data have been passed on to us, for example by referring them to this policy.

3. Why we process the data and on what legal basis

Registration, e-mail verification, creation of the sign-in account and handling of the registration: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Review of the partner before approval (company data, documents, VAT ID check in VIES, check whether the company is already registered with us): legitimate interest in trading only with verified businesses, applying VAT correctly and preventing fraud (Art. 6(1)(f) GDPR).

Keeping rejected and undecided registrations for 6 months (section 6): legitimate interest in handling any questions about or objections to the rejection and in defending legal claims (Art. 6(1)(f) GDPR).

Account management and business cooperation, i.e. sign-in, access to brands, the catalogue with your prices, carts, orders and pre-orders, delivery, invoices, claims, downloads, messages and transactional e-mails (for example confirmation of the registration, approval, order confirmation, shipment, new invoice): performance of a contract (Art. 6(1)(b) GDPR).

We use the bank details only for any refunds: performance of a contract (Art. 6(1)(b) GDPR). After approval, only our staff can change them, so that nobody can change them fraudulently.

If you are a contact person of a legal entity or a person whose contact details the partner gave us (for example the owner, a sales representative or a contact person for the carrier), the contracting party is the partner, not you personally. We therefore process your data for the same purposes on the basis of our legitimate interest in communicating and cooperating with our business partner (Art. 6(1)(f) GDPR).

Accounting and tax obligations, in particular the billing details on documents (name, registered office, company ID, VAT ID, billing address) and keeping records: compliance with a legal obligation (Art. 6(1)(c) GDPR).

Security of the portal and prevention of misuse (sessions, audit trail, attempt limits, protection of registration against bots, e-mail log): legitimate interest in secure and reliable operation and in being able to trace who did what in the portal and when (Art. 6(1)(f) GDPR).

Proof of acceptance of the terms and conditions, and establishing or defending legal claims: legitimate interest (Art. 6(1)(f) GDPR).

Support: our staff can view the portal as you see it in order to help you. In this mode they change a cart only after confirming it; every such action is recorded and you see the change in the cart history. Legal basis: performance of a contract, or legitimate interest for contact persons of legal entities.

Informational e-mails (news and announcements about products, deadlines and terms): legitimate interest in informing existing business partners (Art. 6(1)(f) GDPR). You can refuse them at any time by e-mail to info@elements-distribution.com and, once ordering starts, also in your profile (see Right to object in section 7). Transactional e-mails about orders and your account cannot be switched off.

Neither registration nor use of the portal is based on consent to the processing of personal data. By ticking the box in the form you only confirm that you have read this policy. We need the data marked as mandatory in the form to process the registration and to conclude and perform the contract; without them we cannot accept the registration. Bank details, documents, website, note, premises address, the billing phone, the label, recipient, contact person and phone of a delivery address, the names at contacts and further contacts are optional.

4. Who receives the data

Processors who process data for us on our instructions: – server (VPS) provider: Váš Hosting s.r.o., Company ID 24742252, Zbožská 1385/40, 288 02 Nymburk, Czech Republic; servers in the Czech Republic – e-mail service provider through which the portal sends e-mails: WebStep s.r.o., Company ID 25528262, Celní 17/5, 639 00 Brno, Czech Republic – off-site backup storage provider: Backblaze, Inc. (USA), Backblaze B2 service; we store the backups in its data centre in the EU and encrypt them before upload, so the provider cannot read their content

Other recipients: – carriers: delivery address, contact person and phone to the extent necessary to deliver the shipment; for delivery outside the European Economic Area, also carriers and customs authorities in the country of destination (section 5), – our order and stock processing system (MRP), to which accepted orders are transferred together with the customer's details (name, company ID, VAT ID, country, billing and delivery address including contact person and phone) and the name, e-mail address and phone of the sign-in account, – our external accountants, tax advisers and auditors, if we use their services: data from accounting and tax documents to the extent necessary for their work, – the European Commission, which operates the VIES system, and through it the tax administration of the state that issued the VAT ID: the VAT ID when it is checked (from 26 October 2026, including for registrations submitted before that date), – public authorities where required by law.

Within our company, only authorised staff have access to the data, according to their roles.

Services that receive no personal data: product texts can be machine-translated by DeepL, but only product names and descriptions are sent. We load the product catalogue from an online store on the Shoptet platform; partner data are not transferred to Shoptet. Fonts and product photos are served by the portal itself, so your browser does not load content from third parties while you work in the portal.

5. Transfers outside the EU

We process personal data in the EU: the portal's servers are in the Czech Republic and backups are stored encrypted in a data centre in the EU. The backup storage is provided by the US company Backblaze, Inc.; however, we encrypt the backups before upload, so the provider cannot read their content. The VAT ID check in VIES takes place within the EU.

Partners may be based in, or have delivery addresses in, European countries outside the European Economic Area (for example the United Kingdom, Switzerland, Ukraine or the Western Balkans). When we deliver goods to such a country or a partner is based there, we pass the delivery data (delivery address, contact person and phone) to the carrier and, for customs clearance, to the customs authorities in that country only to the extent necessary to perform the contract (Art. 49(1)(b) and (c) GDPR). For Switzerland, the United Kingdom, Andorra and the Faroe Islands, the European Commission has decided that they ensure an adequate level of data protection (Art. 45 GDPR). We make no other transfers outside the EEA or to international organisations.

6. How long we keep the data

– Verification code and fingerprints of the e-mail and IP address from e-mail verification: deleted after 24 hours, at the latest within 48 hours. – Fingerprint of the IP address and e-mail for attempt limits: usually 24 hours. – Registration and partner data (company, contacts, addresses, bank details, requested brands, documents, result of the VAT ID check and the sign-in account): after approval, for the duration of the business relationship. – Rejected registration: we remove the sign-in account immediately upon rejection (we delete the password and the sign-in), so you can no longer sign in. We delete the other registration data, including the main e-mail address among the contacts, the reason for the rejection and the documents, 6 months after the rejection. The e-mail log and the audit trail have their own periods stated below. – A registration we have not decided on and from which no active partner was created is deleted, together with its documents, 6 months after it was submitted. This also applies to a registration only for a brand we are still preparing. – Exceptionally, a rejected or undecided registration is referred to by a record we must keep (for example an order, a claim or a record of an action by our staff). In that case we delete the documents, the copy of the form data and the reason for the rejection, but the company data and contacts remain together with that record. – You can withdraw your registration at any time by e-mail to info@elements-distribution.com; at your request we delete it without undue delay, even before the periods above have expired. – After the cooperation ends, we anonymise the partner's data at your request without undue delay, and otherwise 3 years after the cooperation ends, i.e. after your last order (if you have never ordered, after the approval of the registration) or after the closure of the account if that happens later. We keep only data for which a longer period applies below, in particular the accounting and tax documents that the law requires us to keep for 10 years, and orders and claims; the audit trail, the e-mail log and backups also have their own periods. – Orders, invoices, claims and related communication: for the period required by accounting and tax law, usually 10 years from the end of the year in which the supply took place. – Proof of acceptance of the terms and conditions (version, language, time): for as long as the account exists; once the account is anonymised, it remains without any link to you. We remove the IP address from it after 12 months. – Audit trail: 3 years from the record; we remove IP addresses from it after 12 months. – Sign-in data (IP address and browser): while you are signed in and then 30 days after the sign-in expires. One-time links for setting a password and for switching portals: 30 days after use or expiry. – E-mail log: e-mail content for 90 days after sending; recipient, subject, status and time sent for 24 months. – Carts: for as long as the account exists; the portal deletes an empty cart by itself, usually after 10 days. A submitted cart becomes an order, for which the periods above apply. – Access to brands and assigned price lists with their change history: for the duration of the business relationship. We keep the history of assigned price lists after that as well; once the partner is anonymised, it remains without any link to you. – Favourite products, saved lists and stock alerts: for as long as the account exists. – Server logs (web server logs with IP address and requested URL): 14 days; application logs are overwritten by size (usually within a few weeks). – Backups: data are kept in backups for no longer than approximately 12 months (daily, weekly and monthly backups) and then overwritten. Deleted or anonymised data may therefore remain for this period in backups, which are used only for disaster recovery.

7. Your rights

You have the right: – of access to your personal data and to a copy of them (Art. 15 GDPR), – to rectification of inaccurate data (Art. 16 GDPR); you can change e-mail addresses, phone numbers, delivery addresses and the premises address yourself in the profile, which will be added when ordering starts, and our staff update the other data at your request, – to erasure (Art. 17 GDPR), unless we need the data to comply with a legal obligation or to establish or defend legal claims; in that case we anonymise the partner's data, – to restriction of processing (Art. 18 GDPR), – to portability of data you have provided to us and that we process by automated means on the basis of a contract, in a machine-readable format (Art. 20 GDPR), – to object to processing based on legitimate interest, including informational e-mails (Art. 21 GDPR), see below.

You can exercise your rights by e-mail to info@elements-distribution.com. We will reply without undue delay and within one month at the latest; in complex cases we may extend this period by a further two months and will inform you if we do. We may verify your identity before handling your request.

You also have the right to lodge a complaint with a supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz, or the supervisory authority in the EU member state where you live or work.

Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR, section 3). We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. You may object to receiving informational e-mails at any time and without giving reasons; we will then stop sending them to you. Send your objection by e-mail to info@elements-distribution.com.

8. Cookies and browser storage

The portal uses only cookies that are necessary for it to work and for settings you choose yourself. We do not use analytics, advertising or other tracking cookies, and we do not use third-party cookies. This is why the portal shows no cookie consent banner. These cookies are necessary to provide the service you explicitly request (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications).

– __Host-b2b_session: keeps you signed in; ends when you sign out, at the latest 14 days after sign-in. – locale: the portal language you chose; created only when you switch the language; valid for 1 year. – theme: the light or dark appearance you chose; created only when you change the appearance; valid for 1 year. – display_currency: the currency you chose for displaying prices; created only when you switch the currency; valid for 1 year.

Each address of the portal (the shared portal and the portal of each brand) stores its cookies separately.

In the browser's local storage (localStorage) the portal remembers your chosen catalogue view, the products selected for comparison and whether you have completed the introductory tour. These data stay in your browser.

You can delete cookies and local storage in your browser settings at any time. Without the sign-in cookie, however, the portal cannot be used.

9. Automated decision-making

Registrations are always reviewed by a person, and access to brands is always set by our staff. The result of the VAT ID check in VIES only serves our staff as supporting information. The form automatically refuses a registration if a company with the same company ID or VAT ID is already registered with us; in that case, write to info@elements-distribution.com and we will look into it.

Price level: the portal adds up the turnover of your orders for each brand. For partners we approve in the shared portal, our staff set the price level manually. Until we abolish automatic price levels (planned for 1 November 2026), a brand portal may recalculate the price level by itself based on turnover for a partner in automatic mode, after an order is submitted or changed and every night. If you disagree with a price level recalculated in this way, write to info@elements-distribution.com and our staff will review it. Once the automatic levels are abolished, price levels are assigned only by our staff.

Apart from this, we do not take decisions about you based solely on automated processing within the meaning of Art. 22 GDPR.

10. Security

The portal runs only over an encrypted connection (HTTPS). We store passwords, access links and verification codes only as fingerprints. The shared partner register and the data of the individual brands are technically separated from each other, as are the data of individual partners. Only authorised staff have access to data according to their roles, important actions are recorded and data are backed up regularly.

11. Changes to this policy

We may update this policy, in particular when portal features or processors change. The current version is always available in the portal footer and via the link in the registration form.