1. Purpose of processing of personal data:
Personal data are processed for the purpose of ordering goods or services, or for the purpose of concluding a purchase contract between the controller and the customer, which also involves the subsequent making of payment, delivery of the goods or service, handling of any complaint and similar processes.
2. Lawfulness of processing of personal data:
Personal data are processed for the purposes of the performance of a contract on the basis of Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
3. Legal obligation of processing of personal data:
In the processing of personal data carried out for the purpose of concluding a purchase contract and related processes (such as making payment, delivery of the goods or service, handling of any complaint, etc.), the operator of the e-shop has obligations arising from the following legal regulations:
- Act No. 40/1964 Coll., the Civil Code,
- Act No. 513/1991 Coll., the Commercial Code,
- Act No. 222/2004 Coll. on Value Added Tax,
- Act No. 431/2002 Coll. on Accounting,
- Act No. 250/2007 Coll. on Consumer Protection and on amendments to Slovak National Council Act No. 372/1990 Coll. on Offences, as amended.
4. List of personal data:
Personal data are processed to the following extent:
- First name and surname,
- Contact details: e-mail and telephone number
- billing address,
- delivery address (if different from the billing address),
- payment method and whether the order has already been paid,
- method of delivery of the goods (courier/personal collection).
5. Data subjects:
The data subjects are the controller’s customers.
6. Storage periods of personal data:
The controller processes personal data for the period necessary to fulfil the purpose, but no longer than 3 years from the last activity on the account (except for data required to be archived for tax purposes, where the retention period is 10 years arising from legal obligations).
7. Legitimate interest of the controller:
Processing of personal data for the purposes of the legitimate interests of the controller is not carried out.
8. Transfer of personal data to third countries:
Personal data are not provided to third countries.
9. Technical and organisational security measures:
Organisational and technical measures for the protection of personal data are set out in the controller’s internal regulations. Security measures are implemented in the areas of physical and premises security, information security, cryptographic protection of information, personnel and administrative security and the protection of sensitive information, with precisely defined powers and responsibilities set out in the security policy.
10. Category of personal data:
Ordinary personal data.
11. Publication of personal data:
Personal data are not published.
12. Automated individual decision-making and profiling:
Not carried out.
13. Processor:
| External accountant | on the basis of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) |
| Digital Ocean, LLC | on the basis of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) |
14. Other authorised entity:
| Other authorised entity | Legal basis | Scope of personal data transferred to a third party |
|---|---|---|
| Public authorities | Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not, however, be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing. | Personal data to the extent requested by the authorised entity (e.g. the Police in the course of investigating offences or criminal offences) |
15. Recipient of personal data:
| Recipient of personal data | Legal basis |
|---|---|
| Slovak Parcel Service s.r.o. Senecká cesta 1, 900 28 Ivanka pri Dunaji Company ID: 31329217 | on the basis of a Forwarding Contract |
| GLS General Logistics Systems Slovakia s.r.o. Budča 1039, 962 33 Budča Company ID: 36624942 | on the basis of a Forwarding Contract |
16. Rights of the data subject
The data subject has the right to request from the controller access to the personal data processed about them, the right to rectification of personal data, the right to erasure or restriction of processing of personal data, the right to object to the processing of personal data, the right not to be subject to automated individual decision-making, including profiling, the right to data portability, as well as the right to submit a petition to initiate proceedings to the supervisory authority. Where the controller processes personal data on the basis of the data subject’s consent, the data subject has the right to withdraw their consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing of personal data based on consent before its withdrawal. The data subject may exercise their rights by sending an email to the controller’s address, or in writing to the controller’s address. The handling of data subjects’ rights is ensured individually through the responsible person (the person designated by the controller).
This document is a translation of the Slovak original. The Slovak version is the primary version and prevails in case of any discrepancies.
