Rules for Processing Personal Data

The controller in respect of personal data processing is:

(hereinafter referred to as the "controller").

The controller states that it processes all personal data exclusively in accordance with generally binding legal regulations (in particular pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"), and in accordance with Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts (hereinafter referred to as the "Act")), with the controller having taken appropriate technical, organizational and personnel measures so as not to jeopardize the security of the personal data processed. All entities that come into contact with personal data in the performance of their duties are bound by a legal or contractual duty of confidentiality.

Given that the protection of personal data is a constantly evolving process, the information provided to data subjects may change from time to time — in such cases, the controller reserves the right to change the conditions of personal data processing, and in the event of substantial changes, the controller will publish a notice on its website or notify changes by e-mail.

Purposes of personal data processing

Your personal data may be processed for the following purposes:

• Processing of personal data for the purposes of concluding a contract (purchase contract), delivery of goods/services, making payment, and fulfilment of other contractual obligations, in particular related to the exercise of rights under warranty.
  • Legal basis: processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Retention period: 10 years
• Processing of personal data for the purpose of handling claims arising from liability for defects.
  • Legal basis: processing is necessary to fulfil the controller's legal obligation under Act No. 250/2007 Coll. on Consumer Protection.
  • Retention period: 5 years
• Processing of personal data for the purposes of registry (records) administration.
  • Legal basis: Act No. 395/2002 Coll. on Archives and Registries and on the Amendment of Certain Acts, as amended.
  • Retention period: 5 years
• Processing of personal data for the purpose of proper bookkeeping.
  • Legal basis: processing is necessary to fulfil the controller's legal obligation under Art. 6(1)(c) GDPR and in accordance with Act No. 431/2002 Coll. on Accounting, as amended.
  • Retention period: 10 years
• Processing of personal data for the purpose of proper tax records.
  • Legal basis: processing is necessary to fulfil the controller's legal obligation under Art. 6(1)(c) GDPR, in accordance with Act No. 595/2003 Coll. on Income Tax, and Act No. 222/2004 Coll. on Value Added Tax, as amended.
  • Retention period: 10 years
• Processing of personal data for the purposes of legal disputes arising from the controller's business activity, or to enforce and defend the controller's legal claims.
  • Legal basis: processing is necessary to fulfil the controller's legal obligation under Art. 6(1)(c) GDPR and in accordance with the Code of Civil Procedure, the Code of Administrative Procedure, the Code of Enforcement, and the Bankruptcy and Restructuring Act.
  • Retention period: 5 years
• Records of exercised rights of data subjects under Act No. 18/2018 Coll. on the Protection of Personal Data and on the Amendment of Certain Acts, and under Regulation (EU) 2016/679.
  • Legal basis: processing is necessary to fulfil the controller's legal obligation under the GDPR and Act No. 18/2018 Coll. on the Protection of Personal Data.
  • Retention period: 5 years
• Processing of personal data for the purposes of direct marketing (the controller's marketing and advertising activities).
  • Legal basis: the controller's legitimate interest under Art. 6(1)(f) GDPR — the legitimate interest consists in improving the controller's sales results by sending marketing offers, including information about existing discounts.
  • Retention period: 5 years from the date of the data subject's last purchase from the controller

The data subject has the right to object to the processing of personal data for direct marketing purposes — in such a case, the controller will stop processing your personal data for that purpose.

Recipients or categories of recipients of personal data

We provide the data subject's personal data, to the necessary extent (in particular for the purpose of processing the order and fulfilling our legal obligations), to the following categories of recipients: delivery and courier companies, Slovenská pošta, a.s., the tax office, IT support providers, courts, bailiffs, and other public authorities, provided this is required by a specific law.

Requirement to provide personal data and possible consequences of not providing it

Where the provision of personal data for any of the above purposes is necessary for the performance of a contract, providing that personal data is a necessary part of the contractual relationship. Failure by the data subject to provide personal data will make it impossible to conclude the contract and fulfil the obligations arising from it.

Where the provision of personal data by the data subject is subject to a legal requirement, the data subject is obliged to provide such personal data, as otherwise it will not be possible to properly fulfil the controller's obligations under the relevant generally binding legal regulations.

Where personal data is processed on the basis of the data subject's consent, providing the personal data is voluntary, and the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal.

Transfer of personal data to a third country or an international organisation: not carried out.

Automated decision-making, including profiling: not carried out.

Rights of data subjects

In connection with the processing of personal data, the data subject has, in particular, the following rights:

1. Right of access to data (Art. 15 GDPR): the data subject has the right to obtain confirmation as to whether the controller processes their personal data, to access that data, to receive information about such processing, and to obtain copies of the personal data the controller holds about them.
2. Right to rectification (Art. 16 GDPR): the data subject has the right to have the controller correct inaccurate personal data concerning them without undue delay. Having regard to the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.
3. Right to erasure (Art. 17 GDPR): the data subject has the right to have the controller delete personal data concerning them without undue delay, if one of the grounds set out in Art. 17 GDPR applies.
4. Right to restriction of processing (Art. 18 GDPR): the data subject has the right to have the controller stop using their personal data under certain circumstances, as defined in Art. 18 GDPR.
5. Right to data portability (Art. 20 GDPR): the data subject has the right, under certain circumstances, to receive the personal data concerning them that they provided to the controller, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from the controller to which the data was provided.
6. Right to object (Art. 21 GDPR): the data subject has the right to object to the processing of personal data where the legal basis for processing is the controller's legitimate interest.
7. Automated individual decision-making, including profiling (Art. 22 GDPR): the data subject has the right not to be subject, in certain circumstances, to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
8. Right to withdraw consent (Art. 7 GDPR): where personal data is processed on the legal basis of the data subject's consent, the data subject has the right to withdraw that consent at any time. Consent may be withdrawn in the same way it was given, as well as in the following ways:
   • by e-mail sent to the controller's address;
   • by sending a written request to the controller's registered office address.

If a data subject believes their personal data has been processed unlawfully, or believes that any of the above rights have been violated, they may lodge a complaint with the supervisory authority — the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, tel.: +421/2/3231 3214, e-mail: statny.dozor@pdp.gov.sk.

This document is effective from [insert update date].