Personal data processing policies

Basic provisions

1. The personal data controller is XXX , sro, Company ID: XXX , with its registered office at XXX , entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert XXX (hereinafter referred to as the controller ). The personal data controller can be contacted in writing at the above address or by email at info@XXX.cz .
2. Personal data means all information about a natural person who has provided their personal data to the administrator based on a purchase contract, based on registration in the administrator's e-shop, or based on consent to the processing of personal data as part of subscribing to newsletters sent by the administrator.
3. The administrator has not appointed a data protection officer.
4. These Principles are issued in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR).

Scope of personal data processing

In connection with the provision of services and the sale of goods, the Administrator processes the following categories of personal data:

• academic degree
• first and last name
• business name
• ID number, VAT number
• e-mail
• phone
• fax
• permanent address
• registered office or place of business address
• billing address
• personal data obtained from Cookies

Purpose of personal data processing, legal grounds and periods of personal data processing

The scope of the data processed depends on the purpose of the processing. For some purposes, it is possible to process data directly on the basis of a contract, the legitimate interest of the Controller or on the basis of the law (without consent), for others only on the basis of consent.

Processing for the purpose of performance of a contract, compliance with legal obligations and legitimate interest

The provision of personal data necessary for the performance of the contract, the fulfillment of the Administrator's legal obligations and the protection of the Administrator's legitimate interests is necessary. Without the provision of personal data for these purposes, it is not possible to provide services or sell goods. Consent is not required for the processing of personal data for these purposes. The processing of personal data for the purpose of performing the contract and fulfilling legal obligations cannot be refused.

These are the following partial purposes:

• sale of goods or services (performance of contract)
• provision of electronic communications services, payment transactions, provision of other services (performance of the contract)
• billing for services (performance of contract)
• fulfillment of legal tax obligations (fulfillment of legal obligations)

In the case of personal data processed for the purpose of fulfilling a contract, the controller processes personal data for the duration of the contractual relationship and subsequently for a further 10 years, taking into account the length of a possible complaint, the limitation period for compensation for damage or injury.

Processing customer data with consent for marketing and business purposes

With the customer's consent, the Administrator processes personal data for marketing and business purposes. With the customer's consent for marketing and business purposes, the Administrator will process the customer's personal data primarily for sending email information about news (newsletter) in the product range or services.

Providing consent for marketing and business purposes is voluntary and the customer can revoke it at any time free of charge directly from the newsletter or by sending a request for deletion to the administrator's email. This consent remains valid for 10 years or until the customer revokes it. After the consent period has expired, it is possible to agree to an extension of the consent for another 10 years .

Processing of personal data of customers who register in the e-shop

With the customer's consent, personal data including name and surname, address, email and telephone number will be stored during registration. This functionality is used to facilitate repeated purchases. Consent can be revoked in writing to the administrator's address or by email and the registration data will be deleted.

Processing of cookies from websites operated by the company

If the subject has cookies enabled in their web browser, we process records of their behavior from cookies placed on websites operated by the Administrator, primarily for the purposes of ensuring better operation of the Administrator's websites, traffic statistics and for the purposes of the Administrator's online advertising - see below for more information.

After the personal data retention period has expired, the administrator deletes or anonymizes the personal data.

Categories of recipients of personal data

In fulfilling its obligations and obligations under the contracts, the Administrator uses professional and specialized services of other entities. If these suppliers process personal data transferred from the Administrator, they have the status of personal data processors and process personal data only within the framework of instructions from the Administrator and may not use them otherwise. A personal data processing contract is concluded with each such entity, in which the processor has strict obligations to protect and secure personal data. This applies in particular to the management of IT systems, online advertising, logistics services, providers of payment systems and gateways, accounting processing, tax consulting, and, if you consent, also your email and information about the purchase of Heuréka spol .

The administrator does not transfer personal data to third countries (to a country outside the EU) or to international organizations.

Your rights

Please note that you have the right to:

• the right to withdraw your consent at any time - in writing or by letter to the administrator's contacts listed above
• the right to correct or supplement personal data – the data subject has the right to have the controller correct or supplement inaccurate personal data without undue delay, pursuant to Article 16 of the GDPR
• the right to request restriction of processing – pursuant to Article 18 GDPR, in particular if the data subject disputes the accuracy of the processed personal data
• the right to object or complain to processing in certain cases - According to Article 21 of the GDPR, the data subject has the right to object to the processing of personal data if the processing is carried out on the basis of a legitimate interest, including processing for the purpose of direct marketing.
• the right to data portability – the subject has the right to obtain personal data concerning him or her, which he or she has provided to the controller, in a structured, commonly used and machine-readable format and to transmit them to another controller
• right to access personal data – the subject has the right to obtain information as to whether or not personal data is being processed and, if so, the right to obtain access to this personal information pursuant to Article 15 of the GDPR
• the right to file a complaint with the supervisory authority
• the right to erasure of personal data in certain cases
• other rights set out in the Personal Data Protection Act, the Personal Data Processing Act and the General Data Protection Regulation No. 2016/679 (GDPR).

Providing consent to the processing of personal data

The provision of personal data and consent to the processing of personal data are completely voluntary. The data subject is under no obligation to provide it and is not subject to any sanctions for failure to provide it.

However, if the data subject does not provide their personal data to the controller, it will not be possible to conclude a contract between the data subject and the controller or to properly perform it.

The consent given to the processing of personal data can be revoked at any time in writing at the address of the controller's registered office.

Personal data security

1. The administrator declares that it has taken all appropriate technical and organizational measures to secure personal data.
2. The administrator has taken all appropriate technical measures to secure data repositories and personal data repositories in paper form.
3. The administrator declares that only persons authorized by him have access to personal data.

Cookies

In order to ensure the functionality of the e-shop solution, the administrator uses so-called cookies, which are stored on the data subjects' devices. These cookies are used primarily to ensure the functionality of the e-shop solution, remarketing (Sklik retargeting, Adwords) and mapping the movement of data subjects on websites (traffic analysis using Google Analytics) . The data subject can refuse, manage and delete cookies using the settings in their internet browser or the Cookies (Consent) bar of the e-shop system.

The Controller's websites use (marketing) retargeting technology from the Sklik service operated by Seznam.cz, as, based in the Czech Republic. This allows the Controller to display the Controller's advertisements in the advertising network of Seznam.cz, as to website visitors who have already shown interest in the Controller's products.

Information obtained from Google Analytics cookies is anonymized.

The site is protected against form spam by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Advertising and statistical network cookies

Final provisions

1. By submitting an order or registering in our e-shop solution, the data subject (client) agrees to the above conditions and the processing of personal data.
2. As part of our activities, we process personal data without your consent based on the performance of a (purchase) contract, our legitimate interest or due to compliance with a legal obligation.

These terms and conditions come into effect on 25.5.2018