Notice on the processing of personal data

 

This notice on the processing of personal data (hereinafter referred to as the “Notice”) has been prepared by Merch s.r.o., with its registered office at Slávičia 10, 903 01 Senec, ID No.: 47 608 803, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No.: 95409/B (hereinafter referred to as the “Company”) for the purpose of providing brief, transparent, intelligible and easily accessible information regarding the processing of your personal data.

 

1. Definitions of terms used

 

In accordance with the principle of transparency and intelligibility, for the purposes of providing information within this Notice, the Company uses the following terms:

 

  • Data subject means you, if the Company processes your personal data in the manner set out in this Notice;

 

  • GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

 

  • Portal means the web portal https://shop.prirodzenenajlepsi.sk, including all subdomains, subpages and components;

 

  • Act means Act No. 18/2018 Coll. on the protection of personal data and on amendments to certain acts, as amended;

 

 

2. General introduction

 

This Notice is prepared in accordance with Art. 13 and Art. 14 GDPR, Section 19 and Section 20 of the Act, and other generally binding legal regulations.

 

Given that the Company is a controller that processes your personal data, it would like to provide you with all necessary information regarding such processing.

 

The Company also uses cookies on the Portal. Some cookies may, among other functions, also obtain your personal data. In such cases, the Company is also the controller within the meaning of Art. 4(7) GDPR, or Section 5 letter o) of the Act, respectively. More information about cookies is available on the Portal.

 

In connection with the processing of your personal data, the Company has also designed and implemented standard and specific personal data protection, including appropriate technical and organizational measures, in order to ensure a high level of security of your personal data.

 

If you have any questions in connection with this Notice or the processing of your personal data or in connection with exercising your rights under the GDPR and the Act, you may contact the Company at any time:

  1. by post at the address: Merch s.r.o., Slávičia 10, 903 01 Senec;
  2. by email to the email address: info@shop.prirodzenenajlepsi.sk;

 

 

 3. Information on the processing of personal data

 

Below, the Company provides an overview of individual processing activities, as well as the personal data processed, the purpose of processing, the legal basis for processing, the retention period, and other information.

 

Processed personal data

Purpose of personal data processing

 

Legal basis for personal data processing

Personal data retention period

 

Statutory or contractual requirement and possible consequences of not providing personal data

 

Personal data necessary to ensure mutual communication - first name, last name, email, telephone contact and the content of communication.

 

Such communication may take place online (email, contact form, etc.), by telephone or via postal mail.

Ensuring communication (including sending, receiving and recording physical and electronic mail) between the Company and the Data subject.

Legitimate interest of the Company.

 

The Company’s legitimate interest is to ensure efficient and smooth communication with the Data subject.

For a period of 3 years from the last communication between the Company and the Data subject.

 

For a period of 10 yearsfrom the date of receipt or sending of paper mail.

Voluntary provision of data.

 

The Data subject may exercise their right to object to the processing of personal data under Art. 21 GDPR and Section 27 of the Act with the Company.

Personal data necessary for registration on the Portal and for creating and operating a user account – first name, last name, address of permanent or temporary residence, email and telephone contact.

Registration on the Portal and creating and operating a user account.

Pre-contractual negotiations and contractual obligation of the Company.

 

By registering on the Portal, the Data subject enters into a contractual relationship with the Company, the subject matter of which is the creation and operation of a user account.

For the duration of the user account and subsequently for the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Providing personal data is a contractual requirement.

 

Failure to provide personal data results in the Company being unable to enter into a contractual relationship with the Data subject, i.e., it will not be possible to create a user account.

Personal data contained in documentation that forms part of the registry -  first name, last name, signature, address of permanent or temporary residence, email, telephone number and other data under a special regulation or data contained in the relevant documentation.

Registry management.

Legal obligation of the Company.

 

The Company fulfills its legal obligations under Act No. 395/2002 Coll. and Decree No. 410/2015 Coll.

For a period of 10 yearsfrom the date the document is included in the registry.

Providing personal data is a legal requirement.

 

Failure to provide personal data results in a breach of obligations arising from legal regulations.

Personal data necessary for exercising the Company’s rights - first name, last name, address of permanent or temporary residence, date of birth and other personal data processed within individual proceedings.

 

The Company may exercise these rights through judicial and extrajudicial means.

Assertion of claims through judicial proceedings via courts, arbitration courts, enforcement offices, law firms, notary offices or via extrajudicial means.

Legal obligation of the Company.

 

The legal obligation consists in identifying the Data subject and the Company’s claim when asserting and enforcing rights.

 

Legal obligations arise from the following generally binding legal regulations: Act No. 40/1964 Coll., Act No. 513/1991 Coll., Act No. 160/2015 Coll., Act No. 233/1995 Coll., Act No. 244/2002 Coll., Act No. 162/2015 Coll. and Act No. 563/2009 Coll.

 

Legitimate interest of the Company.

 

If there is no legal obligation to process the Data subject’s personal data, but such personal data are necessary for asserting or enforcing the Company’s rights, the Company processes personal data based on legitimate interest.

 

The Company’s legitimate interest is the assertion of rights and their subsequent enforcement by lawful means.

For the duration of the limitation period or forfeiture period or for a period of 10 years from the final completion of the proceedings.

The Company processes the Data subject’s personal data on the basis of its legal obligation.

 

Failure to provide personal data results in the Company being unable to fulfill its legal obligations and, as a result, its rights in asserting claims are limited.

 

The Company processes personal data on the basis of legitimate interests because it has carried out a purpose compatibility test, whereby the original purpose for which it processed personal data is compatible with the purpose of asserting claims.

Personal data necessary for entering into a contractual relationship, ensuring communication between the contracting parties and proper performance of contractual obligations - first name, last name, email, telephone contact, job position and signature.

Entering into a contract, ensuring communication between the contracting parties and proper performance of contractual obligations.

 

The Company processes personal data of the Data subject who acts as the representative or contact person of the other contracting party (e.g., statutory representative, member of a statutory body, authorized signatory, proxy, contact person, etc.)

Legitimate interest of the Company.

 

The Company’s legitimate interest is entering into a contractual relationship, ensuring performance of its contractual obligations arising from the relevant contractual relationship, and ensuring communication between the contracting parties.

For the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Voluntary provision of data.

The Data subject may exercise their right to object to the processing of personal data under Art. 21 GDPR and Section 27 of the Act with the Company.

 

If the Data subject’s employer provides their personal data within a contractual relationship, Section 78(3) of the Act applies, under which the employer may provide such data.

Personal data necessary to contact the other contracting party, which is the Data subject - first name, last name, email, telephone number and other personal data stated in the contract or processed on the basis of the contract.

Entering into and performing a contract to which the Data subject is a contracting party (except for a consumer contract).

Pre-contractual negotiations and contractual obligation of the Company.

 

The contractual obligation arises from the Contract concluded with the Data subject.

For the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Providing personal data is a contractual requirement.

 

Failure to provide personal data results in the Company being unable to enter into a contractual relationship with the Data subject.

Personal data necessary for entering into a consumer contract - first name, last name, delivery address, email, telephone contact and order content.

Entering into a consumer contract.

 

If the Data subject wishes to purchase goods or services through the Portal, they enter into a consumer contract with the Company. To conclude this contract, the Company is obliged to process personal data.

Pre-contractual negotiations and contractual obligation of the Company.

 

The contractual obligation arises from the Contract concluded with the Data subject.

For the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Providing personal data is a contractual requirement.

 

Failure to provide personal data results in the Company being unable to enter into a consumer contractual relationship with the Data subject.

Personal data necessary for exercising the Data subject’s rights - first name, last name, email, telephone contact, the relevant personal data, the right exercised and other information.

Exercising the rights of Data subjects by means of a request.

Legal obligation of the Company.

 

The legal obligation consists in enabling the Data subject to exercise their rights via a request and subsequently dealing with the request.

 

Legal obligations arise from the following generally binding legal regulations: GDPR and the Act.

For a period of 5 years following the year in which the Data subject’s request was handled.

The Company processes the Data subject’s personal data on the basis of its legal obligation.

 

Failure to provide personal data results in the Company being unable to fulfill its legal obligations and therefore unable to handle the Data subject’s request.

Personal data necessary for keeping accounting and tax records -first name, last name, email and telephone contact and other data stated on the invoice.

Keeping accounting and tax records.

Legal obligation of the Company.

 

The Company fulfills its legal obligations arising in particular under Act No. 431/2002 Coll., Act No. 222/2004 Coll., Act No. 40/1964 Coll., Act No. 311/2001 Coll., Act No. 595/2003 Coll., Act No. 582/2004 Coll., Act No. 283/2002 Coll. and Act No. 563/2009 Coll.

For a period of 10 years following the year in which the personal data were processed for the first time.

Providing personal data is a legal requirement.

 

Failure to provide personal data results in a breach of obligations arising from legal regulations.

Personal data necessary to achieve the Company’s legitimate interest - first name, last name, telephone contact, email, call recording and other personal data provided within communication.

Improving calls and services provided through the call center.

Legitimate interest of the Company.

 

The Company’s legitimate interest is ensuring an effective way of providing help and assistance as well as making service provision more efficient.

For a period of 1 month from the creation of the audio recording.

Voluntary provision of data.

 

The Data subject may exercise their right to object to the processing of personal data under Art. 21 GDPR and Section 27 of the Act with the Company.

 

Personal data necessary to participate in a contest - first name, last name, social network profile, delivery address, information about being selected, and the content of a comment on the social network (photograph, text or audiovisual recording).

Organization of the contest.

 

If the Data subject participates in the contest, they enter into a contractual relationship with the Company, the subject matter of which is participation in the contest and delivery of the prize if the contest conditions are met.

Pre-contractual negotiations and contractual obligation of the Company.

 

For the duration of the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Providing personal data is a contractual requirement.

 

Failure to provide personal data results in the Data subject being unable to participate in the contest.

Personal data necessary for receiving and handling a complaint -first name, last name, address of permanent or temporary residence, the complained-about goods or service and other data stated in the complaint.

Receiving and handling complaints.

 

The Company is obliged to receive, process, handle and keep records of complaints.

Legal obligation of the Company.

 

Legal obligations arise from the following generally binding legal regulations: Act No. 40/1964 Coll., Act No. 250/2007 Coll. and Act No. 102/2014 Coll.

For the duration of the limitation period or forfeiture period applicable to the Company’s claims arising from the contractual relationship.

Providing personal data is a legal requirement.

 

Failure to provide personal data results in a breach of obligations arising from legal regulations.

 

 

4. Rights of Data subjects

 

In connection with the processing of personal data, you, as a Data subject, have the rights listed below, which you may exercise with the Company at any time in the form of a request. In such a case, the Company is obliged to provide the Data subject with information on the measures taken on the basis of their request without undue delay, and in any event within 1 month. The Company may extend this period by a further 2 months; in such case, it shall inform the Data subject of any such extension within 1 month of receipt of the request, together with the reasons for the delay.

 

The rights of the Data subject listed below are not absolute in every case and statutory exceptions under the GDPR or the Act may apply to their exercise. It also applies that different rights apply to different processing activities.

 

  • Right of access (Art. 15 GDPR or Section 21 of the Act)

 

The Data subject has the right to obtain confirmation as to whether the Company processes their personal data and, where that is the case, the right to access such personal data. The Data subject also has the right to be provided with all information within this Notice, while the Company regularly updates this Notice.

 

  • Right to rectification (Art. 16 GDPR or Section 22 of the Act)

 

The Data subject has the right to have personal data that the Company processes about them rectified without undue delay. The Data subject also has the right to have incomplete personal data completed.

 

  • Right to erasure/forgetting (Art. 17 GDPR or Section 23 of the Act)

 

The Data subject has the right to have personal data that the Company processes about them erased without undue delay. However, the right to erasure is not absolute and at least one of the grounds under Art. 17(1) GDPR and Section 23(2) of the Act must be met, or the Company is not obliged to erase such personal data in the cases set out under Art. 17(3) GDPR and Section 23(4) of the Act.

 

  • Right to restriction of processing (Art. 18 GDPR or Section 24 of the Act)

 

The Data subject has the right for the Company to restrict the processing of their personal data under the conditions set out under Art. 18 GDPR and Section 24 of the Act.

 

  • Right to data portability (Art. 20 GDPR or Section 26 of the Act)

 

The Data subject has the right to receive the personal data they have provided to the Company in a structured, commonly used and machine-readable format and has the right to transmit those personal data to another controller, if they provided their personal data on the basis of consent and such personal data are processed by the Company by automated means.

 

  • Right to object (Art. 21 GDPR or Section 27 of the Act)

 

The Data subject has the right to object to the processing of personal data that the Company processes about them, where such processing is carried out on the legal basis of performing a task carried out in the public interest or for the legitimate purposes of the Company or third parties, including objecting to profiling based on those legal bases. The Data subject also has the right to object to the processing of personal data that the Company processes about them for direct marketing purposes, including profiling.

 

  • Rights related to automated individual decision-making including profiling (Art. 22 GDPR or Section 28 of the Act)

 

The Data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces effects concerning them or similarly significantly affects them.

 

  • Right to submit a proposal to initiate proceedings (Section 100 of the Act)

 

The Data subject has the right to submit a proposal to initiate personal data protection proceedings under Section 100 of the Act to the supervisory authority if they believe that the Company processes their personal data in violation of the GDPR or the Act.

 

The Data subject may submit a proposal to initiate proceedings to the Office for Personal Data Protection of the Slovak Republic, with its registered office at Hraničná 12, 820 07 Bratislava. More information is available on the web portal of the Office for Personal Data Protection of the Slovak Republic.

 

  • Right to withdraw consent (Art. 7 GDPR or Section 14 of the Act)

 

If personal data are processed on the legal basis of the Data subject’s consent, the Data subject has the right to withdraw their consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

 

You can withdraw your consent at any time by sending an email to: info@shop.prirodzenenajlepsi.sk

 

 

5. Sources of personal data collection

 

The Company primarily obtains personal data directly from Data subjects. In some cases, however, Data subjects are not directly in contact with the Company and in such cases the Company obtains personal data from other sources, namely:

 

  • publicly available sources in which the Data subject’s personal data are stated;
  • another person who provides the Company with the Data subject’s personal data – in such a case, the providing person is obliged to have the Data subject’s consent under Section 78(6) of the Act;

 

 

6. Recipients of personal data

 

The Company may also provide the personal data of Data subjects to other natural or legal persons, public authorities or international organizations.

 

When providing the personal data of Data subjects, the Company ensures the highest possible level of personal data protection; when providing personal data to its processors or a joint controller, it has a contractual relationship in accordance with Art. 26 or Art. 28 GDPR, or Section 33 or Section 34 of the Act, respectively.

 

The Company provides the personal data of Data subjects to the following categories of recipients or public authorities:

  • controlling or controlled entities and other entities in the horizontal or vertical hierarchy of the Company’s organizational structure;
  • business partners;
  • providers of legal, accounting, tax, consulting, IT or other services;
  • expert witness, authorized, notified and accredited person or a person authorized to carry out warranty repairs;
  • Slovenská pošta, a.s., courier companies and transport companies;
  • public authorities.

 

 

7. Personal data retention period

 

In addition to the specified retention period for individual personal data under point 3 of this Notice, the Company may retain the personal data of Data subjects for a longer period if it is necessary to retain personal data for longer than the specified period due to the Company’s legitimate interests or due to changes in its legal obligations.

 

 

8. Transfer of personal data to third countries or to international organizations

 

The Company may transfer the personal data of Data subjects to other third countries or to international organizations. In the event of any transfer of personal data to third countries or to international organizations, the Company always undertakes to ensure an adequate level of protection of the personal data of Data subjects.

 

The Company does not transfer personal data to other third countries or to international organizations.

 

 

9. Automated individual decision-making including profiling

 

The Company does not use automated individual decision-making including profiling when processing the personal data of Data subjects.