INFORMATION ON THE PROCESSING OF PERSONAL DATA
1. GENERAL INFORMATION ON THE PROCESSING OF PERSONAL DATA (hereinafter referred to as "PD").
TopDizajn s.r.o., Karpatské námestie 10, 831 06 Bratislava, registered in the Commercial Register of the District Court Bratislava I, Section Sro, File No. 100146/B, Company ID No.: 47 876 051 (hereinafter referred to as the “Controller”).
We comply with the applicable rules, and therefore the protection of your PD is important to us. We process PD in accordance with these terms and conditions.
By granting consent to the processing of PD in our e-shop, you provide the Controller with a serious and freely given, specific, informed and unambiguous indication of the data subject’s (buyer’s) wishes in the form of a clear affirmative action, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as pursuant to Act No. 18/2018 Coll. of 29 November 2017 on Personal Data Protection and on Amendments and Supplements to Certain Acts, as amended (hereinafter referred to as the “GDPR and the ACT”).
2. PURPOSE OF PROCESSING PD
If you have provided us with PD, it will be used for the following purposes:
2.1 E-shop – for the conclusion and performance of the purchase agreement, payment processing, product delivery and, where applicable, the performance of other related activities (such as complaint handling and other obligations arising from consumer-protection legislation) under an agreement concluded through our e-shop between the Controller and the buyer. To process your order, you have provided us with the following data: first name, surname, address, e-mail address and telephone number. The e-mail address and telephone number are also used as means of communication.
An order confirmation will be sent to your e-mail address, and you will also be able to track the status of your order.
We process personal data on the following legal basis (Article 6 /1/b of the GDPR and the ACT). The processing of personal data is necessary for the performance of a contract to which the data subject (buyer) is a party, or in order to take steps at the request of the data subject (buyer) prior to entering into a contract (Section 2.1), i.e. this is a contractual requirement.
2.2 Marketing – for marketing purposes, provided that you have granted your consent to the Controller by subscribing to the newsletter. Marketing purposes include sales promotion, marketing offers, newsletters, and information about products and news. If the customer no longer wishes to receive these offers, they may simply unsubscribe in their account or by using the link at the end of the informational e-mail.
The Controller processes PD on the basis of the data subject’s consent (Article 6/1/a of the GDPR and the ACT).
3. Registration
The buyer may register on the website. The buyer may also make purchases without registration.
If you decide to shop using a registered account, we will process your PD as follows:
Your account is protected by a password. By logging into your account, you can obtain information about your orders, edit your PD and change your newsletter subscription settings. Please protect your password; the Controller is not responsible for any misuse of the password.
If you have registered, you agree that your user behaviour on this website may be associated with your customer account so that we can provide you with personalised content (e.g. special promotions and information).
If you change your mind and no longer wish to remain registered, you may delete your registration in your account. You may shop in our e-shop at any time as an unregistered buyer, i.e. as a guest.
4. THIRD PARTIES
Your personal data may be provided to third parties. During order processing and the performance of the purchase agreement, data may also be provided to third parties such as transport companies, couriers, banks and similar entities. The buyer’s PD is processed solely for the purpose of performing the agreement and for the period necessary for that purpose, as specified in more detail in Section ... Processing Period.
5. PERSONS UNDER 16 YEARS OF AGE
In connection with the provision of information-society services, the Controller lawfully processes personal data on the basis of the data subject’s consent where the data subject has reached the age of 16. This e-shop is not directly intended for persons under 16 years of age.
The Controller does not process PD of persons under 16 years of age. During each registration/login, the Controller requests a solemn declaration from the buyer. This e-shop is not intended for purchases by persons under 16 years of age.
6. PROCESSING PERIOD
The buyer consents to the processing of personal data from the date on which consent is granted under these terms and conditions for a period of up to 10 years for the purpose of performance under the agreement referred to in Section 2.1.
The buyer consents to the processing of personal data from the date on which consent is granted under these terms and conditions for a period of up to 3 years for the purpose of the marketing activities referred to in Section 2.2.
7. TRANSFER TO A THIRD COUNTRY
The Controller does not intend to transfer PD to a third country or an international organisation, including the identification of such country or international organisation.
8. AUTOMATED PROFILING
The Controller processes PD in electronic form. The Controller does not use automated individual decision-making, including profiling, pursuant to Article 4(4).
Consent is not required for the basic collection of statistical data, for example through the use of Google Analytics tracking code.
9. IP ADDRESS
It is a set of numbers that uniquely identifies a device on a computer network.
From the perspective of personal data protection, an IP address may be regarded as data relating to an identifiable person.
An IP address becomes personal data if:
- the IP address is processed by an internet service provider together with other identifying information (name, e-mail address, etc.).
- static IP addresses used by natural persons/individuals must be regarded as personal data.
- a dynamic IP address will be regarded as personal data where an online service provider processes, together with the dynamic IP address, other identifiers considered to be personal data (e.g. first name, surname, e-mail address, etc.).
10. SECURE DATA TRANSMISSION
Your personal data is transmitted securely through encryption. SSL (Secure Socket Layer) encryption is most commonly used for secure communication with web servers. Personal data in our systems, as well as the website itself, is protected by appropriate technical and organisational measures against loss, destruction, alteration and further disclosure of data by unauthorised persons.
If you are registered on our website, only you have access to your account; therefore, please ensure that you handle these details confidentially. The Controller is not responsible for unauthorised use or misuse of the password.
11. RIGHTS OF THE DATA SUBJECT (BUYER)
Under the GDPR, the buyer has (I.) the right to rectification, (II.) the right to erasure, (III.) the right to data portability, (IV.) the right to object, (V.) the right to withdraw consent and (VI.) the right of access to information.
I. Right to rectification
The buyer has the right to have the Controller rectify without undue delay inaccurate PD concerning them and to have incomplete PD completed.
II. Right to erasure
The buyer has the right to have the Controller erase PD concerning them without undue delay. The Controller is obliged to erase such PD without undue delay where one of the following grounds applies:
- the PD is no longer necessary for the purpose for which it was collected or processed,
- the data subject withdraws consent to the processing of PD for at least one specific purpose, or the data subject withdraws consent to the processing of PD for at least one specific purpose; consent is invalid where its granting is excluded by a special regulation,
- the data subject objects to the processing of PD and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing of PD where it concerns direct marketing, including profiling,
- the PD has been processed unlawfully,
- erasure is required in order to comply with an obligation under this Act, a special regulation or an international treaty by which the Slovak Republic is bound, or
- the PD was collected in connection with the offer of information-society services,
- the data subject is under 16 years of age.
Where the Controller has made PD public and is obliged to erase it, the Controller is also obliged, taking account of available technology and the cost of implementation, to take appropriate security measures, including technical measures, to inform other controllers processing the data subject’s PD of the data subject’s request that they erase any links to, or copies or reproductions of, such PD.
III. Right to data portability
The buyer has the right to receive the PD concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format, and has the right to transmit that PD to another controller – seller, where technically feasible and where:
- the PD is processed on the basis of the data subject’s consent, on the basis of a contract and on the basis of the data subject’s consent, which is invalid where its granting is excluded by a special regulation,
- the processing of PD is carried out by automated means.
IV. Right to object
The buyer has the right to object to the processing of PD concerning them for direct-marketing purposes, including profiling to the extent that it is related to such direct marketing. The Controller is obliged to explicitly draw the data subject’s attention to this right no later than at the time of the first communication with them, and information about this right must be presented clearly and separately from any other information. The buyer may exercise the right to object by automated means using technical specifications.
V. Withdrawal of consent
The buyer has the right to withdraw consent to the processing of personal data concerning them at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; the buyer must be informed of this fact before giving consent. The buyer may withdraw consent in the same manner in which it was granted.
VI. Right of access to information
The buyer has the right to obtain confirmation from the Controller as to whether PD concerning them is being processed. Where the Controller processes such PD, the buyer has the right to access that PD and to obtain information about:
- the purpose of processing the PD,
- the category of PD being processed – in our case, this is ordinary PD; the Controller does not process any special category of PD.
- the identity of the recipient or the category of recipients to whom the PD has been or will be disclosed, in particular recipients in a third country or an international organisation, where possible,
- the period for which the PD will be stored or, where this is not possible, the criteria used to determine that period,
- the right to request from the Controller rectification of PD concerning the buyer, its erasure or restriction of its processing, or the right to object to the processing of PD,
- the right to lodge a motion to initiate proceedings,
- the source of the PD, where the personal data was not obtained from the buyer,
- the existence of automated individual decision-making, including profiling; in such cases, the Controller shall provide the buyer in particular with information about the procedure used, as well as the significance and envisaged consequences of such processing of PD for the buyer.
On the basis of such a request, the Controller is obliged to provide the information within 30 days of receipt of the request. The Controller may extend this period by a further 60 days; you will be informed of the extension.
For repeated provision of PD requested by the buyer, the Controller may charge a reasonable fee corresponding to the administrative costs. The Controller is obliged to provide the buyer’s PD in the manner requested by the buyer or in accordance with the buyer’s request.
The Controller reserves the right to verify the buyer and establish whether the person concerned is the specific buyer. Verification consists of providing additional information, for example by answering security questions. Verification is important in connection with the provision of information about the PD processed by the Controller.
VII. Buyer’s right to lodge a motion to initiate proceedings
The buyer may lodge a motion to initiate proceedings pursuant to Section 100 of the Act if their rights are directly affected. The motion must identify the person submitting it, the person against whom it is directed, its subject matter, the rights alleged to have been infringed during the processing of personal data, and the supporting evidence.
A model motion will be published on the website of the Office for Personal Data Protection, Hraničná 12, 820 02 Bratislava. The Office will assess the submission within 30 days and issue a decision within 90 days, or may reasonably extend this period.
12. DO YOU HAVE ANY QUESTIONS?
If you have any questions or comments concerning the processing of personal data, you may contact us and we will be happy to answer your questions.
Controller’s contact details:
TopDizajn s.r.o.
Karpatské námestie 10
831 06 Bratislava
Company ID No.: 47 876 051
E-mail: info@topdizajn.sk Tel.: 0948 332 323
13. FINAL PROVISIONS
This information becomes valid and effective on 24 May 2018. The Controller reserves the right to amend these terms and conditions in the event of a change in the processing of PD within the company or in the event of a legislative change.