Issued by the company Grebnesor spol. s r.o.
I. Definitions
For the purposes of these terms, the following definitions apply:
“Controller” refers to Grebnesor spol. s r.o., with its registered office at Bratislavská 31, 010 01 Žilina, Slovak Republic, Company ID: 48193151, registered in the Commercial Register of the District Court Žilina, Section: Sro, Insert No. 64153/L, phone: 00421903622752, email: info@grebnesor.eu.
“Data Subject” refers to any individual who provides their personal data to the Controller for the purposes mentioned below, particularly a visitor to the Controller’s website or a customer of the Controller.
“Online Store” refers to the Controller’s store at https://www.grebnesor.eu/
“Regulation” refers to the European Parliament and Council Regulation (EU) No. 2016/679 of April 27, 2016, General Data Protection Regulation (GDPR).
“Act” refers to Slovak Act No. 18/2018 Coll. on Personal Data Protection, as amended.
II. Processing of Personal Data for the Purpose of Handling Orders and Using the Availability Tracking Feature (if available)
The personal data of the Data Subject, which the Controller processes for the purpose of concluding and fulfilling a contract based on an order placed by the Data Subject in the Controller’s Online Store, includes: name and surname, address, email, and phone contact of the Data Subject.
The legal basis for processing these voluntarily provided data is the contract with the Controller mentioned above, which could not be concluded without the Data Subject’s data.
Personal data will be processed for the duration of the Controller’s legally established obligations, i.e., at least for 10 years due to mandatory archival of accounting documents.
The processing of the Data Subject’s personal data may be carried out by a Processor who provides or may provide delivery services, web hosting services, management of these websites, management of the Controller’s CRM systems.
The processing of the Data Subject’s personal data will not involve automated decision-making or profiling, and the Controller does not intend to transfer the personal data to a third country, international organization, or third parties, except for the aforementioned Processors.
The Data Subject has the right to request access to their personal data from the Controller, its rectification, erasure, or restriction of processing, the right to object to processing, the right to data portability to another Controller, and the right to lodge a complaint with the Data Protection Authority if the Controller and/or Processor acts in violation of the Regulation and/or the Act.
The option to shop in the Online Store is not primarily intended for Data Subjects under the age of 16.
III. Processing of Personal Data for Newsletter Distribution
The personal data of the Data Subject that the Controller processes for the purpose of sending information about products, services, news, promotions, or other topics (newsletter) include the email address of the Data Subject.
The legal basis for processing this voluntarily provided data is
(a) The legitimate interest of the Controller in promoting its goods after the Data Subject makes a purchase in the Controller’s online store, where the newsletter is sent in accordance with § 116 section 15 of Act No. 452/2021 Coll. on Electronic Communications. The Data Subject has the option to unsubscribe from the newsletter at the time of making an order and subsequently at any time by clicking on the active link located at the end of each newsletter or by submitting a written request to the Controller’s email address,
(b) Consent from the Data Subject, who is not an existing customer of the Controller, is granted pursuant to § 13 section 1 letter a) of the Act in conjunction with Article 6 section 1 letter a) of the Regulation, and this consent can be revoked at any time by clicking on the active link located at the end of each newsletter or by submitting a written request to the Controller’s email address.
Personal data will be processed for the duration of the Data Subject’s interest in receiving newsletters from the Controller, i.e., for the duration of the purpose of their processing.
The processing of the Data Subject’s personal data may be carried out by a Processor who provides or may provide web hosting services, management of these websites, management of the Controller’s CRM systems, management of newsletter campaigns, or a Processor who provides technical solutions for managing newsletter campaigns for the Controller.
The processing of the Data Subject’s personal data will not involve automated decision-making or profiling, and the Controller does not intend to transfer the personal data to a third country, international organization, or third parties, except for the aforementioned Processors. The processing of the Data Subject’s personal data may involve the personalization of newsletters based on the Data Subject’s past orders (offers of complementary goods and services), which, however, is not based on predicting aspects of the Data Subject related to work performance, financial standing, health, etc.
The Data Subject has the right to request access to their personal data from the Controller, its rectification, erasure, or restriction of processing, the right to object to processing, the right to data portability to another Controller, and the right to lodge a complaint with the Data Protection Authority if the Controller and/or Processor acts in violation of the Regulation and/or the Act.
The newsletter is not primarily intended for Data Subjects under the age of 16.
IV. Processing of Personal Data for Registration in the Online Store
The personal data of the Data Subject that the Controller processes for the purpose of concluding and fulfilling a service contract related to registration, which includes creating a user account in the online store, gaining the ability to manage orders online, participating in the Controller’s loyalty programs, making future purchases without the need to re-enter contact details, and tracking purchase history, are: the first and last name, address, email, and phone contact of the Data Subject.
The legal basis for processing these voluntarily provided data is the above-mentioned contract with the Controller, which could not be concluded without the provision of the Data Subject’s data.
Personal data will be processed for the duration of the Data Subject’s interest in using services related to registration in the online store, i.e., for the duration of the purpose of their processing.
The processing of the Data Subject’s personal data may be carried out by a Processor who provides or may provide web hosting services, management of these websites, and management of the Controller’s CRM systems.
The processing of the Data Subject’s personal data will not involve automated decision-making or profiling, and the Controller does not intend to transfer the personal data to a third country, international organization, or third parties, except for the aforementioned Processors.
The Data Subject has the right to request access to their personal data from the Controller, its rectification, erasure, or restriction of processing, the right to object to processing, the right to data portability to another Controller, and the right to lodge a complaint with the Data Protection Authority if the Controller and/or Processor acts in violation of the Regulation and/or the Act.
The possibility of registration in the online store is not primarily intended for Data Subjects under the age of 16.
V. Review of Purchases in the Online Store and Use of Price Comparison Tools (if available)
The personal data of the Data Subject that the Controller processes for the purpose of publishing the purchase review submitted by the Data Subject in an anonymized form include: name or nickname, email address, and the purchase review of the Data Subject.
The processing of the personal data of the Data Subject may be entrusted to a processor who provides the Controller with a technical solution for obtaining purchase reviews and who publishes these reviews for the Controller, primarily the operator of an online price comparison tool.
The legal basis for processing this data is the legitimate interest of the Controller, which lies in verifying customer satisfaction to improve the services provided by the Controller for other customers.
Personal data will be processed for the duration of the Data Subject’s interest in publishing the review of their purchase.
The processing of the personal data of the Data Subject will not involve automated decision-making or profiling, and the Controller does not intend to transfer personal data to a third country, international organization, or third parties, except for the aforementioned processors.
The Data Subject primarily has the right to request access to their personal data from the Controller, to correct or delete it, to restrict processing, to object to processing, to data portability to another controller, as well as the right to lodge a complaint with the Data Protection Authority if the Controller and/or processor processes personal data in violation of the Regulation and/or the Act.
The form intended for reviewing purchases in the Online Store is not primarily intended for Data Subjects younger than 16 years of age.
VI. Processing of Personal Data for Analytical Purposes
The personal data of the Data Subject that the Controller processes with the help of third-party online analytical tools (primarily but not exclusively) for the analytical purposes listed below includes: email address and phone contact of the Data Subject, which the Data Subject voluntarily provides to the Controller.
Processing of the Data Subject’s personal data may be entrusted to a processor who provides technical solutions for data analysis to the Controller.
The legal basis for processing these data is the legitimate interest of the Controller, which lies in identifying the Data Subject and subsequently analyzing their user preferences in the Online Store for the purpose of improving it, as well as for subsequently tailoring advertisements to offer goods and services directly to the Data Subject.
Personal data will be processed for the duration of the Controller’s legitimate interest.
In the processing of the Data Subject’s personal data, there will be no automated decision-making or profiling, and the Controller does not intend to transfer personal data to a third country, international organization, or third parties, except for the processors mentioned above.
The Data Subject has the right to request access to their personal data from the Controller, its rectification, erasure, or restriction of processing, the right to object to processing, the right to data portability to another Controller, and the right to lodge a complaint with the Data Protection Authority if the Controller and/or Processor acts in violation of the Regulation and/or the Act.
The analysis of personal data within the above-mentioned purpose does not focus on Data Subjects under the age of 16.
VII. Processing of Personal Data Using a Quotation Request Form or Contact Form (if any of these forms are available)
The personal data of the Data Subject that the Controller processes when using a form intended to request a quote, or through the contact form in connection with expressing interest in receiving a quote, includes: name and surname, email address, phone number, and any other data that the Data Subject voluntarily provides in the contact form regarding the specific service.
The legal basis for processing these voluntarily provided data is the pre-contractual relationship between the Controller and the Data Subject, within which the Controller provides information about its services at the Data Subject’s request.
Personal data provided in connection with the submission of an inquiry by the Data Subject will be processed for the duration of the pre-contractual and, if applicable, contractual relationship between the Controller and the Data Subject, and further for the time necessary to defend the Controller’s legal claims related to the Controller’s activities.
In the processing of the Data Subject’s personal data, there will be no automated decision-making or profiling, and the Controller does not intend to transfer personal data to a third country, international organization, or third parties.
The Data Subject primarily has the right to request from the Controller access to their personal data, their correction or deletion, or restriction of processing, the right to object to processing, as well as the right to file a complaint with the Office for Personal Data Protection if the Controller and/or processor processes personal data in violation of the Regulation and/or Act.
Quotation request forms and contact forms are not primarily intended for visitors younger than 16 years of age.