Statement on personal data processing

The protection of personal data of the buyer, who is a natural person, is regulated by Regulation (EU) 2016/679 of the European Parliament and of the Council, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR").

The purpose of this document is to inform you, as a buyer, if you are purchasing goods as a natural person, about the processing of your personal data by our company as a seller and your related rights, in accordance with Article 12 et seq. of the GDPR.

This document also applies to the processing of your personal data based on your consent.

The processing of so-called cookies, with the exception of your rights, is governed by a separate statement of the controller published on the controller's website.

I. Personal data controller

The controller of your personal data is PECKA-MODELÁŘ sro, with its registered office at Stoupající 798/20, Prosek, 19000 Praha 9, Company ID: 27114295, Tax Identification Number: CZ27114295, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 97301, (hereinafter referred to as the " Controller "), which is also the seller.

II. Personal data processed and their sources

The Administrator processes personal data that it obtains directly from you, as a buyer, which you have filled in the order form in connection with the conclusion of a contractual or other legal relationship between you and the Administrator (in particular, this is a purchase contract), or when registering in your user account on the Administrator's website. This includes your following personal data:

first and last name;
identification number, tax identification number;
delivery address (if personal collection of goods is not agreed);
telephone number;
electronic mail address (email address).

Based on your consent to the processing of personal data, the administrator further processes the following personal data:

date of birth;
phone number and
electronic mail address (email address).

III. Purpose of processing personal data and legal basis for processing personal data

The administrator processes your personal data for the purposes included in your consent to the processing of personal data, negotiating the contractual relationship and performing the contract, fulfilling legal obligations applicable to the administrator, and protecting the rights and other important interests of the administrator (e.g. collecting the administrator's debts).

The administrator processes your personal data for the following purposes:

Your name, surname, identification number, tax identification number for the purposes of concluding a purchase contract with you and its performance, fulfilling legal obligations (e.g. keeping accounts, fulfilling obligations under tax regulations) and protecting the rights and other important interests of the administrator (e.g. debt collection),
delivery address for the purposes of fulfilling the contract (delivery of the shipment you ordered),
telephone number for the purposes of fulfilling the contract (contacting in the event of any problems with the shipment) and for marketing purposes (i.e. offering products and services of the seller or third parties) including sending commercial communications within the meaning of Act No. 480/2004 Coll., on certain information society services, in particular so-called birthday offers (discount on the seller's goods sent to the buyer in connection with his birthday),
e-mail address for the purposes of fulfilling the contract (for the purpose of sending confirmation of receipt of your order), for marketing purposes (i.e. offering products and services of the seller or third parties) including sending commercial communications within the meaning of Act No. 480/2004 Coll., on certain information society services, in particular so-called birthday offers (discount on the seller's goods sent to the buyer in connection with his birthday) and for the purposes of sending a purchase satisfaction questionnaire by Heureka Shopping sro, Seznam.cz, as and Google LLC.
date of birth for the purpose of sending the so-called birthday offer (discount on the seller's goods sent to the buyer in connection with his birthday).

This personal data of yours is a requirement for the proper performance of the concluded purchase contract:

Your name, surname, identification number, tax identification number - without this information it will not be possible to conclude a purchase contract with you,
delivery address - without this information it will not be possible to deliver the goods to you,
telephone number - without this information, the administrator will not be able to contact you if necessary, and
e-mail address - without this information, the administrator will not be able to accept receipt of your order.

The legal basis for processing your personal data is the performance of the contract you have concluded with the administrator, as well as the legitimate interests of the administrator (primarily for the purpose of recording contractual relationships and statistical purposes, in order to protect the rights of the administrator against unlawful activity, including IT security, recovery of the administrator's claims) and compliance with legal requirements (in particular, compliance with requirements under personal data protection regulations (e.g. GDPR), accounting, compliance with obligations under tax regulations).

A separate legal basis for the processing of your personal data is your consent, for the purposes specified in this consent. Your consent is voluntary and its failure to provide it has no effect on the fulfillment of your order.

If the legal basis for the processing of your personal data is your consent, you may withdraw this consent at any time free of charge by using the contact details of the controller below. However, the withdrawal of your consent does not affect the lawfulness of the processing based on your consent given before its withdrawal. The withdrawal of consent also does not affect the processing of your personal data that the controller processes on a legal basis other than your consent.

IV. Recipients of personal data

Your personal data is processed primarily by the administrator, who does not use the services of any personal data processor, with the exception stated below.

Your personal data is thus accessible to the administrator's employees and other cooperating persons, in particular entities involved in the fulfillment of your order (e.g. shipping companies), entities providing legal and accounting services, the entity managing the website (e-shop) for the administrator, and the entity managing the administrator's accounting system. Based on your consent, Heureka Shopping sro, IČO 02387727 (www.heurekashopping.cz), Seznam.cz, as, IČO 26168685, and Google LLC, reg. no. 3582691, with registered office at 251 Little Falls Dr, Wilmington, DE 19808, USA, may have access to your e-mail address for the purpose of sending a satisfaction questionnaire.

The Administrator uses Google Ads conversion measurement services from Google LLC, which includes the enhanced conversion functionality to increase the accuracy of measured conversions. Marketing data about website visitors is transmitted to Google LLC in order to improve the relevance of conversion measurement. Before being sent to Google LLC, this data is encrypted to ensure maximum protection. Google LLC may pair it with its database for the purpose of more precise conversion measurement. Information about visitors to the Administrator's website is thus transmitted to Google LLC, specifically the data that you enter into forms on the Administrator's website. The transmission to Google LLC occurs based on consent to the use of personal data in the cookie bar.

The Administrator hereby informs you that your personal data will not be transferred by the Administrator or other recipients of personal data to a state that is not a member state of the European Union or to an international organization. The exception is cases where you request that the ordered goods be delivered to a state that is not a member state of the European Union - then the transfer of personal data to this state is the Administrator's obligation arising from the contract concluded with you in terms of the Administrator's obligation to properly fulfill the contract. The Administrator then transfers your personal data to the transport company responsible for delivering the goods to this state, and this company is obliged to take all appropriate measures to ensure that your personal data is not misused and is protected throughout the entire period of their processing.

The Administrator declares that no automated decision-making, including profiling, takes place in relation to your personal data.

V. Method of processing and protection of personal data

The controller processes your personal data through its employees or other cooperating persons at the controller's registered office, its premises and branches. Processing takes place using computer technology or, if applicable, manually for personal data in paper form, in compliance with all security principles for the management and processing of personal data. For this purpose, the controller has adopted technical and organizational measures to ensure the protection of personal data, in particular measures to prevent unauthorized or accidental access to your personal data, their alteration, destruction or loss, unauthorized transfers, their unauthorized processing, as well as other misuse of your personal data.

All entities to which your personal data may be disclosed respect your right to privacy and are obliged to comply with applicable legal regulations regarding the protection of personal data.

VI. Processing period of personal data

Your personal data will be processed for a reasonable period of time taking into account the purpose of the processing.

For the purposes of recording contracts and accepted performance, the administrator will record your personal data for a period of 3 years from the due date of payment of the purchase price.

The administrator will process your personal data for the purpose of sending commercial communications (newsletters) and birthday offers until you object to such sending, for a maximum period of 5 years from your last purchase.

The administrator will process your e-mail address for the purpose of sending the satisfaction questionnaire until it is transferred to Heureka Shopping sro, Seznam.cz, as and Google LLC.

The controller will process your personal data after the expiry of the above-mentioned periods, or after your consent has been withdrawn, to the extent necessary to prove the legitimacy of the processing of your personal data, in cases of raising probable legal claims and fulfilling legal obligations (e.g. Section 31 of Act No. 563/1991 Coll., on accounting, or Section 35 of Act No. 235/2004 Coll., on value added tax).

VII. Rights of data subjects

As a data subject, you have the following rights under the GDPR, which the controller is obliged to explicitly inform you about:

Right to access personal data

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed by the controller and, if so, you have the right to access those personal data and the following information:

for what purposes does the controller process your personal data;
which your personal data is processed by the controller;
to whom your personal data is disclosed;
the period of processing your personal data;
the existence of the right to request from the administrator the correction or deletion of your personal data or the restriction of their processing or to object to their processing;
the right to file a complaint with a supervisory authority;
any available information about the source of your personal data, if it was not obtained from you;
whether automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, is taking place, and if so, you have the right to obtain information regarding the procedure used, as well as the significance and anticipated consequences of such processing for you.

The controller will process your request for access to your personal data free of charge. However, if your request is manifestly unfounded or excessive, in particular because it is repeated, the controller may refuse to comply with your request or impose a reasonable fee on you taking into account the administrative costs associated with providing the requested information.

Right to rectification of personal data

You have the right to have the controller correct your inaccurate personal data without undue delay. You also have the right to have the controller complete your personal data without undue delay if it is incomplete.

Right to erasure of personal data

You have the right to have the controller erase your personal data without undue delay if one of the following reasons applies:

The controller no longer needs your personal data for the purposes for which they were processed;
you withdraw your consent to the processing of personal data, provided that this is personal data for the processing of which your consent is necessary, and at the same time the controller has no other reason why it no longer needs to process this data (e.g. for the purpose of collecting debts owed to you);
you exercise your right to object to processing (see letter f) below) of your personal data processed on the basis of the controller's legitimate interests and the controller no longer finds any legitimate interests that would justify the processing;
you exercise your right to object to the processing (see letter f) below) of your personal data processed for the purpose of the controller's direct marketing;
the processing of your personal data is no longer in accordance with applicable legal regulations.

The right to erasure does not apply in cases where the processing of your personal data is still necessary for compliance with a legal obligation of the controller (typically imposed by law), for archiving purposes in the public interest, for scientific, historical or statistical purposes, or for the establishment, exercise or defence of legal claims of the controller (e.g. recovery of claims of the controller).

Right to restriction of processing of personal data

You have the right to request that the controller not process your personal data for a limited period of time if one of the following conditions is met:

you dispute the accuracy of your personal data, for the period necessary for the controller to verify the accuracy of your personal data;
if the controller processes your personal data without sufficient legal basis, but you request restriction of processing and not their deletion (see letter c) above);
the controller no longer needs to process your personal data, but you require them for the establishment, exercise or defence of your legal claims;
for the period of verification of the legitimacy of your objection to the processing of your personal data for the purposes of the controller's legitimate interests (see letter f) below).

Right to data portability

You have the right to request that the controller provide you with your personal data that has been collected from you for the purpose of entering into and performing a contract with you or for the processing of which you have consented. However, you may only obtain your personal data if the controller processes it automatically in electronic form. Your personal data will then be provided to you in a structured, commonly used and machine-readable format.

Right to object to processing

You have the right to object to the processing of your personal data if the controller processes it based on its legitimate interests. The controller will grant your objection unless it demonstrates compelling legitimate grounds for the processing of your personal data.

You have the right to object to the processing of your personal data if the controller processes it for the purposes of its direct marketing (typically promoting its goods or services). The controller will always comply with your objection in this case.

Right to file a complaint

You have the right, regardless of all the above rights, to file a complaint against the processing of your personal data by the controller with the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7 (more at www.uoou.cz), in particular if you believe that your personal data is being processed in violation of generally binding legal regulations.

VIII. Information for data subjects

If a personal data breach is likely to result in a high risk to your rights and freedoms, the controller will notify you of the breach without undue delay. However, this notification is not mandatory in cases where:

the controller has implemented appropriate technical and organizational protection measures and these measures were applied to your personal data affected by the personal data breach;
the controller has taken subsequent measures to ensure that the high risk to your rights and freedoms is no longer likely to materialise;
it would require a disproportionate effort for the controller. In such a case, you will be informed by means of a public notice or similar measure.